ASN.1 parsing failed about cryptography

[alex]

For ease of debugging, it's generally helpful if you paste the certificate without teh leading ... from the Python repl.

That said, I can tell you what the problem is in this case: The rules of DER specify that when a field is encoded, if it has it's default value, that it must be omitted from the final output. In this case you have a certificate with an extension whose critical field is explicitly encoded as false, when that is the default value.

In short, whatever created this certificate is emitting invalid certs.

[septs]

https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/hermes/certs/test/gemalto.pem

The certificate extracted from chromium os, it's is eSIM certificate issuer.

[alex]

I suggest someone take it up with teh issuer. There's no good reason in 2024 (or 2017, when this appears to have been issued), to be creating semantically invalid DER certificates.