x509kit 0.3.1__tar.gz → 0.3.2__tar.gz

{x509kit-0.3.1/src/x509kit.egg-info → x509kit-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: x509kit
-Version: 0.3.1
+Version: 0.3.2
 Summary: Pure-Python X.509 / PKCS#10 / CRL / OCSP / PKCS#12 toolkit — stdlib only
 Author-email: ArtProsto <artemkamirn@mail.ru>
 License: MIT

{x509kit-0.3.1 → x509kit-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "x509kit"
-version = "0.3.1"
+version = "0.3.2"
 description = "Pure-Python X.509 / PKCS#10 / CRL / OCSP / PKCS#12 toolkit — stdlib only"
 readme = "README.md"
 requires-python = ">=3.9"

{x509kit-0.3.1 → x509kit-0.3.2}/src/x509kit/__init__.py

@@ -25,6 +25,10 @@ x509kit — X.509 / PKCS#10 / PKCS#12 / RSA / Ed25519 / ECDSA / CRL / OCSP / NC.
     k.sign_pss(msg, "sha256")      / k.verify_pss(msg, sig, "sha256")
     k.size_bits / k.is_private / k.weak
 
+    # Шорткат на всех трёх типах ключей:
+    k.to_pkcs12(cert, chain=[ca], password="...", name="alice")
+        ^ возвращает PKCS12, можно .save("alice.p12")
+
     Ed25519Keys.generate() / Ed25519Keys(seed=bytes(32))
     Ed25519Keys.from_pem(pem, private=True, password="...")
     k.sign(msg) / k.verify(msg, sig) / k.pub
@@ -55,6 +59,10 @@ x509kit — X.509 / PKCS#10 / PKCS#12 / RSA / Ed25519 / ECDSA / CRL / OCSP / NC.
     c.weak_hash / c.has_unknown_critical
     c.verify_signature(issuer) / c.is_self_signed()
     c.to_pem() / c.to_der()
+    c.info()                            — вывод в стиле openssl x509 -text
+    Cert.from_url("https://example.com") — скачать и распарсить сертификат
+        ^ accepts "example.com" или "https://host:port"
+        ^ возвращает Cert
 
     CACert.create_self_signed(subject, keys, days=3650, path_len=None)
     CACert.from_cert(cert, signing_key=None)
@@ -171,6 +179,11 @@ x509kit — X.509 / PKCS#10 / PKCS#12 / RSA / Ed25519 / ECDSA / CRL / OCSP / NC.
     ASN1 — низкоуровневый DER-парсер (parse, as_int, as_oid, ...)
         ^ защита: _MAX_DER_SIZE = 50 MB, _MAX_DEPTH = 32
     canonicalize_name(name) / names_equal(a, b)   — RFC 4518
+
+    Name.from_string("CN=x, O=y, C=XX")           — RFC 4514 parser
+        ^ порядок "от конкретного к общему"
+        ^ поддерживает escape: "CN=with\\, comma, O=Org"
+    Name.from_dict({...})                          — из dict
     san_extension(dns_names=[], ips=[], emails=[], uris=[])
     validate_hostname(cert, "example.com")        — RFC 6125
     load_pem_certs / load_pem_csrs / load_pem_bundle / load_pem_crls
@@ -180,6 +193,8 @@ x509kit — X.509 / PKCS#10 / PKCS#12 / RSA / Ed25519 / ECDSA / CRL / OCSP / NC.
 
     CertBundle([c1, c2, ...])
         .from_pem(data) / .from_file(path) / .to_pem() / .save(path)
+        .to_pkcs12(key, password="...", name="...")
+            ^ certs[0] — leaf, certs[1:] — chain; возвращает PKCS12
 
     EKU_OIDS — {serverAuth, clientAuth, codeSigning, emailProtection,
                 timeStamping, OCSPSigning, anyExtendedKeyUsage, ...}

{x509kit-0.3.1 → x509kit-0.3.2}/src/x509kit/x509.py

@@ -44,7 +44,7 @@ import socket
 import unicodedata
 import warnings as _warnings
 
-__version__ = "0.3.1"
+__version__ = "0.3.2"
 
 
 # ======================================================================
@@ -361,6 +361,21 @@ KNOWN_EXTENSION_OIDS = {
     OID_AIA,
 }
 
