Merge branch 'master' into macstadium-travis

1 files changed, 1391 insertions, 20 deletions

diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index d38fe573..72f2f9e4 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -39,6 +39,296 @@ class TestExtension(object):
         )
 
 
+class TestNoticeReference(object):
+    def test_notice_numbers_not_all_int(self):
+        with pytest.raises(TypeError):
+            x509.NoticeReference("org", [1, 2, "three"])
+
+    def test_notice_numbers_none(self):
+        with pytest.raises(TypeError):
+            x509.NoticeReference("org", None)
+
+    def test_repr(self):
+        nr = x509.NoticeReference(u"org", [1, 3, 4])
+
+        if six.PY3:
+            assert repr(nr) == (
+                "<NoticeReference(organization='org', notice_numbers=[1, 3, 4"
+                "])>"
+            )
+        else:
+            assert repr(nr) == (
+                "<NoticeReference(organization=u'org', notice_numbers=[1, 3, "
+                "4])>"
+            )
+
+    def test_eq(self):
+        nr = x509.NoticeReference("org", [1, 2])
+        nr2 = x509.NoticeReference("org", [1, 2])
+        assert nr == nr2
+
+    def test_ne(self):
+        nr = x509.NoticeReference("org", [1, 2])
+        nr2 = x509.NoticeReference("org", [1])
+        nr3 = x509.NoticeReference(None, [1, 2])
+        assert nr != nr2
+        assert nr != nr3
+        assert nr != object()
+
+
+class TestUserNotice(object):
+    def test_notice_reference_invalid(self):
+        with pytest.raises(TypeError):
+            x509.UserNotice("invalid", None)
+
+    def test_notice_reference_none(self):
+        un = x509.UserNotice(None, "text")
+        assert un.notice_reference is None
+        assert un.explicit_text == "text"
+
+    def test_repr(self):
+        un = x509.UserNotice(x509.NoticeReference(u"org", [1]), u"text")
+        if six.PY3:
+            assert repr(un) == (
+                "<UserNotice(notice_reference=<NoticeReference(organization='"
+                "org', notice_numbers=[1])>, explicit_text='text')>"
+            )
+        else:
+            assert repr(un) == (
+                "<UserNotice(notice_reference=<NoticeReference(organization=u"
+                "'org', notice_numbers=[1])>, explicit_text=u'text')>"
+            )
+
+    def test_eq(self):
+        nr = x509.NoticeReference("org", [1, 2])
+        nr2 = x509.NoticeReference("org", [1, 2])
+        un = x509.UserNotice(nr, "text")
+        un2 = x509.UserNotice(nr2, "text")
+        assert un == un2
+
+    def test_ne(self):
+        nr = x509.NoticeReference("org", [1, 2])
+        nr2 = x509.NoticeReference("org", [1])
+        un = x509.UserNotice(nr, "text")
+        un2 = x509.UserNotice(nr2, "text")
+        un3 = x509.UserNotice(nr, "text3")
+        assert un != un2
+        assert un != un3
+        assert un != object()
+
+
+class TestPolicyInformation(object):
+    def test_invalid_policy_identifier(self):
+        with pytest.raises(TypeError):
+            x509.PolicyInformation("notanoid", None)
+
+    def test_none_policy_qualifiers(self):
+        pi = x509.PolicyInformation(x509.ObjectIdentifier("1.2.3"), None)
+        assert pi.policy_identifier == x509.ObjectIdentifier("1.2.3")
+        assert pi.policy_qualifiers is None
+
+    def test_policy_qualifiers(self):
+        pq = [u"string"]
+        pi = x509.PolicyInformation(x509.ObjectIdentifier("1.2.3"), pq)
+        assert pi.policy_identifier == x509.ObjectIdentifier("1.2.3")
+        assert pi.policy_qualifiers == pq
+
+    def test_invalid_policy_identifiers(self):
+        with pytest.raises(TypeError):
+            x509.PolicyInformation(x509.ObjectIdentifier("1.2.3"), [1, 2])
+
+    def test_repr(self):
+        pq = [u"string", x509.UserNotice(None, u"hi")]
+        pi = x509.PolicyInformation(x509.ObjectIdentifier("1.2.3"), pq)
+        if six.PY3:
+            assert repr(pi) == (
+                "<PolicyInformation(policy_identifier=<ObjectIdentifier(oid=1."
+                "2.3, name=Unknown OID)>, policy_qualifiers=['string', <UserNo"
+                "tice(notice_reference=None, explicit_text='hi')>])>"
+            )
+        else:
+            assert repr(pi) == (
+                "<PolicyInformation(policy_identifier=<ObjectIdentifier(oid=1."
+                "2.3, name=Unknown OID)>, policy_qualifiers=[u'string', <UserN"
+                "otice(notice_reference=None, explicit_text=u'hi')>])>"
+            )
+
+    def test_eq(self):
+        pi = x509.PolicyInformation(
+            x509.ObjectIdentifier("1.2.3"),
+            [u"string", x509.UserNotice(None, u"hi")]
+        )
+        pi2 = x509.PolicyInformation(
+            x509.ObjectIdentifier("1.2.3"),
+            [u"string", x509.UserNotice(None, u"hi")]
+        )
+        assert pi == pi2
+
+    def test_ne(self):
+        pi = x509.PolicyInformation(
+            x509.ObjectIdentifier("1.2.3"), [u"string"]
+        )
+        pi2 = x509.PolicyInformation(
+            x509.ObjectIdentifier("1.2.3"), [u"string2"]
+        )
+        pi3 = x509.PolicyInformation(
