SSLError(58, '[ASN1] nested asn1 error (_ssl.c:4174)') and SSLError(0, 'not enough data: cadata does not contain a certificate (_ssl.c:4159)')

If a CA encodes certificate serial number integer value 102 (0x66) as 02 04 00 00 00 66 instead of 02 01 66, which violates the DER standard the following error shows up when trying to load such a certificate:

SSLError(58, '[ASN1] nested asn1 error (_ssl.c:4174)') and SSLError(0, 'not enough data: cadata does not contain a certificate (_ssl.c:4159)')

There are some root certificates in circulation with such non-compliant DER encoding which apparently can't be replaced, and they are causing a host of issues in various Python based applications since Python uses OpenSSL.

I am reporting this as a bug even though I don't consider strict adherence to DER standard to be a bug, but something should be done to allow use of such certificates or there should be an option to relax validation so that this results in a warning instead of error.

Other implementations (Firefox, Chromium) accept those certificates.

Relevant Python issue can be found here.

Current workaround is to:

• Process certificates from Windows certificate store one by one and
• Skip certificates which raise an exception related to this error

@mattcaswell @t8m Please advise.