Rename PyAsn1Error, it's getting more general (#8527)

13 files changed, 306 insertions, 222 deletions

diff --git a/src/rust/src/asn1.rs b/src/rust/src/asn1.rs
index 522e21ac6..72dc7101d 100644
--- a/src/rust/src/asn1.rs
+++ b/src/rust/src/asn1.rs
@@ -7,68 +7,67 @@ use pyo3::basic::CompareOp;
 use pyo3::types::IntoPyDict;
 use pyo3::ToPyObject;
 
-pub enum PyAsn1Error {
+pub enum CryptographyError {
     Asn1Parse(asn1::ParseError),
     Asn1Write(asn1::WriteError),
     Py(pyo3::PyErr),
 }
 
-impl From<asn1::ParseError> for PyAsn1Error {
-    fn from(e: asn1::ParseError) -> PyAsn1Error {
-        PyAsn1Error::Asn1Parse(e)
+impl From<asn1::ParseError> for CryptographyError {
+    fn from(e: asn1::ParseError) -> CryptographyError {
+        CryptographyError::Asn1Parse(e)
     }
 }
 
-impl From<asn1::WriteError> for PyAsn1Error {
-    fn from(e: asn1::WriteError) -> PyAsn1Error {
-        PyAsn1Error::Asn1Write(e)
+impl From<asn1::WriteError> for CryptographyError {
+    fn from(e: asn1::WriteError) -> CryptographyError {
+        CryptographyError::Asn1Write(e)
     }
 }
 
-impl From<pyo3::PyErr> for PyAsn1Error {
-    fn from(e: pyo3::PyErr) -> PyAsn1Error {
-        PyAsn1Error::Py(e)
+impl From<pyo3::PyErr> for CryptographyError {
+    fn from(e: pyo3::PyErr) -> CryptographyError {
+        CryptographyError::Py(e)
     }
 }
 
-impl From<pyo3::PyDowncastError<'_>> for PyAsn1Error {
-    fn from(e: pyo3::PyDowncastError<'_>) -> PyAsn1Error {
-        PyAsn1Error::Py(e.into())
+impl From<pyo3::PyDowncastError<'_>> for CryptographyError {
+    fn from(e: pyo3::PyDowncastError<'_>) -> CryptographyError {
+        CryptographyError::Py(e.into())
     }
 }
 
-impl From<pem::PemError> for PyAsn1Error {
-    fn from(e: pem::PemError) -> PyAsn1Error {
-        PyAsn1Error::Py(pyo3::exceptions::PyValueError::new_err(format!(
+impl From<pem::PemError> for CryptographyError {
+    fn from(e: pem::PemError) -> CryptographyError {
+        CryptographyError::Py(pyo3::exceptions::PyValueError::new_err(format!(
             "Unable to load PEM file. See https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file for more details. {:?}",
             e
         )))
     }
 }
 
-impl From<PyAsn1Error> for pyo3::PyErr {
-    fn from(e: PyAsn1Error) -> pyo3::PyErr {
+impl From<CryptographyError> for pyo3::PyErr {
+    fn from(e: CryptographyError) -> pyo3::PyErr {
         match e {
-            PyAsn1Error::Asn1Parse(asn1_error) => pyo3::exceptions::PyValueError::new_err(format!(
-                "error parsing asn1 value: {:?}",
-                asn1_error
-            )),
-            PyAsn1Error::Asn1Write(asn1::WriteError::AllocationError) => {
+            CryptographyError::Asn1Parse(asn1_error) => pyo3::exceptions::PyValueError::new_err(
+                format!("error parsing asn1 value: {:?}", asn1_error),
+            ),
+            CryptographyError::Asn1Write(asn1::WriteError::AllocationError) => {
                 pyo3::exceptions::PyMemoryError::new_err(
                     "failed to allocate memory while performing ASN.1 serialization",
                 )
             }
-            PyAsn1Error::Py(py_error) => py_error,
+            CryptographyError::Py(py_error) => py_error,
         }
     }
 }
 
-impl PyAsn1Error {
+impl CryptographyError {
     pub(crate) fn add_location(self, loc: asn1::ParseLocation) -> Self {
         match self {
-            PyAsn1Error::Py(e) => PyAsn1Error::Py(e),
-            PyAsn1Error::Asn1Parse(e) => PyAsn1Error::Asn1Parse(e.add_location(loc)),
-            PyAsn1Error::Asn1Write(e) => PyAsn1Error::Asn1Write(e),
+            CryptographyError::Py(e) => CryptographyError::Py(e),
+            CryptographyError::Asn1Parse(e) => CryptographyError::Asn1Parse(e.add_location(loc)),
+            CryptographyError::Asn1Write(e) => CryptographyError::Asn1Write(e),
         }
     }
 }
@@ -76,7 +75,7 @@ impl PyAsn1Error {
 // The primary purpose of this alias is for brevity to keep function signatures
 // to a single-line as a work around for coverage issues. See
 // https://github.com/pyca/cryptography/pull/6173
-pub(crate) type PyAsn1Result<T = pyo3::PyObject> = Result<T, PyAsn1Error>;
+pub(crate) type CryptographyResult<T = pyo3::PyObject> = Result<T, CryptographyError>;
 