+            x509.ObjectIdentifier("1.2.3.4"), [u"string"]
+        )
+        assert pi != pi2
+        assert pi != pi3
+        assert pi != object()
+
+
+class TestCertificatePolicies(object):
+    def test_invalid_policies(self):
+        pq = [u"string"]
+        pi = x509.PolicyInformation(x509.ObjectIdentifier("1.2.3"), pq)
+        with pytest.raises(TypeError):
+            x509.CertificatePolicies([1, pi])
+
+    def test_iter_len(self):
+        pq = [u"string"]
+        pi = x509.PolicyInformation(x509.ObjectIdentifier("1.2.3"), pq)
+        cp = x509.CertificatePolicies([pi])
+        assert len(cp) == 1
+        for policyinfo in cp:
+            assert policyinfo == pi
+
+    def test_repr(self):
+        pq = [u"string"]
+        pi = x509.PolicyInformation(x509.ObjectIdentifier("1.2.3"), pq)
+        cp = x509.CertificatePolicies([pi])
+        if six.PY3:
+            assert repr(cp) == (
+                "<CertificatePolicies([<PolicyInformation(policy_identifier=<O"
+                "bjectIdentifier(oid=1.2.3, name=Unknown OID)>, policy_qualifi"
+                "ers=['string'])>])>"
+            )
+        else:
+            assert repr(cp) == (
+                "<CertificatePolicies([<PolicyInformation(policy_identifier=<O"
+                "bjectIdentifier(oid=1.2.3, name=Unknown OID)>, policy_qualifi"
+                "ers=[u'string'])>])>"
+            )
+
+    def test_eq(self):
+        pi = x509.PolicyInformation(
+            x509.ObjectIdentifier("1.2.3"), [u"string"]
+        )
+        cp = x509.CertificatePolicies([pi])
+        pi2 = x509.PolicyInformation(
+            x509.ObjectIdentifier("1.2.3"), [u"string"]
+        )
+        cp2 = x509.CertificatePolicies([pi2])
+        assert cp == cp2
+
+    def test_ne(self):
+        pi = x509.PolicyInformation(
+            x509.ObjectIdentifier("1.2.3"), [u"string"]
+        )
+        cp = x509.CertificatePolicies([pi])
+        pi2 = x509.PolicyInformation(
+            x509.ObjectIdentifier("1.2.3"), [u"string2"]
+        )
+        cp2 = x509.CertificatePolicies([pi2])
+        assert cp != cp2
+        assert cp != object()
+
+
+@pytest.mark.requires_backend_interface(interface=RSABackend)
+@pytest.mark.requires_backend_interface(interface=X509Backend)
+class TestCertificatePoliciesExtension(object):
+    def test_cps_uri_policy_qualifier(self, backend):
+        cert = _load_cert(
+            os.path.join("x509", "custom", "cp_cps_uri.pem"),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+
+        cp = cert.extensions.get_extension_for_oid(
+            x509.OID_CERTIFICATE_POLICIES
+        ).value
+
+        assert cp == x509.CertificatePolicies([
+            x509.PolicyInformation(
+                x509.ObjectIdentifier("2.16.840.1.12345.1.2.3.4.1"),
+                [u"http://other.com/cps"]
+            )
+        ])
+
+    def test_user_notice_with_notice_reference(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "cp_user_notice_with_notice_reference.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+
+        cp = cert.extensions.get_extension_for_oid(
+            x509.OID_CERTIFICATE_POLICIES
+        ).value
+
+        assert cp == x509.CertificatePolicies([
+            x509.PolicyInformation(
+                x509.ObjectIdentifier("2.16.840.1.12345.1.2.3.4.1"),
+                [
+                    u"http://example.com/cps",
+                    u"http://other.com/cps",
+                    x509.UserNotice(
+                        x509.NoticeReference(u"my org", [1, 2, 3, 4]),
+                        u"thing"
+                    )
+                ]
+            )
+        ])
+
+    def test_user_notice_with_explicit_text(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "cp_user_notice_with_explicit_text.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+
+        cp = cert.extensions.get_extension_for_oid(
+            x509.OID_CERTIFICATE_POLICIES
+        ).value
+
+        assert cp == x509.CertificatePolicies([
+            x509.PolicyInformation(
+                x509.ObjectIdentifier("2.16.840.1.12345.1.2.3.4.1"),
+                [x509.UserNotice(None, u"thing")]
+            )
+        ])
+
+    def test_user_notice_no_explicit_text(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "cp_user_notice_no_explicit_text.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+
+        cp = cert.extensions.get_extension_for_oid(
+            x509.OID_CERTIFICATE_POLICIES
+        ).value
+
+        assert cp == x509.CertificatePolicies([
+            x509.PolicyInformation(
+                x509.ObjectIdentifier("2.16.840.1.12345.1.2.3.4.1"),
+                [
+                    x509.UserNotice(
+                        x509.NoticeReference(u"my org", [1, 2, 3, 4]),
+                        None
+                    )
+                ]
+            )
+        ])
+
+
 class TestKeyUsage(object):
     def test_key_agreement_false_encipher_decipher_true(self):
         with pytest.raises(ValueError):
@@ -173,6 +463,57 @@ class TestKeyUsage(object):
             "only=False)>"
         )
 