+
+EXT_NAMES = {
+    "2.5.29.17":         "X509v3 Subject Alternative Name",
+    "2.5.29.19":         "X509v3 Basic Constraints",
+    "2.5.29.15":         "X509v3 Key Usage",
+    "2.5.29.37":         "X509v3 Extended Key Usage",
+    "2.5.29.30":         "X509v3 Name Constraints",
+    "2.5.29.14":         "X509v3 Subject Key Identifier",
+    "2.5.29.35":         "X509v3 Authority Key Identifier",
+    "2.5.29.31":         "X509v3 CRL Distribution Points",
+    "2.5.29.20":         "X509v3 CRL Number",
+    "2.5.29.21":         "X509v3 CRL Reason Code",
+    "1.3.6.1.5.5.7.1.1": "Authority Information Access",
+}
+
 # RFC 5280 §5.3.1 reason codes
 CRL_REASONS = {
     "unspecified":          0,
@@ -475,6 +490,20 @@ def _escape_dn(v: str) -> str:
     return "".join(out)
 
 
+def _unescape_dn(s: str) -> str:
+    """RFC 4514: убрать escape-последовательности в значении DN."""
+    out = []
+    i = 0
+    while i < len(s):
+        if s[i] == "\\" and i + 1 < len(s):
+            out.append(s[i + 1])
+            i += 2
+            continue
+        out.append(s[i])
+        i += 1
+    return "".join(out)
+
+
 def _encode_rdn(short_or_oid: str, value: str) -> bytes:
     oid = ATTR_OIDS.get(short_or_oid, short_or_oid)
     if not isinstance(value, str):
@@ -568,6 +597,72 @@ class Name:
 
     def __hash__(self):
         return hash(self.raw)
+
+    @classmethod
+    def from_string(cls, s):
+        r"""RFC 4514: разобрать строку DN в Name.
+
+        Порядок в строке — от конкретного к общему:
+            "CN=example.com, O=MyOrg, C=XX"
+
+        Эквивалентно Name.from_dict({"C": "XX", "O": "MyOrg", "CN": "example.com"}).
+
+        Поддерживает escape-последовательности:
+            CN=with\, comma, O=Org
+            CN=with\backslash
+        """
+        if not s or not s.strip():
+            raise X509ParseError("Name.from_string: empty string")
+
+        # Разбить по неэкранированным запятым
+        parts, cur, i = [], [], 0
+        while i < len(s):
+            c = s[i]
+            if c == "\\" and i + 1 < len(s):
+                cur.append(c)
+                cur.append(s[i + 1])
+                i += 2
+                continue
+            if c == ",":
+                parts.append("".join(cur))
+                cur = []
+                i += 1
+                continue
+            cur.append(c)
+            i += 1
+        if cur:
+            parts.append("".join(cur))
+
+        rdns = []
+        for part in parts:
+            part = part.strip()
+            if not part:
+                continue
+            key_b, val_b, in_val, j = [], [], False, 0
+            while j < len(part):
+                c = part[j]
+                if c == "\\" and j + 1 < len(part):
+                    (val_b if in_val else key_b).append(c)
+                    (val_b if in_val else key_b).append(part[j + 1])
+                    j += 2
+                    continue
+                if c == "=" and not in_val:
+                    in_val = True
+                    j += 1
+                    continue
+                (val_b if in_val else key_b).append(c)
+                j += 1
+            if not in_val:
+                raise X509ParseError(f"Name.from_string: missing '=' in {part!r}")
+            k = "".join(key_b).strip()
+            v = _unescape_dn("".join(val_b).strip())
+            oid = ATTR_OIDS.get(k, k)
+            rdns.append((oid, v))
+
+        rdn_list = [_encode_rdn(oid, val) for oid, val in reversed(rdns)]
+        node, _ = ASN1.parse(der_seq(*rdn_list))
+        return cls(node)
+
 class AlgorithmIdentifier:
     __slots__ = ("oid", "params", "raw")
 
@@ -732,7 +827,6 @@ def _parse_pss_params(params_node):
             salt_len = child.children[0].as_int()
     return (hash_name, salt_len)
 
-
 class RSAKeys:
     __slots__ = ("n", "e", "d", "p", "q", "dp", "dq", "qinv")
 
@@ -950,6 +1044,27 @@ class RSAKeys:
         self.dp = 0; self.dq = 0; self.qinv = 0
 
