From 6e2dcf9bfd0f4492ab0b7a4de52b0043d8ed2b9a Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 21 Aug 2026 13:49:09 +0200 Subject: [PATCH] Fix handling of CRL without next_update We don't seem to have any CRL without a next_update field, but cryptography 40.0.2 supports that. Signed-off-by: Gilles Peskine --- scripts/audit-validity-dates.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/audit-validity-dates.py b/scripts/audit-validity-dates.py index 123f7bdc0..660a53b91 100755 --- a/scripts/audit-validity-dates.py +++ b/scripts/audit-validity-dates.py @@ -105,8 +105,10 @@ class AuditData: # CertificateRevocationList expires after "next_update" # CertificateRevocationList is invalid before "last_update" elif self.data_type == DataType.CRL: - self.not_valid_after = x509_obj.next_update assert isinstance(x509_obj, cryptography.x509.CertificateRevocationList) + self.not_valid_after = \ + datetime.datetime.max if x509_obj.next_update is None else \ + x509_obj.next_update self.not_valid_before = x509_obj.last_update # CertificateSigningRequest is always valid. elif self.data_type == DataType.CSR: