raise type error rather than internalerror w/ unsupported asn1 in subject

2 files changed, 17 insertions, 1 deletions

diff --git a/src/cryptography/hazmat/backends/openssl/decode_asn1.py b/src/cryptography/hazmat/backends/openssl/decode_asn1.py
index 140d3de4..67586c22 100644
--- a/src/cryptography/hazmat/backends/openssl/decode_asn1.py
+++ b/src/cryptography/hazmat/backends/openssl/decode_asn1.py
@@ -709,7 +709,11 @@ def _asn1_string_to_ascii(backend, asn1_string):
 def _asn1_string_to_utf8(backend, asn1_string):
     buf = backend._ffi.new("unsigned char **")
     res = backend._lib.ASN1_STRING_to_UTF8(buf, asn1_string)
-    backend.openssl_assert(res >= 0)
+    if res == -1:
+        raise TypeError(
+            "Unsupported ASN1 string type. Type: {0}".format(asn1_string.type)
+        )
+
     backend.openssl_assert(buf[0] != backend._ffi.NULL)
     buf = backend._ffi.gc(
         buf, lambda buffer: backend._lib.OPENSSL_free(buffer[0])
diff --git a/tests/test_x509.py b/tests/test_x509.py
index c042169c..8a801f2d 100644
--- a/tests/test_x509.py
+++ b/tests/test_x509.py
@@ -3157,6 +3157,18 @@ class TestDSACertificateRequest(object):
         verifier.verify()
 
 
+@pytest.mark.requires_backend_interface(interface=X509Backend)
+class TestGOSTCertificate(object):
+    def test_numeric_string_x509_name_entry(self, backend):
+        cert = _load_cert(
+            os.path.join("x509", "e-trust.ru.der"),
+            x509.load_der_x509_certificate,
+            backend
+        )
+        with pytest.raises(TypeError):
+            cert.subject
+
+
 @pytest.mark.requires_backend_interface(interface=EllipticCurveBackend)
 @pytest.mark.requires_backend_interface(interface=X509Backend)
 class TestECDSACertificate(object):