 
+    def to_pkcs12(self, cert, chain=None, password="", name=None,
+                  iterations=2048, cipher="aes-256-cbc"):
+        """Упаковать этот ключ + сертификат (+цепочку) в PKCS#12.
+
+        Возвращает PKCS12. Для сохранения:
+            key.to_pkcs12(cert, chain=[ca]).save("client.p12")
+        """
+        b = PKCS12Builder()
+        b.set_key(self)
+        b.set_cert(cert)
+        if chain:
+            b.add_chain(*chain)
+        b.set_password(password)
+        if name:
+            b.set_name(name)
+        b.set_iterations(iterations)
+        if cipher != "aes-256-cbc":
+            b.set_cipher(cipher)
+        return b.build()
+
+
 # ======================================================================
 #  Ed25519Keys (RFC 8032)
 # ======================================================================
@@ -1196,6 +1311,27 @@ class Ed25519Keys:
         self.seed = None
 
 
+    def to_pkcs12(self, cert, chain=None, password="", name=None,
+                  iterations=2048, cipher="aes-256-cbc"):
+        """Упаковать этот ключ + сертификат (+цепочку) в PKCS#12.
+
+        Возвращает PKCS12. Для сохранения:
+            key.to_pkcs12(cert, chain=[ca]).save("client.p12")
+        """
+        b = PKCS12Builder()
+        b.set_key(self)
+        b.set_cert(cert)
+        if chain:
+            b.add_chain(*chain)
+        b.set_password(password)
+        if name:
+            b.set_name(name)
+        b.set_iterations(iterations)
+        if cipher != "aes-256-cbc":
+            b.set_cipher(cipher)
+        return b.build()
+
+
 # ======================================================================
 #  ECDSA — P-256, P-384, P-521, secp256k1
 # ======================================================================
@@ -1586,6 +1722,27 @@ class ECDSAKeys:
         self.d = None
 
 
+    def to_pkcs12(self, cert, chain=None, password="", name=None,
+                  iterations=2048, cipher="aes-256-cbc"):
+        """Упаковать этот ключ + сертификат (+цепочку) в PKCS#12.
+
+        Возвращает PKCS12. Для сохранения:
+            key.to_pkcs12(cert, chain=[ca]).save("client.p12")
+        """
+        b = PKCS12Builder()
+        b.set_key(self)
+        b.set_cert(cert)
+        if chain:
+            b.add_chain(*chain)
+        b.set_password(password)
+        if name:
+            b.set_name(name)
+        b.set_iterations(iterations)
+        if cipher != "aes-256-cbc":
+            b.set_cipher(cipher)
+        return b.build()
+
+
 # ======================================================================
 #  SPKI
 # ======================================================================
@@ -2661,6 +2818,114 @@ class Cert:
 