 pub(crate) fn py_oid_to_oid(py_oid: &pyo3::PyAny) -> pyo3::PyResult<asn1::ObjectIdentifier> {
     Ok(py_oid
@@ -106,7 +105,10 @@ struct Spki<'a> {
 }
 
 #[pyo3::prelude::pyfunction]
-fn parse_spki_for_data(py: pyo3::Python<'_>, data: &[u8]) -> Result<pyo3::PyObject, PyAsn1Error> {
+fn parse_spki_for_data(
+    py: pyo3::Python<'_>,
+    data: &[u8],
+) -> Result<pyo3::PyObject, CryptographyError> {
     let spki = asn1::parse_single::<Spki<'_>>(data)?;
     if spki.data.padding_bits() != 0 {
         return Err(pyo3::exceptions::PyValueError::new_err("Invalid public key encoding").into());
@@ -131,7 +133,10 @@ pub(crate) fn big_byte_slice_to_py_int<'p>(
 }
 
 #[pyo3::prelude::pyfunction]
-fn decode_dss_signature(py: pyo3::Python<'_>, data: &[u8]) -> Result<pyo3::PyObject, PyAsn1Error> {
+fn decode_dss_signature(
+    py: pyo3::Python<'_>,
+    data: &[u8],
+) -> Result<pyo3::PyObject, CryptographyError> {
     let sig = asn1::parse_single::<DssSignature<'_>>(data)?;
 
     Ok((
@@ -164,7 +169,7 @@ pub(crate) fn encode_der_data<'p>(
     pem_tag: String,
     data: Vec<u8>,
     encoding: &'p pyo3::PyAny,
-) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+) -> CryptographyResult<&'p pyo3::types::PyBytes> {
     let encoding_class = py
         .import("cryptography.hazmat.primitives.serialization")?
         .getattr(crate::intern!(py, "Encoding"))?;
@@ -198,7 +203,7 @@ fn encode_dss_signature(
     py: pyo3::Python<'_>,
     r: &pyo3::types::PyLong,
     s: &pyo3::types::PyLong,
-) -> PyAsn1Result<pyo3::PyObject> {
+) -> CryptographyResult<pyo3::PyObject> {
     let sig = DssSignature {
         r: asn1::BigUint::new(py_uint_to_big_endian_bytes(py, r)?).unwrap(),
         s: asn1::BigUint::new(py_uint_to_big_endian_bytes(py, s)?).unwrap(),
@@ -264,7 +269,7 @@ fn parse_name_value_tags(rdns: &mut Name<'_>) -> Vec<u8> {
 }
 
 #[pyo3::prelude::pyfunction]
-fn test_parse_certificate(data: &[u8]) -> Result<TestCertificate, PyAsn1Error> {
+fn test_parse_certificate(data: &[u8]) -> Result<TestCertificate, CryptographyError> {
     let mut asn1_cert = asn1::parse_single::<Asn1Certificate<'_>>(data)?;
 
     Ok(TestCertificate {
@@ -295,31 +300,33 @@ pub(crate) fn create_submodule(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::pr
 
 #[cfg(test)]
 mod tests {
-    use super::PyAsn1Error;
+    use super::CryptographyError;
 
     #[test]
-    fn test_pyasn1error_from() {
+    fn test_cryptographyerror_from() {
         pyo3::prepare_freethreaded_python();
         pyo3::Python::with_gil(|py| {
-            let e: PyAsn1Error = asn1::WriteError::AllocationError.into();
+            let e: CryptographyError = asn1::WriteError::AllocationError.into();
             assert!(matches!(
                 e,
-                PyAsn1Error::Asn1Write(asn1::WriteError::AllocationError)
+                CryptographyError::Asn1Write(asn1::WriteError::AllocationError)
             ));
             let py_e: pyo3::PyErr = e.into();
             assert!(py_e.is_instance::<pyo3::exceptions::PyMemoryError>(py));
 
-            let e: PyAsn1Error = pyo3::PyDowncastError::new(py.None().as_ref(py), "abc").into();
-            assert!(matches!(e, PyAsn1Error::Py(_)));
+            let e: CryptographyError =
+                pyo3::PyDowncastError::new(py.None().as_ref(py), "abc").into();
+            assert!(matches!(e, CryptographyError::Py(_)));
         })
     }
 