+    def test_eq(self):
+        ku = x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=True,
+            key_cert_sign=False,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=True
+        )
+        ku2 = x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=True,
+            key_cert_sign=False,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=True
+        )
+        assert ku == ku2
+
+    def test_ne(self):
+        ku = x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=True,
+            key_cert_sign=False,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=True
+        )
+        ku2 = x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=False,
+            key_cert_sign=False,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=False
+        )
+        assert ku != ku2
+        assert ku != object()
+
 
 class TestSubjectKeyIdentifier(object):
     def test_properties(self):
@@ -221,29 +562,33 @@ class TestSubjectKeyIdentifier(object):
 
 
 class TestAuthorityKeyIdentifier(object):
-    def test_authority_cert_issuer_not_name(self):
+    def test_authority_cert_issuer_not_generalname(self):
         with pytest.raises(TypeError):
-            x509.AuthorityKeyIdentifier(b"identifier", "notname", 3)
+            x509.AuthorityKeyIdentifier(b"identifier", ["notname"], 3)
 
     def test_authority_cert_serial_number_not_integer(self):
-        name = x509.Name([
-            x509.NameAttribute(x509.ObjectIdentifier('oid'), 'value1'),
-            x509.NameAttribute(x509.ObjectIdentifier('oid2'), 'value2'),
-        ])
+        dirname = x509.DirectoryName(
+            x509.Name([
+                x509.NameAttribute(x509.ObjectIdentifier('oid'), 'value1'),
+                x509.NameAttribute(x509.ObjectIdentifier('oid2'), 'value2'),
+            ])
+        )
         with pytest.raises(TypeError):
-            x509.AuthorityKeyIdentifier(b"identifier", name, "notanint")
+            x509.AuthorityKeyIdentifier(b"identifier", [dirname], "notanint")
 
     def test_authority_issuer_none_serial_not_none(self):
         with pytest.raises(ValueError):
             x509.AuthorityKeyIdentifier(b"identifier", None, 3)
 
     def test_authority_issuer_not_none_serial_none(self):
-        name = x509.Name([
-            x509.NameAttribute(x509.ObjectIdentifier('oid'), 'value1'),
-            x509.NameAttribute(x509.ObjectIdentifier('oid2'), 'value2'),
-        ])
+        dirname = x509.DirectoryName(
+            x509.Name([
+                x509.NameAttribute(x509.ObjectIdentifier('oid'), 'value1'),
+                x509.NameAttribute(x509.ObjectIdentifier('oid2'), 'value2'),
+            ])
+        )
         with pytest.raises(ValueError):
-            x509.AuthorityKeyIdentifier(b"identifier", name, None)
+            x509.AuthorityKeyIdentifier(b"identifier", [dirname], None)
 
     def test_authority_cert_serial_and_issuer_none(self):
         aki = x509.AuthorityKeyIdentifier(b"id", None, None)
@@ -252,24 +597,55 @@ class TestAuthorityKeyIdentifier(object):
         assert aki.authority_cert_serial_number is None
 
     def test_repr(self):
-        name = x509.Name([x509.NameAttribute(x509.OID_COMMON_NAME, 'myCN')])
-        aki = x509.AuthorityKeyIdentifier(b"digest", name, 1234)
+        dirname = x509.DirectoryName(
+            x509.Name([x509.NameAttribute(x509.OID_COMMON_NAME, 'myCN')])
+        )
+        aki = x509.AuthorityKeyIdentifier(b"digest", [dirname], 1234)
 
         if six.PY3:
             assert repr(aki) == (
                 "<AuthorityKeyIdentifier(key_identifier=b'digest', authority_"
-                "cert_issuer=<Name([<NameAttribute(oid=<ObjectIdentifier(oid="
-                "2.5.4.3, name=commonName)>, value='myCN')>])>, authority_cer"
-                "t_serial_number=1234)>"
+                "cert_issuer=[<DirectoryName(value=<Name([<NameAttribute(oid="
+                "<ObjectIdentifier(oid=2.5.4.3, name=commonName)>, value='myC"
+                "N')>])>)>], authority_cert_serial_number=1234)>"
             )
         else:
             assert repr(aki) == (
                 "<AuthorityKeyIdentifier(key_identifier='digest', authority_ce"
-                "rt_issuer=<Name([<NameAttribute(oid=<ObjectIdentifier(oid=2.5"
-                ".4.3, name=commonName)>, value='myCN')>])>, authority_cert_se"
-                "rial_number=1234)>"
+                "rt_issuer=[<DirectoryName(value=<Name([<NameAttribute(oid=<Ob"
+                "jectIdentifier(oid=2.5.4.3, name=commonName)>, value='myCN')>"
+                "])>)>], authority_cert_serial_number=1234)>"
             )
 
+    def test_eq(self):
+        dirname = x509.DirectoryName(
+            x509.Name([x509.NameAttribute(x509.OID_COMMON_NAME, 'myCN')])
+        )
+        aki = x509.AuthorityKeyIdentifier(b"digest", [dirname], 1234)
+        dirname2 = x509.DirectoryName(
+            x509.Name([x509.NameAttribute(x509.OID_COMMON_NAME, 'myCN')])
+        )
+        aki2 = x509.AuthorityKeyIdentifier(b"digest", [dirname2], 1234)
+        assert aki == aki2
+
+    def test_ne(self):
+        dirname = x509.DirectoryName(
+            x509.Name([x509.NameAttribute(x509.OID_COMMON_NAME, 'myCN')])
+        )
+        dirname5 = x509.DirectoryName(
+            x509.Name([x509.NameAttribute(x509.OID_COMMON_NAME, 'aCN')])
+        )
+        aki = x509.AuthorityKeyIdentifier(b"digest", [dirname], 1234)
+        aki2 = x509.AuthorityKeyIdentifier(b"diges", [dirname], 1234)
+        aki3 = x509.AuthorityKeyIdentifier(b"digest", None, None)
+        aki4 = x509.AuthorityKeyIdentifier(b"digest", [dirname], 12345)
+        aki5 = x509.AuthorityKeyIdentifier(b"digest", [dirname5], 12345)
+        assert aki != aki2
+        assert aki != aki3
+        assert aki != aki4
+        assert aki != aki5
+        assert aki != object()
+
 
 class TestBasicConstraints(object):
     def test_ca_not_boolean(self):
@@ -297,6 +673,19 @@ class TestBasicConstraints(object):
             "<BasicConstraints(ca=True, path_length=None)>"
         )
 