     def __hash__(self):
         return hash(self.der)
+
+
+    @classmethod
+    def from_url(cls, url, port=None, timeout=5, verify=False):
+        """Загрузить сертификат с HTTPS-сервера.
+
+        url — "https://example.com" или просто "example.com"
+        verify=False (default) — принять любой сертификат (для инспекции)
+        verify=True — упасть, если сертификат невалиден
+
+        Возвращает Cert.
+        """
+        import ssl as _ssl
+        from urllib.parse import urlparse
+
+        if "://" in url:
+            parsed = urlparse(url)
+            host = parsed.hostname
+            if port is None:
+                port = parsed.port or 443
+        else:
+            host = url
+            if port is None:
+                port = 443
+        if not host:
+            raise X509Error(f"Cert.from_url: cannot parse host from {url!r}")
+
+        if verify:
+            ctx = _ssl.create_default_context()
+        else:
+            ctx = _ssl._create_unverified_context()
+
+        with socket.create_connection((host, port), timeout=timeout) as sock:
+            with ctx.wrap_socket(sock, server_hostname=host) as ssock:
+                der = ssock.getpeercert(binary_form=True)
+
+        return cls(der)
+
+    def info(self):
+        """Текстовое представление в стиле `openssl x509 -text`."""
+        def _fmt_time(dt):
+            return dt.strftime("%b %d %H:%M:%S %Y GMT")
+
+        lines = []
+        lines.append("Certificate:")
+        lines.append("    Data:")
+        lines.append(f"        Version: {self.version} (0x{self.version - 1:x})")
+        lines.append(f"        Serial Number: {self.serial} (0x{self.serial:x})")
+        lines.append(f"        Signature Algorithm: {self.signature_algorithm_name}")
+        lines.append(f"        Issuer: {self.issuer}")
+        lines.append( "        Validity")
+        lines.append(f"            Not Before: {_fmt_time(self.not_before)}")
+        lines.append(f"            Not After : {_fmt_time(self.not_after)}")
+        lines.append(f"        Subject: {self.subject}")
+
+        key = self.public_key
+        lines.append("        Subject Public Key Info:")
+        if isinstance(key, RSAKeys):
+            lines.append("            Public Key Algorithm: rsaEncryption")
+            lines.append(f"                Public-Key: ({key.size_bits} bit)")
+            h = key.n.to_bytes((key.n.bit_length() + 7) // 8, "big").hex()
+            lines.append("                Modulus:")
+            for i in range(0, len(h), 64):
+                lines.append(f"                    {h[i:i+64]}")
+            lines.append(f"                Exponent: {key.e} (0x{key.e:x})")
+        elif isinstance(key, Ed25519Keys):
+            lines.append("            Public Key Algorithm: ED25519")
+            lines.append("                ED25519 Public-Key:")
+            h = key.pub.hex()
+            for i in range(0, len(h), 64):
+                lines.append(f"                    {h[i:i+64]}")
+        elif isinstance(key, ECDSAKeys):
+            lines.append("            Public Key Algorithm: id-ecPublicKey")
+            lines.append(f"                ASN1 OID: {key.curve_oid}")
+            size = key.curve["size"]
+            x, y = key.point
+            xh = x.to_bytes(size, "big").hex()
+            yh = y.to_bytes(size, "big").hex()
+            lines.append("                pub:")
+            for i in range(0, len(xh), 64):
+                lines.append(f"                    {xh[i:i+64]}")
+            for i in range(0, len(yh), 64):
+                lines.append(f"                    {yh[i:i+64]}")
+        else:
+            lines.append(f"            Public Key Algorithm: {self.key_algorithm_oid}")
+
+        if self.extensions:
+            lines.append("        X509v3 extensions:")
+            for ext in self.extensions:
+                name = EXT_NAMES.get(ext.oid, ext.oid)
+                crit = " critical" if ext.critical else ""
+                lines.append(f"            {name}:{crit}")
+                v = ext.value
+                if v:
+                    hexed = v.hex()
+                    if len(hexed) > 64:
+                        lines.append(f"                {hexed[:64]}...")
+                    else:
+                        lines.append(f"                {hexed}")
+
+        lines.append(f"    Signature Algorithm: {self.signature_algorithm_name}")
+        sig_hex = self.signature.hex()
+        for i in range(0, len(sig_hex), 64):
+            lines.append(f"        {sig_hex[i:i+64]}")
+
+        return "\n".join(lines)
+
+
 def _sign_and_build_alg(key, data, hash_name="sha256", sig_scheme="pkcs1v15"):
     """Подписать `data` и вернуть (AlgorithmIdentifier DER, signature bytes)."""
     if not isinstance(key, (RSAKeys, Ed25519Keys, ECDSAKeys)):
@@ -3289,6 +3554,30 @@ class CertBundle:
     def __repr__(self):       return f"<CertBundle {len(self.certs)} certs>"
 
 
+    def to_pkcs12(self, key, password="", name=None, iterations=2048,
+                  cipher="aes-256-cbc"):
+        """Собрать PKCS#12 из цепочки: certs[0] — leaf, остальные — chain.
+
+        key — приватный ключ leaf'а.
+        """
+        if not self.certs:
+            raise X509Error("CertBundle.to_pkcs12: empty bundle")
+        leaf = self.certs[0]
+        chain = self.certs[1:]
+        b = PKCS12Builder()
+        b.set_key(key)
+        b.set_cert(leaf)
+        if chain:
+            b.add_chain(*chain)
+        b.set_password(password)
+        if name:
+            b.set_name(name)
+        b.set_iterations(iterations)
+        if cipher != "aes-256-cbc":
+            b.set_cipher(cipher)
+        return b.build()
+
+
 # ======================================================================
 #  CRLBuilder — выпуск CRL
 # ======================================================================

