`permitted_public_key_algorithms` and `permitted_signature_algorithms` are not exposed when verifying a x509 certificate
Author: twillekeCreated Sep 3, 2025Updated Jun 28, 2026
Labelsx509
I am trying to verify a certificate that has a ED25519 key and the certificate authority also has a ED25519 key.
But even when the certificate is valid I get the error:
cryptography.hazmat.bindings._rust.x509.VerificationError: validation failed: candidates exhausted: Forbidden public key algorithm: AlgorithmIdentifier { oid: DefinedByMarker(PhantomData<asn1::object_identifier::ObjectIdentifier>), params: Ed25519 }This seems to occur because when the Policy is create, the WebPKI defaults are selected and the WebPKI does not allow ED25519 keys.
https://github.com/pyca/cryptography/blob/1a952fc144b74c6e09577865184ad3fc8ad24b15/src/rust/cryptography-x509-verification/src/policy/mod.rs#L257-L258
I have found no way to set these parameters on the python side. Is this an oversight or is it meant that way ?
Source: pyca/cryptography