     #[test]
-    fn test_pyasn1error_add_location() {
+    fn test_cryptographyerror_add_location() {
         let py_err = pyo3::PyErr::new::<pyo3::exceptions::PyValueError, _>("Error!");
-        PyAsn1Error::Py(py_err).add_location(asn1::ParseLocation::Field("meh"));
+        CryptographyError::Py(py_err).add_location(asn1::ParseLocation::Field("meh"));
 
         let asn1_write_err = asn1::WriteError::AllocationError;
-        PyAsn1Error::Asn1Write(asn1_write_err).add_location(asn1::ParseLocation::Field("meh"));
+        CryptographyError::Asn1Write(asn1_write_err)
+            .add_location(asn1::ParseLocation::Field("meh"));
     }
 }
diff --git a/src/rust/src/oid.rs b/src/rust/src/oid.rs
index 724f78eaa..c172310c0 100644
--- a/src/rust/src/oid.rs
+++ b/src/rust/src/oid.rs
@@ -2,7 +2,7 @@
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
 
-use crate::asn1::PyAsn1Result;
+use crate::asn1::CryptographyResult;
 use std::collections::hash_map::DefaultHasher;
 use std::hash::{Hash, Hasher};
 
@@ -14,7 +14,7 @@ pub(crate) struct ObjectIdentifier {
 #[pyo3::pymethods]
 impl ObjectIdentifier {
     #[new]
-    fn new(value: &str) -> PyAsn1Result<Self> {
+    fn new(value: &str) -> CryptographyResult<Self> {
         let oid = asn1::ObjectIdentifier::from_string(value)
             .ok_or_else(|| asn1::ParseError::new(asn1::ParseErrorKind::InvalidValue))?;
         Ok(ObjectIdentifier { oid })
diff --git a/src/rust/src/pkcs7.rs b/src/rust/src/pkcs7.rs
index 48eb09932..557c09be1 100644
--- a/src/rust/src/pkcs7.rs
+++ b/src/rust/src/pkcs7.rs
@@ -2,7 +2,7 @@
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
 
-use crate::asn1::{encode_der_data, PyAsn1Result};
+use crate::asn1::{encode_der_data, CryptographyResult};
 use crate::x509;
 
 use chrono::Timelike;
@@ -87,7 +87,7 @@ fn serialize_certificates<'p>(
     py: pyo3::Python<'p>,
     py_certs: Vec<pyo3::PyRef<'p, x509::Certificate>>,
     encoding: &'p pyo3::PyAny,
-) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+) -> CryptographyResult<&'p pyo3::types::PyBytes> {
     if py_certs.is_empty() {
         return Err(pyo3::exceptions::PyTypeError::new_err(
             "certs must be a list of certs with length >= 1",
@@ -129,7 +129,7 @@ fn sign_and_serialize<'p>(
     builder: &'p pyo3::PyAny,
     encoding: &'p pyo3::PyAny,
     options: &'p pyo3::types::PyList,
-) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+) -> CryptographyResult<&'p pyo3::types::PyBytes> {
     let pkcs7_options = py
         .import("cryptography.hazmat.primitives.serialization.pkcs7")?
         .getattr(crate::intern!(py, "PKCS7Options"))?;
diff --git a/src/rust/src/x509/certificate.rs b/src/rust/src/x509/certificate.rs
index d47c9b2c3..39d0ebfb5 100644
--- a/src/rust/src/x509/certificate.rs
+++ b/src/rust/src/x509/certificate.rs
@@ -4,7 +4,7 @@
 
 use crate::asn1::{
     big_byte_slice_to_py_int, encode_der_data, oid_to_py_oid, py_uint_to_big_endian_bytes,
-    PyAsn1Error, PyAsn1Result,
+    CryptographyError, CryptographyResult,
 };
 use crate::x509;
 use crate::x509::{crl, extensions, oid, sct, sign, Asn1ReadableOrWritable};
@@ -121,7 +121,7 @@ impl Certificate {
         slf
     }
 
-    fn public_key<'p>(&self, py: pyo3::Python<'p>) -> PyAsn1Result<&'p pyo3::PyAny> {
+    fn public_key<'p>(&self, py: pyo3::Python<'p>) -> CryptographyResult<&'p pyo3::PyAny> {
         // This makes an unnecessary copy. It'd be nice to get rid of it.
         let serialized = pyo3::types::PyBytes::new(
             py,
@@ -137,7 +137,7 @@ impl Certificate {
         &self,
         py: pyo3::Python<'p>,
         algorithm: pyo3::PyObject,
-    ) -> PyAsn1Result<&'p pyo3::PyAny> {
+    ) -> CryptographyResult<&'p pyo3::PyAny> {
         let hasher = py
             .import("cryptography.hazmat.primitives.hashes")?
             .getattr(crate::intern!(py, "Hash"))?
@@ -153,21 +153,24 @@ impl Certificate {
         &self,
         py: pyo3::Python<'p>,
         encoding: &'p pyo3::PyAny,
-    ) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+    ) -> CryptographyResult<&'p pyo3::types::PyBytes> {
         let result = asn1::write_single(self.raw.borrow_value())?;
 