+    def test_eq(self):
+        na = x509.BasicConstraints(ca=True, path_length=None)
+        na2 = x509.BasicConstraints(ca=True, path_length=None)
+        assert na == na2
+
+    def test_ne(self):
+        na = x509.BasicConstraints(ca=True, path_length=None)
+        na2 = x509.BasicConstraints(ca=True, path_length=1)
+        na3 = x509.BasicConstraints(ca=False, path_length=None)
+        assert na != na2
+        assert na != na3
+        assert na != object()
+
 
 class TestExtendedKeyUsage(object):
     def test_not_all_oids(self):
@@ -325,6 +714,21 @@ class TestExtendedKeyUsage(object):
             "tAuth)>])>"
         )
 
+    def test_eq(self):
+        eku = x509.ExtendedKeyUsage([
+            x509.ObjectIdentifier("1.3.6"), x509.ObjectIdentifier("1.3.7")
+        ])
+        eku2 = x509.ExtendedKeyUsage([
+            x509.ObjectIdentifier("1.3.6"), x509.ObjectIdentifier("1.3.7")
+        ])
+        assert eku == eku2
+
+    def test_ne(self):
+        eku = x509.ExtendedKeyUsage([x509.ObjectIdentifier("1.3.6")])
+        eku2 = x509.ExtendedKeyUsage([x509.ObjectIdentifier("1.3.6.1")])
+        assert eku != eku2
+        assert eku != object()
+
 
 @pytest.mark.requires_backend_interface(interface=RSABackend)
 @pytest.mark.requires_backend_interface(interface=X509Backend)
@@ -737,6 +1141,25 @@ class TestSubjectAlternativeName(object):
             "<SubjectAlternativeName([<DNSName(value=cryptography.io)>])>"
         )
 
+    def test_eq(self):
+        san = x509.SubjectAlternativeName(
+            [x509.DNSName(u"cryptography.io")]
+        )
+        san2 = x509.SubjectAlternativeName(
+            [x509.DNSName(u"cryptography.io")]
+        )
+        assert san == san2
+
+    def test_ne(self):
+        san = x509.SubjectAlternativeName(
+            [x509.DNSName(u"cryptography.io")]
+        )
+        san2 = x509.SubjectAlternativeName(
+            [x509.RFC822Name(u"admin@cryptography.io")]
+        )
+        assert san != san2
+        assert san != object()
+
 
