Function cert_to_dict

crates/stdlib/src/openssl/cert.rs:188–342

Helper to convert X509 to dict (for getpeercert with binary=False)

(vm: &VirtualMachine, cert: &X509Ref)

    // Helper to convert X509 to dict (for getpeercert with binary=False)
    fn cert_to_dict(vm: &VirtualMachine, cert: &X509Ref) -> PyResult {
        let dict = vm.ctx.new_dict();

        dict.set_item("subject", name_to_py(vm, cert.subject_name())?, vm)?;
        dict.set_item("issuer", name_to_py(vm, cert.issuer_name())?, vm)?;
        // X.509 version: OpenSSL uses 0-based (0=v1, 1=v2, 2=v3) but Python uses 1-based (1=v1, 2=v2, 3=v3)
        dict.set_item("version", vm.new_pyobj(cert.version() + 1), vm)?;

        let serial_num = cert
            .serial_number()
            .to_bn()
            .and_then(|bn| bn.to_hex_str())
            .map_err(|e| convert_openssl_error(vm, e))?;
        // Serial number must have even length (each byte = 2 hex chars)
        // BigNum::to_hex_str() strips leading zeros, so we need to pad
        let serial_str = serial_num.to_string();
        let serial_str = if serial_str.len() % 2 == 1 {
            format!("0{}", serial_str)
        } else {
            serial_str
        };
        dict.set_item("serialNumber", vm.ctx.new_str(serial_str).into(), vm)?;

        dict.set_item(
            "notBefore",
            vm.ctx.new_str(cert.not_before().to_string()).into(),
            vm,
        )?;
        dict.set_item(
            "notAfter",
            vm.ctx.new_str(cert.not_after().to_string()).into(),
            vm,
        )?;

        if let Some(names) = cert.subject_alt_names() {
            let san: Vec<PyObjectRef> = names
                .iter()
                .map(|gen_name| {
                    if let Some(email) = gen_name.email() {
                        vm.new_tuple((ascii!("email"), email)).into()
                    } else if let Some(dnsname) = gen_name.dnsname() {
                        vm.new_tuple((ascii!("DNS"), dnsname)).into()
                    } else if let Some(ip) = gen_name.ipaddress() {
                        // Parse IP address properly (IPv4 or IPv6)
                        let ip_str = if ip.len() == 4 {
                            // IPv4
                            format!("{}.{}.{}.{}", ip[0], ip[1], ip[2], ip[3])
                        } else if ip.len() == 16 {
                            // IPv6 - format with all zeros visible (not compressed)
                            let ip_addr =
                                std::net::Ipv6Addr::from(<[u8; 16]>::try_from(&ip[0..16]).unwrap());
                            let s = ip_addr.segments();
                            format!(
                                "{:X}:{:X}:{:X}:{:X}:{:X}:{:X}:{:X}:{:X}",
                                s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7]
                            )
                        } else {
                            // Fallback for unexpected length