         encode_der_data(py, "CERTIFICATE".to_string(), result, encoding)
     }
 
     #[getter]
-    fn serial_number<'p>(&self, py: pyo3::Python<'p>) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    fn serial_number<'p>(
+        &self,
+        py: pyo3::Python<'p>,
+    ) -> Result<&'p pyo3::PyAny, CryptographyError> {
         let bytes = self.raw.borrow_value().tbs_cert.serial.as_bytes();
         warn_if_negative_serial(py, bytes)?;
         Ok(big_byte_slice_to_py_int(py, bytes)?)
     }
 
     #[getter]
-    fn version<'p>(&self, py: pyo3::Python<'p>) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    fn version<'p>(&self, py: pyo3::Python<'p>) -> Result<&'p pyo3::PyAny, CryptographyError> {
         let version = &self.raw.borrow_value().tbs_cert.version;
         cert_version(py, *version)
     }
@@ -192,7 +195,7 @@ impl Certificate {
     fn tbs_certificate_bytes<'p>(
         &self,
         py: pyo3::Python<'p>,
-    ) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+    ) -> CryptographyResult<&'p pyo3::types::PyBytes> {
         let result = asn1::write_single(&self.raw.borrow_value().tbs_cert)?;
         Ok(pyo3::types::PyBytes::new(py, &result))
     }
@@ -201,7 +204,7 @@ impl Certificate {
     fn tbs_precertificate_bytes<'p>(
         &self,
         py: pyo3::Python<'p>,
-    ) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+    ) -> CryptographyResult<&'p pyo3::types::PyBytes> {
         let val = self.raw.borrow_value();
         let mut tbs_precert = val.tbs_cert.clone();
         // Remove the SCT list extension
@@ -213,9 +216,11 @@ impl Certificate {
                     .filter(|x| x.extn_id != oid::PRECERT_SIGNED_CERTIFICATE_TIMESTAMPS_OID)
                     .collect();
                 if filtered_extensions.len() == ext_count {
-                    return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                        "Could not find pre-certificate SCT list extension",
-                    )));
+                    return Err(CryptographyError::from(
+                        pyo3::exceptions::PyValueError::new_err(
+                            "Could not find pre-certificate SCT list extension",
+                        ),
+                    ));
                 }
                 let filtered_extensions: x509::Extensions<'_> = Asn1ReadableOrWritable::new_write(
                     asn1::SequenceOfWriter::new(filtered_extensions),
@@ -224,9 +229,11 @@ impl Certificate {
                 let result = asn1::write_single(&tbs_precert)?;
                 Ok(pyo3::types::PyBytes::new(py, &result))
             }
-            None => Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                "Could not find any extensions in TBS certificate",
-            ))),
+            None => Err(CryptographyError::from(
+                pyo3::exceptions::PyValueError::new_err(
+                    "Could not find any extensions in TBS certificate",
+                ),
+            )),
         }
     }
 
@@ -263,14 +270,14 @@ impl Certificate {
     fn signature_hash_algorithm<'p>(
         &self,
         py: pyo3::Python<'p>,
-    ) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    ) -> Result<&'p pyo3::PyAny, CryptographyError> {
         let sig_oids_to_hash = py
             .import("cryptography.hazmat._oid")?
             .getattr(crate::intern!(py, "_SIG_OIDS_TO_HASH"))?;
         let hash_alg = sig_oids_to_hash.get_item(self.signature_algorithm_oid(py)?);
         match hash_alg {
             Ok(data) => Ok(data),
-            Err(_) => Err(PyAsn1Error::from(pyo3::PyErr::from_instance(
+            Err(_) => Err(CryptographyError::from(pyo3::PyErr::from_instance(
                 py.import("cryptography.exceptions")?.call_method1(
                     "UnsupportedAlgorithm",
                     (format!(
@@ -324,16 +331,18 @@ impl Certificate {
         &self,
         py: pyo3::Python<'_>,
         issuer: pyo3::PyRef<'_, Certificate>,
-    ) -> PyAsn1Result<()> {
+    ) -> CryptographyResult<()> {
         if self.raw.borrow_value().tbs_cert.signature_alg != self.raw.borrow_value().signature_alg {
-            return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
+            return Err(CryptographyError::from(pyo3::exceptions::PyValueError::new_err(
                 "Inner and outer signature algorithms do not match. This is an invalid certificate."
             )));
         };
         if self.raw.borrow_value().tbs_cert.issuer != issuer.raw.borrow_value().tbs_cert.subject {
-            return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                "Issuer certificate subject does not match certificate issuer.",
-            )));
+            return Err(CryptographyError::from(
+                pyo3::exceptions::PyValueError::new_err(
+                    "Issuer certificate subject does not match certificate issuer.",
+                ),
+            ));
         };
         sign::verify_signature_with_oid(
             py,
@@ -345,7 +354,7 @@ impl Certificate {
     }
 }
 
