The late extension caching such that v3 things are not parsed when an X509 certificate is deserialized, but only by side
effect after the fact, sucks. it forces X509 objects to be mutated when the should not need to be, and forces the need
to realize things are not there and to call magical functions to do "yes I really need the v3 stuff" - which has been effecitvely
unversally the case for a very long time.
We should just stop this BS and parse the entire cert up front, and hopefully stop making more memory copies while we are at it
akin to OpenSSL's efforts in openssl/openssl#29117
Solving this probably looks like ensuring d2i fills in the "caches" with an eye to eventually removing them as any sort of notion of a cache. having all sorts of locking nonsense around parsing only part of a certificate is counterproductive complexity.
The late extension caching such that v3 things are not parsed when an X509 certificate is deserialized, but only by side
effect after the fact, sucks. it forces X509 objects to be mutated when the should not need to be, and forces the need
to realize things are not there and to call magical functions to do "yes I really need the v3 stuff" - which has been effecitvely
unversally the case for a very long time.
We should just stop this BS and parse the entire cert up front, and hopefully stop making more memory copies while we are at it
akin to OpenSSL's efforts in openssl/openssl#29117
Solving this probably looks like ensuring d2i fills in the "caches" with an eye to eventually removing them as any sort of notion of a cache. having all sorts of locking nonsense around parsing only part of a certificate is counterproductive complexity.