 @pytest.mark.requires_backend_interface(interface=RSABackend)
 @pytest.mark.requires_backend_interface(interface=X509Backend)
@@ -856,3 +1279,951 @@ class TestRSASubjectAlternativeNameExtension(object):
                 x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, 'Texas'),
             ])
         ] == dirname
+
+    def test_rfc822name(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "san_rfc822_idna.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_SUBJECT_ALTERNATIVE_NAME
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        san = ext.value
+
+        rfc822name = san.get_values_for_type(x509.RFC822Name)
+        assert [u"email@em\xe5\xefl.com"] == rfc822name
+
+    def test_unicode_rfc822_name_dns_name_uri(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "san_idna_names.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_SUBJECT_ALTERNATIVE_NAME
+        )
+        assert ext is not None
+        rfc822_name = ext.value.get_values_for_type(x509.RFC822Name)
+        dns_name = ext.value.get_values_for_type(x509.DNSName)
+        uri = ext.value.get_values_for_type(x509.UniformResourceIdentifier)
+        assert rfc822_name == [u"email@\u043f\u044b\u043a\u0430.cryptography"]
+        assert dns_name == [u"\u043f\u044b\u043a\u0430.cryptography"]
+        assert uri == [u"https://www.\u043f\u044b\u043a\u0430.cryptography"]
+
+    def test_rfc822name_dnsname_ipaddress_directoryname_uri(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "san_email_dns_ip_dirname_uri.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_SUBJECT_ALTERNATIVE_NAME
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        san = ext.value
+
+        rfc822_name = san.get_values_for_type(x509.RFC822Name)
+        uri = san.get_values_for_type(x509.UniformResourceIdentifier)
+        dns = san.get_values_for_type(x509.DNSName)
+        ip = san.get_values_for_type(x509.IPAddress)
+        dirname = san.get_values_for_type(x509.DirectoryName)
+        assert [u"user@cryptography.io"] == rfc822_name
+        assert [u"https://cryptography.io"] == uri
+        assert [u"cryptography.io"] == dns
+        assert [
+            x509.Name([
+                x509.NameAttribute(x509.OID_COMMON_NAME, 'dirCN'),
+                x509.NameAttribute(
+                    x509.OID_ORGANIZATION_NAME, 'Cryptographic Authority'
+                ),
+            ])
+        ] == dirname
+        assert [
+            ipaddress.ip_address(u"127.0.0.1"),
+            ipaddress.ip_address(u"ff::")
+        ] == ip
+
+    def test_invalid_rfc822name(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "san_rfc822_names.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        with pytest.raises(ValueError) as exc:
+            cert.extensions
+
+        assert 'Invalid rfc822name value' in str(exc.value)
+
+
+@pytest.mark.requires_backend_interface(interface=RSABackend)
+@pytest.mark.requires_backend_interface(interface=X509Backend)
+class TestExtendedKeyUsageExtension(object):
+    def test_eku(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "extended_key_usage.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_EXTENDED_KEY_USAGE
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert [
+            x509.ObjectIdentifier("1.3.6.1.5.5.7.3.1"),
+            x509.ObjectIdentifier("1.3.6.1.5.5.7.3.2"),
+            x509.ObjectIdentifier("1.3.6.1.5.5.7.3.3"),
+            x509.ObjectIdentifier("1.3.6.1.5.5.7.3.4"),
+            x509.ObjectIdentifier("1.3.6.1.5.5.7.3.9"),
+            x509.ObjectIdentifier("1.3.6.1.5.5.7.3.8"),
+            x509.ObjectIdentifier("2.5.29.37.0"),
+            x509.ObjectIdentifier("2.16.840.1.113730.4.1"),
+        ] == list(ext.value)
+
+
+class TestAccessDescription(object):
+    def test_invalid_access_method(self):
+        with pytest.raises(ValueError):
+            x509.AccessDescription("notanoid", x509.DNSName(u"test"))
+
+    def test_invalid_access_location(self):
+        with pytest.raises(TypeError):
+            x509.AccessDescription(x509.OID_CA_ISSUERS, "invalid")
+
+    def test_repr(self):
+        ad = x509.AccessDescription(
+            x509.OID_OCSP,
+            x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+        )
+        assert repr(ad) == (
+            "<AccessDescription(access_method=<ObjectIdentifier(oid=1.3.6.1.5."
+            "5.7.48.1, name=OCSP)>, access_location=<UniformResourceIdentifier"
+            "(value=http://ocsp.domain.com)>)>"
+        )
+
+    def test_eq(self):
+        ad = x509.AccessDescription(
+            x509.OID_OCSP,
+            x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+        )
+        ad2 = x509.AccessDescription(
+            x509.OID_OCSP,
+            x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+        )
+        assert ad == ad2
+
+    def test_ne(self):
+        ad = x509.AccessDescription(
+            x509.OID_OCSP,
+            x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+        )
+        ad2 = x509.AccessDescription(
+            x509.OID_CA_ISSUERS,
+            x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+        )
+        ad3 = x509.AccessDescription(
+            x509.OID_OCSP,
+            x509.UniformResourceIdentifier(u"http://notthesame")
+        )
+        assert ad != ad2
+        assert ad != ad3
+        assert ad != object()
+
+
+class TestAuthorityInformationAccess(object):
+    def test_invalid_descriptions(self):
+        with pytest.raises(TypeError):
+            x509.AuthorityInformationAccess(["notanAccessDescription"])
+
+    def test_iter_len(self):
+        aia = x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.UniformResourceIdentifier(u"http://domain.com/ca.crt")
+            )
+        ])
+        assert len(aia) == 2
+        assert list(aia) == [
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.UniformResourceIdentifier(u"http://domain.com/ca.crt")
+            )
+        ]
+
+    def test_repr(self):
+        aia = x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.UniformResourceIdentifier(u"http://domain.com/ca.crt")
+            )
+        ])
+        assert repr(aia) == (
+            "<AuthorityInformationAccess([<AccessDescription(access_method=<Ob"
+            "jectIdentifier(oid=1.3.6.1.5.5.7.48.1, name=OCSP)>, access_locati"
+            "on=<UniformResourceIdentifier(value=http://ocsp.domain.com)>)>, <"
+            "AccessDescription(access_method=<ObjectIdentifier(oid=1.3.6.1.5.5"
+            ".7.48.2, name=caIssuers)>, access_location=<UniformResourceIdenti"
+            "fier(value=http://domain.com/ca.crt)>)>])>"
+        )
+
+    def test_eq(self):
+        aia = x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.UniformResourceIdentifier(u"http://domain.com/ca.crt")
+            )
+        ])
+        aia2 = x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.UniformResourceIdentifier(u"http://domain.com/ca.crt")
+            )
+        ])
+        assert aia == aia2
+
+    def test_ne(self):
+        aia = x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.UniformResourceIdentifier(u"http://domain.com/ca.crt")