-fn cert_version(py: pyo3::Python<'_>, version: u8) -> Result<&pyo3::PyAny, PyAsn1Error> {
+fn cert_version(py: pyo3::Python<'_>, version: u8) -> Result<&pyo3::PyAny, CryptographyError> {
     let x509_module = py.import("cryptography.x509")?;
     match version {
         0 => Ok(x509_module
@@ -354,7 +363,7 @@ fn cert_version(py: pyo3::Python<'_>, version: u8) -> Result<&pyo3::PyAny, PyAsn
         2 => Ok(x509_module
             .getattr(crate::intern!(py, "Version"))?
             .get_item("v3")?),
-        _ => Err(PyAsn1Error::from(pyo3::PyErr::from_instance(
+        _ => Err(CryptographyError::from(pyo3::PyErr::from_instance(
             x509_module
                 .getattr(crate::intern!(py, "InvalidVersion"))?
                 .call1((format!("{} is not a valid X509 version", version), version))?,
@@ -363,7 +372,7 @@ fn cert_version(py: pyo3::Python<'_>, version: u8) -> Result<&pyo3::PyAny, PyAsn
 }
 
 #[pyo3::prelude::pyfunction]
-fn load_pem_x509_certificate(py: pyo3::Python<'_>, data: &[u8]) -> PyAsn1Result<Certificate> {
+fn load_pem_x509_certificate(py: pyo3::Python<'_>, data: &[u8]) -> CryptographyResult<Certificate> {
     // We support both PEM header strings that OpenSSL does
     // https://github.com/openssl/openssl/blob/5e2d22d53ed322a7124e26a4fbd116a8210eb77a/include/openssl/pem.h#L32-L33
     let parsed = x509::find_in_pem(
@@ -375,7 +384,10 @@ fn load_pem_x509_certificate(py: pyo3::Python<'_>, data: &[u8]) -> PyAsn1Result<
 }
 
 #[pyo3::prelude::pyfunction]
-fn load_pem_x509_certificates(py: pyo3::Python<'_>, data: &[u8]) -> PyAsn1Result<Vec<Certificate>> {
+fn load_pem_x509_certificates(
+    py: pyo3::Python<'_>,
+    data: &[u8],
+) -> CryptographyResult<Vec<Certificate>> {
     let certs = pem::parse_many(data)?
         .iter()
         .filter(|p| p.tag == "CERTIFICATE" || p.tag == "X509 CERTIFICATE")
@@ -383,14 +395,14 @@ fn load_pem_x509_certificates(py: pyo3::Python<'_>, data: &[u8]) -> PyAsn1Result
         .collect::<Result<Vec<_>, _>>()?;
 
     if certs.is_empty() {
-        return Err(PyAsn1Error::from(pem::PemError::MalformedFraming));
+        return Err(CryptographyError::from(pem::PemError::MalformedFraming));
     }
 
     Ok(certs)
 }
 
 #[pyo3::prelude::pyfunction]
-fn load_der_x509_certificate(py: pyo3::Python<'_>, data: &[u8]) -> PyAsn1Result<Certificate> {
+fn load_der_x509_certificate(py: pyo3::Python<'_>, data: &[u8]) -> CryptographyResult<Certificate> {
     let raw = OwnedRawCertificate::try_new(Arc::from(data), |data| asn1::parse_single(data))?;
     // Parse cert version immediately so we can raise error on parse if it is invalid.
     cert_version(py, raw.borrow_value().tbs_cert.version)?;
@@ -493,7 +505,7 @@ fn parse_display_text(
 fn parse_user_notice(
     py: pyo3::Python<'_>,
     un: UserNotice<'_>,
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let x509_module = py.import("cryptography.x509")?;
     let et = match un.explicit_text {
         Some(data) => parse_display_text(py, data)?,
@@ -520,7 +532,7 @@ fn parse_user_notice(
 fn parse_policy_qualifiers<'a>(
     py: pyo3::Python<'_>,
     policy_qualifiers: &asn1::SequenceOf<'a, PolicyQualifierInfo<'a>>,
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let py_pq = pyo3::types::PyList::empty(py);
     for pqi in policy_qualifiers.clone() {
         let qualifier = match pqi.qualifier {
@@ -528,16 +540,20 @@ fn parse_policy_qualifiers<'a>(
                 if pqi.policy_qualifier_id == oid::CP_CPS_URI_OID {
                     pyo3::types::PyString::new(py, data.as_str()).to_object(py)
                 } else {
-                    return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                        "CpsUri ASN.1 structure found but OID did not match",
-                    )));
+                    return Err(CryptographyError::from(
+                        pyo3::exceptions::PyValueError::new_err(
+                            "CpsUri ASN.1 structure found but OID did not match",
+                        ),
+                    ));
                 }
             }
             Qualifier::UserNotice(un) => {
                 if pqi.policy_qualifier_id != oid::CP_USER_NOTICE_OID {
-                    return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                        "UserNotice ASN.1 structure found but OID did not match",
-                    )));
+                    return Err(CryptographyError::from(
+                        pyo3::exceptions::PyValueError::new_err(
+                            "UserNotice ASN.1 structure found but OID did not match",
+                        ),
+                    ));
                 }
                 parse_user_notice(py, un)?
             }
@@ -547,7 +563,7 @@ fn parse_policy_qualifiers<'a>(
     Ok(py_pq.to_object(py))
 }
 