{x509kit-0.3.1 → x509kit-0.3.2/src/x509kit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: x509kit
-Version: 0.3.1
+Version: 0.3.2
 Summary: Pure-Python X.509 / PKCS#10 / CRL / OCSP / PKCS#12 toolkit — stdlib only
 Author-email: ArtProsto <artemkamirn@mail.ru>
 License: MIT

{x509kit-0.3.1 → x509kit-0.3.2}/test_all.py

@@ -36,6 +36,7 @@ import sys
 import traceback
 
 from x509kit import (
+    PKCS12,
     RSAKeys, Ed25519Keys, ECDSAKeys,
     Cert, CACert, CSR, CertBundle,
     CRL, CRLBuilder, CRL_REASONS,
@@ -986,6 +987,173 @@ def test_pem_roundtrip():
 #  Main
 # ======================================================================
 
+
+# ======================================================================
+#  16. Новые фичи: from_string, from_url, info, to_pkcs12
+# ======================================================================
+
+def test_name_from_string():
+    hr("16. Name.from_string (RFC 4514)")
+
+    n1 = Name.from_string("CN=example.com, O=MyOrg, C=XX")
+    n2 = Name.from_dict({"C": "XX", "O": "MyOrg", "CN": "example.com"})
+    T.expect("round-trip == from_dict", n1.raw == n2.raw,
+             f"\n      from_string: {n1}\n      from_dict:   {n2}")
+    T.expect("str содержит CN", "CN=example.com" in str(n1))
+
+    n3 = Name.from_string(str(n2))
+    T.expect("round-trip через str", n3.raw == n2.raw)
+
+    n4 = Name.from_string(r"CN=with\, comma, O=Org")
+    T.expect("escape запятой", n4.get("CN") == "with, comma",
+             f"got: {n4.get('CN')!r}")
+
+    n5 = Name.from_string(r"CN=with\\backslash")
+    T.expect("escape backslash", n5.get("CN") == r"with\backslash",
+             f"got: {n5.get('CN')!r}")
+
+    try:
+        Name.from_string("")
+        T.fail("пустая строка → X509Error", "не бросило")
+    except X509Error:
+        T.ok("пустая строка → X509Error")
+
+    try:
+        Name.from_string("no-equals-sign")
+        T.fail("нет '=' → X509Error", "не бросило")
+    except X509Error:
+        T.ok("нет '=' → X509Error")
+
+
+def test_cert_from_url():
+    hr("17. Cert.from_url")
+
+    T.expect("Cert.from_url определён", hasattr(Cert, "from_url"))
+
+    try:
+        cert = Cert.from_url("example.com", timeout=5)
+        T.expect("возвращает Cert", isinstance(cert, Cert))
+        T.expect("subject есть", cert.subject.get("CN") is not None)
+        T.expect("SAN есть", len(cert.san) > 0)
+    except Exception as e:
+        T.skip("Cert.from_url — нет сети", str(e)[:60])
+
+    try:
+        Cert.from_url("", timeout=2)
+        T.fail("пустой URL → X509Error", "не бросило")
+    except X509Error:
+        T.ok("пустой URL → X509Error")
+    except Exception as e:
+        T.ok(f"пустой URL → {type(e).__name__}")
+
+
+def test_cert_info():
+    hr("18. Cert.info() — openssl x509 -text style")
+
+    key = Ed25519Keys.generate()
+    cert = (CertificateBuilder()
+        .add_subject({"C": "XX", "O": "Info", "CN": "info.example"})
+        .add_public_key(key)
+        .add_serial_random().add_validity(days=30)
+        .add_san_dns("info.example")
+        .self_signed().sign(key))
+
+    info = cert.info()
+
+    checks = [
+        ("начинается с 'Certificate:'", info.startswith("Certificate:")),
+        ("есть 'Version: 3'",           "Version: 3" in info),
+        ("есть 'Serial Number:'",       "Serial Number:" in info),
+        ("есть 'Signature Algorithm:'", "Signature Algorithm:" in info),
+        ("есть 'Issuer:'",              "Issuer:" in info),
+        ("есть 'Validity'",             "Validity" in info),
+        ("есть 'Not Before'",           "Not Before:" in info),
+        ("есть 'Not After'",            "Not After :" in info),
+        ("есть 'Subject:'",             "Subject:" in info),