+            )
+        ])
+        aia2 = x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+        ])
+
+        assert aia != aia2
+        assert aia != object()
+
+
+@pytest.mark.requires_backend_interface(interface=RSABackend)
+@pytest.mark.requires_backend_interface(interface=X509Backend)
+class TestAuthorityInformationAccessExtension(object):
+    def test_aia_ocsp_ca_issuers(self, backend):
+        cert = _load_cert(
+            os.path.join("x509", "cryptography.io.pem"),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_INFORMATION_ACCESS
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value == x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://gv.symcd.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.UniformResourceIdentifier(u"http://gv.symcb.com/gv.crt")
+            ),
+        ])
+
+    def test_aia_multiple_ocsp_ca_issuers(self, backend):
+        cert = _load_cert(
+            os.path.join("x509", "custom", "aia_ocsp_ca_issuers.pem"),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_INFORMATION_ACCESS
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value == x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp2.domain.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.DirectoryName(x509.Name([
+                    x509.NameAttribute(x509.OID_COMMON_NAME, "myCN"),
+                    x509.NameAttribute(x509.OID_ORGANIZATION_NAME, "some Org"),
+                ]))
+            ),
+        ])
+
+    def test_aia_ocsp_only(self, backend):
+        cert = _load_cert(
+            os.path.join("x509", "custom", "aia_ocsp.pem"),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_INFORMATION_ACCESS
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value == x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+        ])
+
+    def test_aia_ca_issuers_only(self, backend):
+        cert = _load_cert(
+            os.path.join("x509", "custom", "aia_ca_issuers.pem"),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_INFORMATION_ACCESS
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value == x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.DirectoryName(x509.Name([
+                    x509.NameAttribute(x509.OID_COMMON_NAME, "myCN"),
+                    x509.NameAttribute(x509.OID_ORGANIZATION_NAME, "some Org"),
+                ]))
+            ),
+        ])
+
+
+@pytest.mark.requires_backend_interface(interface=RSABackend)
+@pytest.mark.requires_backend_interface(interface=X509Backend)
+class TestAuthorityKeyIdentifierExtension(object):
+    def test_aki_keyid(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "cryptography.io.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_KEY_IDENTIFIER
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value.key_identifier == (
+            b"\xc3\x9c\xf3\xfc\xd3F\x084\xbb\xceF\x7f\xa0|[\xf3\xe2\x08\xcbY"
+        )
+        assert ext.value.authority_cert_issuer is None
+        assert ext.value.authority_cert_serial_number is None
+
+    def test_aki_all_fields(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "authority_key_identifier.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_KEY_IDENTIFIER
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value.key_identifier == (
+            b"9E>\xca=b\x1d\xea\x86I\xf6Z\xab@\xb7\xa4p\x98\xf1\xec"
+        )
+        assert ext.value.authority_cert_issuer == [
+            x509.DirectoryName(
+                x509.Name([
+                    x509.NameAttribute(
+                        x509.OID_ORGANIZATION_NAME, u"PyCA"
+                    ),
+                    x509.NameAttribute(
+                        x509.OID_COMMON_NAME, u"cryptography.io"
+                    )
+                ])
+            )
+        ]
+        assert ext.value.authority_cert_serial_number == 3
+
+    def test_aki_no_keyid(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "authority_key_identifier_no_keyid.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_KEY_IDENTIFIER
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value.key_identifier is None
+        assert ext.value.authority_cert_issuer == [
+            x509.DirectoryName(
+                x509.Name([
+                    x509.NameAttribute(
+                        x509.OID_ORGANIZATION_NAME, u"PyCA"
+                    ),
+                    x509.NameAttribute(
+                        x509.OID_COMMON_NAME, u"cryptography.io"
+                    )
+                ])
+            )
+        ]
+        assert ext.value.authority_cert_serial_number == 3
+
+
+class TestDistributionPoint(object):
+    def test_distribution_point_full_name_not_general_names(self):
+        with pytest.raises(TypeError):
+            x509.DistributionPoint(["notgn"], None, None, None)
+
+    def test_distribution_point_relative_name_not_name(self):
+        with pytest.raises(TypeError):
+            x509.DistributionPoint(None, "notname", None, None)
+
+    def test_distribution_point_full_and_relative_not_none(self):
+        with pytest.raises(ValueError):
+            x509.DistributionPoint("data", "notname", None, None)
+
+    def test_crl_issuer_not_general_names(self):
+        with pytest.raises(TypeError):
+            x509.DistributionPoint(None, None, None, ["notgn"])
+
+    def test_reason_not_reasonflags(self):
+        with pytest.raises(TypeError):
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
+                None,
+                frozenset(["notreasonflags"]),
+                None
+            )
+
+    def test_reason_not_frozenset(self):
+        with pytest.raises(TypeError):
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
+                None,
+                [x509.ReasonFlags.ca_compromise],
+                None
+            )
+
+    def test_disallowed_reasons(self):
+        with pytest.raises(ValueError):
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
+                None,
+                frozenset([x509.ReasonFlags.unspecified]),
+                None
+            )
+
+        with pytest.raises(ValueError):
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
+                None,
+                frozenset([x509.ReasonFlags.remove_from_crl]),
+                None
+            )
+
+    def test_reason_only(self):
+        with pytest.raises(ValueError):
+            x509.DistributionPoint(
+                None,
+                None,
+                frozenset([x509.ReasonFlags.aa_compromise]),
+                None
+            )
+
+    def test_eq(self):
+        dp = x509.DistributionPoint(
+            [x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
+            None,
+            frozenset([x509.ReasonFlags.superseded]),
+            [
+                x509.DirectoryName(
+                    x509.Name([
+                        x509.NameAttribute(
+                            x509.OID_COMMON_NAME, "Important CA"
+                        )
+                    ])
+                )
+            ],
+        )
+        dp2 = x509.DistributionPoint(
+            [x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
+            None,
