title: How do I remove CT extensions from an x.509 certificate in Python?
body: <p>I'm working on a Python script in which I need to determine if a precertificate and leaf certificate match.</p>
  <p>To do this, I need to compare the TBS cert of the precert and leaf cert, after removing the SCT(1.3.6.1.4.1.11129.2.4.2) and Precert Poison(1.3.6.1.4.1.11129.2.4.3) extensions.</p>
  <p>Using the python cryptography module, it's easy to get the TBS cert:</p>
  <pre class="lang-py prettyprint-override"><code>from cryptography import x509
  from cryptography.hazmat.backends import default_backend
  
  cert = x509.load_pem_x509_certificate(cert_data_pem, default_backend())
  
  print(cert.tbs_certificate_bytes)
  </code></pre>
  <p>However I've not been able to figure out how to remove those extensions. It kind of looks like asn1crypto could do it, but there seems to be very little documentation available.</p>
  <p>What's the neatest way to remove these extensions? I'm happy to depend on openssl if that works, as I'm already using it in the script.</p>