+        ("есть 'Subject Public Key Info:'",
+         "Subject Public Key Info:" in info),
+        ("есть 'Public Key Algorithm: ED25519'",
+         "Public Key Algorithm: ED25519" in info),
+        ("есть 'X509v3 extensions:'",   "X509v3 extensions:" in info),
+        ("есть 'X509v3 Subject Alternative Name'",
+         "X509v3 Subject Alternative Name" in info),
+        ("есть SAN содержимое",         "info.example" in info),
+    ]
+    for label, ok in checks:
+        T.expect(label, ok)
+
+
+def test_pkcs12_shortcuts():
+    hr("19. PKCS#12 шорткаты")
+
+    ca_key = Ed25519Keys.generate()
+    ca = (CertificateBuilder(is_ca=True)
+        .add_subject({"CN": "Shortcut CA"})
+        .add_public_key(ca_key)
+        .add_serial_random().add_validity(days=365)
+        .add_basic_constraints(path_len=0)
+        .add_key_usage("keyCertSign", "cRLSign")
+        .self_signed().sign(ca_key))
+
+    leaf_key = Ed25519Keys.generate()
+    leaf = (CertificateBuilder()
+        .add_subject({"CN": "shortcut.example"})
+        .add_issuer(ca).add_public_key(leaf_key)
+        .add_serial_random().add_validity(days=30)
+        .add_san_dns("shortcut.example")
+        .sign(ca_key))
+
+    # key.to_pkcs12
+    p12 = leaf_key.to_pkcs12(leaf, chain=[ca], password="hunter2",
+                             name="shortcut")
+    T.expect("key.to_pkcs12 → PKCS12", isinstance(p12, PKCS12))
+    T.expect("to_pkcs12: MAC valid", p12.verify_mac())
+    T.expect("to_pkcs12: chain ok", p12.verify_chain(trust_anchor=ca))
+
+    reloaded = PKCS12.load(p12.to_der(), password="hunter2")
+    T.expect("to_pkcs12 round-trip: key matches",
+             reloaded.key.pub == leaf_key.pub)
+    T.expect("to_pkcs12 round-trip: cert matches",
+             reloaded.cert.der == leaf.der)
+
+    # CertBundle.to_pkcs12
+    bundle = CertBundle([leaf, ca])
+    p12b = bundle.to_pkcs12(leaf_key, password="hunter2", name="bundle")
+    T.expect("bundle.to_pkcs12 → PKCS12", isinstance(p12b, PKCS12))
+    T.expect("bundle.to_pkcs12: MAC valid", p12b.verify_mac())
+
+    reloaded_b = PKCS12.load(p12b.to_der(), password="hunter2")
+    T.expect("bundle round-trip: cert matches",
+             reloaded_b.cert.der == leaf.der)
+    T.expect("bundle round-trip: chain len=1",
+             len(reloaded_b.chain) == 1)
+
+    # Все три типа ключей
+    for label, kf in [
+        ("RSA",     lambda: RSAKeys.generate(2048)),
+        ("Ed25519", lambda: Ed25519Keys.generate()),
+        ("EC-P256", lambda: ECDSAKeys.generate("P-256")),
+    ]:
+        try:
+            k = kf()
+            c = (CertificateBuilder()
+                .add_subject({"CN": f"{label}.shortcut"})
+                .add_public_key(k)
+                .add_serial_random().add_validity(days=30)
+                .self_signed().sign(k))
+            p = k.to_pkcs12(c, password="pw", name=label)
+            T.expect(f"{label}: to_pkcs12 + MAC", p.verify_mac())
+        except Exception as e:
+            T.fail(f"{label}: to_pkcs12", str(e)[:80])
+
+    # Пустой bundle
+    try:
+        CertBundle([]).to_pkcs12(leaf_key)
+        T.fail("пустой bundle → X509Error", "не бросило")
+    except X509Error:
+        T.ok("пустой bundle → X509Error")
+
+
 def main():
     print("╔" + "═" * 70 + "╗")
     print("║  x509kit — полный прогон" + " " * 46 + "║")
@@ -1012,6 +1180,10 @@ def main():
         test_aia()
         test_canonicalization()
         test_pem_roundtrip()
+        test_name_from_string()
+        test_cert_from_url()
+        test_cert_info()
+        test_pkcs12_shortcuts()
     except Exception as e:
         print()
         print("\033[31m!!! Непойманное исключение:\033[0m", type(e).__name__, e)