ValueError: error parsing asn1 value: ParseError { kind: ExtraData }

[tykling]

This happens occationally:

Traceback (most recent call last):
  File "/usr/local/bin/certgrinder", line 8, in <module>
    sys.exit(main())
  File "/usr/local/lib/python3.9/site-packages/certgrinder/certgrinder.py", line 2306, in main
    certgrinder.grind(args)
  File "/usr/local/lib/python3.9/site-packages/certgrinder/certgrinder.py", line 1876, in grind
    getattr(self, args.method)()
  File "/usr/local/lib/python3.9/site-packages/certgrinder/certgrinder.py", line 1679, in periodic
    if not self.check_ocsp():
  File "/usr/local/lib/python3.9/site-packages/certgrinder/certgrinder.py", line 1144, in check_ocsp
    ocsp_response = self.load_ocsp_response(self.ocsp_response_path)
  File "/usr/local/lib/python3.9/site-packages/certgrinder/certgrinder.py", line 1050, in load_ocsp_response
    return ocsp.load_der_ocsp_response(ocsp_response_data)
ValueError: error parsing asn1 value: ParseError { kind: ExtraData }

[tykling]

an OCSP response gotten from LetsEncrypt today showing the issue:

>>> ocsp.load_der_ocsp_response(base64.b64decode(b'MIIBVQoBAKCCAU4wggFKBgkrBgEFBQcwAQEEggE7MIIBNzCBvqE0MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJFNhgPMjAyNDEyMzEwOTE4MDBaMHUwczBLMAkGBSsOAwIaBQAEFNR6OIBB6OmNBzh87Pa22PIPpWQxBBQNxcz9m+4UBaFMMIKlPl6Kw1gJ0gISA6fZIiYouNAZ/FM4cAb8b1rZgAAYDzIwMjQxMjMxMDkxODAwWqARGA8yMDI1MDEwNzA5MTc1OFowCgYIKoZIzj0EAwMDaAAwZQIxAIYiE9csQpnWTCUFBscQJvQLGN5uzr5u0tnEVg5sskabxN8AkShm0XdkRm17HhczxgIwanuZnm724HuDbjZYtQGfUnEFGfa+jCJlWogjGky9NCrAIuOzYScbjYD0Z8Xn/1ydMQ=='))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: error parsing asn1 value: ParseError { kind: ExtraData }
>>> 

this online parser is also unhappy:

https://lapo.it/asn1js/#MIIBVQoBAKCCAU4wggFKBgkrBgEFBQcwAQEEggE7MIIBNzCBvqE0MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJFNhgPMjAyNDEyMzEwOTE4MDBaMHUwczBLMAkGBSsOAwIaBQAEFNR6OIBB6OmNBzh87Pa22PIPpWQxBBQNxcz9m-4UBaFMMIKlPl6Kw1gJ0gISA6fZIiYouNAZ_FM4cAb8b1rZgAAYDzIwMjQxMjMxMDkxODAwWqARGA8yMDI1MDEwNzA5MTc1OFowCgYIKoZIzj0EAwMDaAAwZQIxAIYiE9csQpnWTCUFBscQJvQLGN5uzr5u0tnEVg5sskabxN8AkShm0XdkRm17HhczxgIwanuZnm724HuDbjZYtQGfUnEFGfa-jCJlWogjGky9NCrAIuOzYScbjYD0Z8Xn_1yd

This has been raised in cryptography before: pyca/cryptography#7901

[tykling]

It appears to be a single trailing byte, a 1 causing the issue:

>>> ocsp.load_der_ocsp_response(b'0\x82\x01U\n\x01\x00\xa0\x82\x01N0\x82\x01J\x06\t+\x06\x01\x05\x05\x070\x01\x01\x04\x82\x01;0\x82\x0170\x81\xbe\xa14021\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x160\x14\x06\x03U\x04\n\x13\rLet\'s Encrypt1\x0b0\t\x06\x03U\x04\x03\x13\x02E6\x18\x0f20241231091800Z0u0s0K0\t\x06\x05+\x0e\x03\x02\x1a\x05\x00\x04\x14\xd4z8\x80A\xe8\xe9\x8d\x078|\xec\xf6\xb6\xd8\xf2\x0f\xa5d1\x04\x14\r\xc5\xcc\xfd\x9b\xee\x14\x05\xa1L0\x82\xa5>^\x8a\xc3X\t\xd2\x02\x12\x03\xa7\xd9"&(\xb8\xd0\x19\xfcS8p\x06\xfcoZ\xd9\x80\x00\x18\x0f20241231091800Z\xa0\x11\x18\x0f20250107091758Z0\n\x06\x08*\x86H\xce=\x04\x03\x03\x03h\x000e\x021\x00\x86"\x13\xd7,B\x99\xd6L%\x05\x06\xc7\x10&\xf4\x0b\x18\xden\xce\xben\xd2\xd9\xc4V\x0el\xb2F\x9b\xc4\xdf\x00\x91(f\xd1wdFm{\x1e\x173\xc6\x020j{\x99\x9en\xf6\xe0{\x83n6X\xb5\x01\x9fRq\x05\x19\xf6\xbe\x8c"eZ\x88#\x1aL\xbd4*\xc0"\xe3\xb3a\'\x1b\x8d\x80\xf4g\xc5\xe7\xff\\\x9d1')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: error parsing asn1 value: ParseError { kind: ExtraData }
>>> ocsp.load_der_ocsp_response(b'0\x82\x01U\n\x01\x00\xa0\x82\x01N0\x82\x01J\x06\t+\x06\x01\x05\x05\x070\x01\x01\x04\x82\x01;0\x82\x0170\x81\xbe\xa14021\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x160\x14\x06\x03U\x04\n\x13\rLet\'s Encrypt1\x0b0\t\x06\x03U\x04\x03\x13\x02E6\x18\x0f20241231091800Z0u0s0K0\t\x06\x05+\x0e\x03\x02\x1a\x05\x00\x04\x14\xd4z8\x80A\xe8\xe9\x8d\x078|\xec\xf6\xb6\xd8\xf2\x0f\xa5d1\x04\x14\r\xc5\xcc\xfd\x9b\xee\x14\x05\xa1L0\x82\xa5>^\x8a\xc3X\t\xd2\x02\x12\x03\xa7\xd9"&(\xb8\xd0\x19\xfcS8p\x06\xfcoZ\xd9\x80\x00\x18\x0f20241231091800Z\xa0\x11\x18\x0f20250107091758Z0\n\x06\x08*\x86H\xce=\x04\x03\x03\x03h\x000e\x021\x00\x86"\x13\xd7,B\x99\xd6L%\x05\x06\xc7\x10&\xf4\x0b\x18\xden\xce\xben\xd2\xd9\xc4V\x0el\xb2F\x9b\xc4\xdf\x00\x91(f\xd1wdFm{\x1e\x173\xc6\x020j{\x99\x9en\xf6\xe0{\x83n6X\xb5\x01\x9fRq\x05\x19\xf6\xbe\x8c"eZ\x88#\x1aL\xbd4*\xc0"\xe3\xb3a\'\x1b\x8d\x80\xf4g\xc5\xe7\xff\\\x9d')
<cryptography.hazmat.bindings._rust.ocsp.OCSPResponse object at 0x82df6be70>
>>> 

[tykling]

aec078c