-fn parse_cp(py: pyo3::Python<'_>, ext_data: &[u8]) -> Result<pyo3::PyObject, PyAsn1Error> {
+fn parse_cp(py: pyo3::Python<'_>, ext_data: &[u8]) -> Result<pyo3::PyObject, CryptographyError> {
     let cp = asn1::parse_single::<asn1::SequenceOf<'_, PolicyInformation<'_>>>(ext_data)?;
     let x509_module = py.import("cryptography.x509")?;
     let certificate_policies = pyo3::types::PyList::empty(py);
@@ -598,7 +614,7 @@ pub(crate) struct GeneralSubtree<'a> {
 fn parse_general_subtrees(
     py: pyo3::Python<'_>,
     subtrees: SequenceOfSubtrees<'_>,
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let gns = pyo3::types::PyList::empty(py);
     for gs in subtrees.unwrap_read().clone() {
         gns.append(x509::parse_general_name(py, gs.base)?)?;
@@ -646,7 +662,7 @@ pub(crate) struct AuthorityKeyIdentifier<'a> {
 pub(crate) fn parse_distribution_point_name(
     py: pyo3::Python<'_>,
     dp: DistributionPointName<'_>,
-) -> Result<(pyo3::PyObject, pyo3::PyObject), PyAsn1Error> {
+) -> Result<(pyo3::PyObject, pyo3::PyObject), CryptographyError> {
     Ok(match dp {
         DistributionPointName::FullName(data) => (
             x509::parse_general_names(py, data.unwrap_read())?,
@@ -661,7 +677,7 @@ pub(crate) fn parse_distribution_point_name(
 fn parse_distribution_point(
     py: pyo3::Python<'_>,
     dp: DistributionPoint<'_>,
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let (full_name, relative_name) = match dp.distribution_point {
         Some(data) => parse_distribution_point_name(py, data)?,
         None => (py.None(), py.None()),
@@ -682,7 +698,7 @@ fn parse_distribution_point(
 pub(crate) fn parse_distribution_points(
     py: pyo3::Python<'_>,
     data: &[u8],
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let dps = asn1::parse_single::<asn1::SequenceOf<'_, DistributionPoint<'_>>>(data)?;
     let py_dps = pyo3::types::PyList::empty(py);
     for dp in dps {
@@ -695,7 +711,7 @@ pub(crate) fn parse_distribution_points(
 pub(crate) fn parse_distribution_point_reasons(
     py: pyo3::Python<'_>,
     reasons: Option<&asn1::BitString<'_>>,
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let reason_bit_mapping = py
         .import("cryptography.x509.extensions")?
         .getattr(crate::intern!(py, "_REASON_BIT_MAPPING"))?;
@@ -753,7 +769,7 @@ pub(crate) struct PolicyConstraints {
 pub(crate) fn parse_authority_key_identifier<'p>(
     py: pyo3::Python<'p>,
     ext_data: &[u8],
-) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+) -> Result<&'p pyo3::PyAny, CryptographyError> {
     let x509_module = py.import("cryptography.x509")?;
     let aki = asn1::parse_single::<AuthorityKeyIdentifier<'_>>(ext_data)?;
     let serial = match aki.authority_cert_serial_number {
@@ -772,7 +788,7 @@ pub(crate) fn parse_authority_key_identifier<'p>(
 pub(crate) fn parse_access_descriptions(
     py: pyo3::Python<'_>,
     ext_data: &[u8],
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let x509_module = py.import("cryptography.x509")?;
     let ads = pyo3::types::PyList::empty(py);
     let parsed = asn1::parse_single::<x509::common::SequenceOfAccessDescriptions<'_>>(ext_data)?;
@@ -792,7 +808,7 @@ pub fn parse_cert_ext<'p>(
     py: pyo3::Python<'p>,
     oid: asn1::ObjectIdentifier,
     ext_data: &[u8],
-) -> PyAsn1Result<Option<&'p pyo3::PyAny>> {
+) -> CryptographyResult<Option<&'p pyo3::PyAny>> {
     let x509_module = py.import("cryptography.x509")?;
     match oid {
         oid::SUBJECT_ALTERNATIVE_NAME_OID => {
@@ -973,12 +989,17 @@ pub fn parse_cert_ext<'p>(
     }
 }
 