+            frozenset([x509.ReasonFlags.superseded]),
+            [
+                x509.DirectoryName(
+                    x509.Name([
+                        x509.NameAttribute(
+                            x509.OID_COMMON_NAME, "Important CA"
+                        )
+                    ])
+                )
+            ],
+        )
+        assert dp == dp2
+
+    def test_ne(self):
+        dp = x509.DistributionPoint(
+            [x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
+            None,
+            frozenset([x509.ReasonFlags.superseded]),
+            [
+                x509.DirectoryName(
+                    x509.Name([
+                        x509.NameAttribute(
+                            x509.OID_COMMON_NAME, "Important CA"
+                        )
+                    ])
+                )
+            ],
+        )
+        dp2 = x509.DistributionPoint(
+            [x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
+            None,
+            None,
+            None
+        )
+        assert dp != dp2
+        assert dp != object()
+
+    def test_repr(self):
+        dp = x509.DistributionPoint(
+            None,
+            x509.Name([
+                x509.NameAttribute(x509.OID_COMMON_NAME, "myCN")
+            ]),
+            frozenset([x509.ReasonFlags.ca_compromise]),
+            [
+                x509.DirectoryName(
+                    x509.Name([
+                        x509.NameAttribute(
+                            x509.OID_COMMON_NAME, "Important CA"
+                        )
+                    ])
+                )
+            ],
+        )
+        if six.PY3:
+            assert repr(dp) == (
+                "<DistributionPoint(full_name=None, relative_name=<Name([<Name"
+                "Attribute(oid=<ObjectIdentifier(oid=2.5.4.3, name=commonName)"
+                ">, value='myCN')>])>, reasons=frozenset({<ReasonFlags.ca_comp"
+                "romise: 'cACompromise'>}), crl_issuer=[<DirectoryName(value=<"
+                "Name([<NameAttribute(oid=<ObjectIdentifier(oid=2.5.4.3, name="
+                "commonName)>, value='Important CA')>])>)>])>"
+            )
+        else:
+            assert repr(dp) == (
+                "<DistributionPoint(full_name=None, relative_name=<Name([<Name"
+                "Attribute(oid=<ObjectIdentifier(oid=2.5.4.3, name=commonName)"
+                ">, value='myCN')>])>, reasons=frozenset([<ReasonFlags.ca_comp"
+                "romise: 'cACompromise'>]), crl_issuer=[<DirectoryName(value=<"
+                "Name([<NameAttribute(oid=<ObjectIdentifier(oid=2.5.4.3, name="
+                "commonName)>, value='Important CA')>])>)>])>"
+            )
+
+
+class TestCRLDistributionPoints(object):
+    def test_invalid_distribution_points(self):
+        with pytest.raises(TypeError):
+            x509.CRLDistributionPoints(["notadistributionpoint"])
+
+    def test_iter_len(self):
+        cdp = x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"http://domain")],
+                None,
+                None,
+                None
+            ),
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"ftp://domain")],
+                None,
+                frozenset([
+                    x509.ReasonFlags.key_compromise,
+                    x509.ReasonFlags.ca_compromise,
+                ]),
+                None
+            ),
+        ])
+        assert len(cdp) == 2
+        assert list(cdp) == [
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"http://domain")],
+                None,
+                None,
+                None
+            ),
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"ftp://domain")],
+                None,
+                frozenset([
+                    x509.ReasonFlags.key_compromise,
+                    x509.ReasonFlags.ca_compromise,
+                ]),
+                None
+            ),
+        ]
+
+    def test_repr(self):
+        cdp = x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"ftp://domain")],
+                None,
+                frozenset([x509.ReasonFlags.key_compromise]),
+                None
+            ),
+        ])
+        if six.PY3:
+            assert repr(cdp) == (
+                "<CRLDistributionPoints([<DistributionPoint(full_name=[<Unifo"
+                "rmResourceIdentifier(value=ftp://domain)>], relative_name=No"
+                "ne, reasons=frozenset({<ReasonFlags.key_compromise: 'keyComp"
+                "romise'>}), crl_issuer=None)>])>"
+            )
+        else:
+            assert repr(cdp) == (
+                "<CRLDistributionPoints([<DistributionPoint(full_name=[<Unifo"
+                "rmResourceIdentifier(value=ftp://domain)>], relative_name=No"
+                "ne, reasons=frozenset([<ReasonFlags.key_compromise: 'keyComp"
+                "romise'>]), crl_issuer=None)>])>"
+            )
+
+    def test_eq(self):
+        cdp = x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"ftp://domain")],
+                None,
+                frozenset([
+                    x509.ReasonFlags.key_compromise,
+                    x509.ReasonFlags.ca_compromise,
+                ]),
+                [x509.UniformResourceIdentifier(u"uri://thing")],
+            ),
+        ])
+        cdp2 = x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"ftp://domain")],
+                None,
+                frozenset([
+                    x509.ReasonFlags.key_compromise,
+                    x509.ReasonFlags.ca_compromise,
+                ]),
+                [x509.UniformResourceIdentifier(u"uri://thing")],
+            ),
+        ])
+        assert cdp == cdp2
+
+    def test_ne(self):
+        cdp = x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"ftp://domain")],
+                None,
+                frozenset([
+                    x509.ReasonFlags.key_compromise,
+                    x509.ReasonFlags.ca_compromise,
+                ]),
+                [x509.UniformResourceIdentifier(u"uri://thing")],
+            ),
+        ])
+        cdp2 = x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"ftp://domain2")],
+                None,
+                frozenset([
+                    x509.ReasonFlags.key_compromise,
+                    x509.ReasonFlags.ca_compromise,
+                ]),
+                [x509.UniformResourceIdentifier(u"uri://thing")],
+            ),
+        ])
+        cdp3 = x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"ftp://domain")],
+                None,
+                frozenset([x509.ReasonFlags.key_compromise]),
+                [x509.UniformResourceIdentifier(u"uri://thing")],
+            ),
+        ])
+        cdp4 = x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                [x509.UniformResourceIdentifier(u"ftp://domain")],
+                None,
+                frozenset([
+                    x509.ReasonFlags.key_compromise,
+                    x509.ReasonFlags.ca_compromise,
+                ]),
+                [x509.UniformResourceIdentifier(u"uri://thing2")],
+            ),
+        ])
+        assert cdp != cdp2
+        assert cdp != cdp3
+        assert cdp != cdp4