-pub(crate) fn time_from_py(py: pyo3::Python<'_>, val: &pyo3::PyAny) -> PyAsn1Result<x509::Time> {
+pub(crate) fn time_from_py(
+    py: pyo3::Python<'_>,
+    val: &pyo3::PyAny,
+) -> CryptographyResult<x509::Time> {
     let dt = x509::py_to_chrono(py, val)?;
     time_from_chrono(dt)
 }
 
-pub(crate) fn time_from_chrono(dt: chrono::DateTime<chrono::Utc>) -> PyAsn1Result<x509::Time> {
+pub(crate) fn time_from_chrono(
+    dt: chrono::DateTime<chrono::Utc>,
+) -> CryptographyResult<x509::Time> {
     if dt.year() >= 2050 {
         Ok(x509::Time::GeneralizedTime(asn1::GeneralizedTime::new(dt)?))
     } else {
@@ -992,7 +1013,7 @@ fn create_x509_certificate(
     builder: &pyo3::PyAny,
     private_key: &pyo3::PyAny,
     hash_algorithm: &pyo3::PyAny,
-) -> PyAsn1Result<Certificate> {
+) -> CryptographyResult<Certificate> {
     let sigalg = x509::sign::compute_signature_algorithm(py, private_key, hash_algorithm)?;
     let serialization_mod = py.import("cryptography.hazmat.primitives.serialization")?;
     let der_encoding = serialization_mod
diff --git a/src/rust/src/x509/common.rs b/src/rust/src/x509/common.rs
index b4ffc41b2..e93ec7ec0 100644
--- a/src/rust/src/x509/common.rs
+++ b/src/rust/src/x509/common.rs
@@ -2,7 +2,7 @@
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
 
-use crate::asn1::{oid_to_py_oid, py_oid_to_oid, PyAsn1Error, PyAsn1Result};
+use crate::asn1::{oid_to_py_oid, py_oid_to_oid, CryptographyError, CryptographyResult};
 use crate::x509;
 use chrono::{Datelike, TimeZone, Timelike};
 use pyo3::types::IntoPyDict;
@@ -17,15 +17,14 @@ pub(crate) fn find_in_pem(
     data: &[u8],
     filter_fn: fn(&pem::Pem) -> bool,
     no_match_err: &'static str,
-) -> Result<pem::Pem, PyAsn1Error> {
+) -> Result<pem::Pem, CryptographyError> {
     let all_sections = pem::parse_many(data)?;
     if all_sections.is_empty() {
-        return Err(PyAsn1Error::from(pem::PemError::MalformedFraming));
+        return Err(CryptographyError::from(pem::PemError::MalformedFraming));
     }
-    all_sections
-        .into_iter()
-        .find(filter_fn)
-        .ok_or_else(|| PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(no_match_err)))
+    all_sections.into_iter().find(filter_fn).ok_or_else(|| {
+        CryptographyError::from(pyo3::exceptions::PyValueError::new_err(no_match_err))
+    })
 }
 