+        assert cdp != object()
+
+
+@pytest.mark.requires_backend_interface(interface=RSABackend)
+@pytest.mark.requires_backend_interface(interface=X509Backend)
+class TestCRLDistributionPointsExtension(object):
+    def test_fullname_and_crl_issuer(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "PKITS_data", "certs", "ValidcRLIssuerTest28EE.crt"
+            ),
+            x509.load_der_x509_certificate,
+            backend
+        )
+
+        cdps = cert.extensions.get_extension_for_oid(
+            x509.OID_CRL_DISTRIBUTION_POINTS
+        ).value
+
+        assert cdps == x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                full_name=[x509.DirectoryName(
+                    x509.Name([
+                        x509.NameAttribute(x509.OID_COUNTRY_NAME, "US"),
+                        x509.NameAttribute(
+                            x509.OID_ORGANIZATION_NAME,
+                            "Test Certificates 2011"
+                        ),
+                        x509.NameAttribute(
+                            x509.OID_ORGANIZATIONAL_UNIT_NAME,
+                            "indirectCRL CA3 cRLIssuer"
+                        ),
+                        x509.NameAttribute(
+                            x509.OID_COMMON_NAME,
+                            "indirect CRL for indirectCRL CA3"
+                        ),
+                    ])
+                )],
+                relative_name=None,
+                reasons=None,
+                crl_issuer=[x509.DirectoryName(
+                    x509.Name([
+                        x509.NameAttribute(x509.OID_COUNTRY_NAME, "US"),
+                        x509.NameAttribute(
+                            x509.OID_ORGANIZATION_NAME,
+                            "Test Certificates 2011"
+                        ),
+                        x509.NameAttribute(
+                            x509.OID_ORGANIZATIONAL_UNIT_NAME,
+                            "indirectCRL CA3 cRLIssuer"
+                        ),
+                    ])
+                )],
+            )
+        ])
+
+    def test_relativename_and_crl_issuer(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "PKITS_data", "certs", "ValidcRLIssuerTest29EE.crt"
+            ),
+            x509.load_der_x509_certificate,
+            backend
+        )
+
+        cdps = cert.extensions.get_extension_for_oid(
+            x509.OID_CRL_DISTRIBUTION_POINTS
+        ).value
+
+        assert cdps == x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                full_name=None,
+                relative_name=x509.Name([
+                    x509.NameAttribute(
+                        x509.OID_COMMON_NAME,
+                        "indirect CRL for indirectCRL CA3"
+                    ),
+                ]),
+                reasons=None,
+                crl_issuer=[x509.DirectoryName(
+                    x509.Name([
+                        x509.NameAttribute(x509.OID_COUNTRY_NAME, "US"),
+                        x509.NameAttribute(
+                            x509.OID_ORGANIZATION_NAME,
+                            "Test Certificates 2011"
+                        ),
+                        x509.NameAttribute(
+                            x509.OID_ORGANIZATIONAL_UNIT_NAME,
+                            "indirectCRL CA3 cRLIssuer"
+                        ),
+                    ])
+                )],
+            )
+        ])
+
+    def test_fullname_crl_issuer_reasons(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "cdp_fullname_reasons_crl_issuer.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+
+        cdps = cert.extensions.get_extension_for_oid(
+            x509.OID_CRL_DISTRIBUTION_POINTS
+        ).value
+
+        assert cdps == x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                full_name=[x509.UniformResourceIdentifier(
+                    u"http://myhost.com/myca.crl"
+                )],
+                relative_name=None,
+                reasons=frozenset([
+                    x509.ReasonFlags.key_compromise,
+                    x509.ReasonFlags.ca_compromise
+                ]),
+                crl_issuer=[x509.DirectoryName(
+                    x509.Name([
+                        x509.NameAttribute(x509.OID_COUNTRY_NAME, "US"),
+                        x509.NameAttribute(
+                            x509.OID_ORGANIZATION_NAME, "PyCA"
+                        ),
+                        x509.NameAttribute(
+                            x509.OID_COMMON_NAME, "cryptography CA"
+                        ),
+                    ])
+                )],
+            )
+        ])
+
+    def test_all_reasons(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "cdp_all_reasons.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+
+        cdps = cert.extensions.get_extension_for_oid(
+            x509.OID_CRL_DISTRIBUTION_POINTS
+        ).value
+
+        assert cdps == x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                full_name=[x509.UniformResourceIdentifier(
+                    u"http://domain.com/some.crl"
+                )],
+                relative_name=None,
+                reasons=frozenset([
+                    x509.ReasonFlags.key_compromise,
+                    x509.ReasonFlags.ca_compromise,
+                    x509.ReasonFlags.affiliation_changed,
+                    x509.ReasonFlags.superseded,
+                    x509.ReasonFlags.privilege_withdrawn,
+                    x509.ReasonFlags.cessation_of_operation,
+                    x509.ReasonFlags.aa_compromise,
+                    x509.ReasonFlags.certificate_hold,
+                ]),
+                crl_issuer=None
+            )
+        ])
+
+    def test_single_reason(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "cdp_reason_aa_compromise.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+
+        cdps = cert.extensions.get_extension_for_oid(
+            x509.OID_CRL_DISTRIBUTION_POINTS
+        ).value
+
+        assert cdps == x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                full_name=[x509.UniformResourceIdentifier(
+                    u"http://domain.com/some.crl"
+                )],
+                relative_name=None,
+                reasons=frozenset([x509.ReasonFlags.aa_compromise]),
+                crl_issuer=None
+            )
+        ])
+
+    def test_crl_issuer_only(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "cdp_crl_issuer.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+
+        cdps = cert.extensions.get_extension_for_oid(
+            x509.OID_CRL_DISTRIBUTION_POINTS
+        ).value
+
+        assert cdps == x509.CRLDistributionPoints([
+            x509.DistributionPoint(
+                full_name=None,
+                relative_name=None,
+                reasons=None,
+                crl_issuer=[x509.DirectoryName(
+                    x509.Name([
+                        x509.NameAttribute(
+                            x509.OID_COMMON_NAME, "cryptography CA"
+                        ),
+                    ])
+                )],
+            )
+        ])