 pub(crate) type Name<'a> = Asn1ReadableOrWritable<
@@ -103,7 +102,7 @@ pub(crate) fn encode_name<'p>(
 pub(crate) fn encode_name_entry<'p>(
     py: pyo3::Python<'p>,
     py_name_entry: &'p pyo3::PyAny,
-) -> PyAsn1Result<AttributeTypeValue<'p>> {
+) -> CryptographyResult<AttributeTypeValue<'p>> {
     let asn1_type = py
         .import("cryptography.x509.name")?
         .getattr(crate::intern!(py, "_ASN1Type"))?;
@@ -141,7 +140,7 @@ pub(crate) fn encode_name_entry<'p>(
 fn encode_name_bytes<'p>(
     py: pyo3::Python<'p>,
     py_name: &'p pyo3::PyAny,
-) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+) -> CryptographyResult<&'p pyo3::types::PyBytes> {
     let name = encode_name(py, py_name)?;
     let result = asn1::write_single(&name)?;
     Ok(pyo3::types::PyBytes::new(py, &result))
@@ -217,7 +216,7 @@ pub(crate) type SequenceOfGeneralName<'a> = Asn1ReadableOrWritable<
 pub(crate) fn encode_general_names<'a>(
     py: pyo3::Python<'a>,
     py_gns: &'a pyo3::PyAny,
-) -> Result<Vec<GeneralName<'a>>, PyAsn1Error> {
+) -> Result<Vec<GeneralName<'a>>, CryptographyError> {
     let mut gns = vec![];
     for el in py_gns.iter()? {
         let gn = encode_general_name(py, el?)?;
@@ -229,7 +228,7 @@ pub(crate) fn encode_general_names<'a>(
 pub(crate) fn encode_general_name<'a>(
     py: pyo3::Python<'a>,
     gn: &'a pyo3::PyAny,
-) -> Result<GeneralName<'a>, PyAsn1Error> {
+) -> Result<GeneralName<'a>, CryptographyError> {
     let gn_module = py.import("cryptography.x509.general_name")?;
     let gn_type = gn.get_type().as_ref();
     let gn_value = gn.getattr(crate::intern!(py, "value"))?;
@@ -266,9 +265,9 @@ pub(crate) fn encode_general_name<'a>(
         let oid = py_oid_to_oid(gn_value)?;
         Ok(GeneralName::RegisteredID(oid))
     } else {
-        Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-            "Unsupported GeneralName type",
-        )))
+        Err(CryptographyError::from(
+            pyo3::exceptions::PyValueError::new_err("Unsupported GeneralName type"),
+        ))
     }
 }
 
@@ -287,7 +286,7 @@ pub(crate) type SequenceOfAccessDescriptions<'a> = Asn1ReadableOrWritable<
 pub(crate) fn encode_access_descriptions<'a>(
     py: pyo3::Python<'a>,
     py_ads: &'a pyo3::PyAny,
-) -> Result<SequenceOfAccessDescriptions<'a>, PyAsn1Error> {
+) -> Result<SequenceOfAccessDescriptions<'a>, CryptographyError> {
     let mut ads = vec![];
     for py_ad in py_ads.iter()? {
         let py_ad = py_ad?;
@@ -342,7 +341,7 @@ pub(crate) struct Extension<'a> {
 pub(crate) fn parse_name<'p>(
     py: pyo3::Python<'p>,
     name: &Name<'_>,
-) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+) -> Result<&'p pyo3::PyAny, CryptographyError> {
     let x509_module = py.import("cryptography.x509")?;
     let py_rdns = pyo3::types::PyList::empty(py);
     for rdn in name.unwrap_read().clone() {
@@ -355,7 +354,7 @@ pub(crate) fn parse_name<'p>(
 fn parse_name_attribute(
     py: pyo3::Python<'_>,
     attribute: AttributeTypeValue<'_>,
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let x509_module = py.import("cryptography.x509")?;
     let oid = oid_to_py_oid(py, &attribute.type_id)?.to_object(py);
     let tag_enum = py
@@ -366,7 +365,7 @@ fn parse_name_attribute(
         .tag()
         .as_u8()
         .ok_or_else(|| {
-            PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
+            CryptographyError::from(pyo3::exceptions::PyValueError::new_err(
                 "Long-form tags are not supported in NameAttribute values",
             ))
         })?
@@ -400,7 +399,7 @@ fn parse_name_attribute(
 pub(crate) fn parse_rdn<'a>(
     py: pyo3::Python<'_>,
     rdn: &asn1::SetOf<'a, AttributeTypeValue<'a>>,
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let x509_module = py.import("cryptography.x509")?;
     let py_attrs = pyo3::types::PySet::empty(py)?;
     for attribute in rdn.clone() {
@@ -415,7 +414,7 @@ pub(crate) fn parse_rdn<'a>(
 pub(crate) fn parse_general_name(
     py: pyo3::Python<'_>,
     gn: GeneralName<'_>,
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let x509_module = py.import("cryptography.x509")?;
     let py_gn = match gn {
         GeneralName::OtherName(data) => {
@@ -462,7 +461,7 @@ pub(crate) fn parse_general_name(
                 .to_object(py)
         }
         _ => {
-            return Err(PyAsn1Error::from(pyo3::PyErr::from_instance(
+            return Err(CryptographyError::from(pyo3::PyErr::from_instance(
                 x509_module.call_method1(
                     "UnsupportedGeneralNameType",
                     ("x400Address/EDIPartyName are not supported types",),
@@ -476,7 +475,7 @@ pub(crate) fn parse_general_name(
 pub(crate) fn parse_general_names<'a>(
     py: pyo3::Python<'_>,
     gn_seq: &asn1::SequenceOf<'a, GeneralName<'a>>,
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let gns = pyo3::types::PyList::empty(py);
     for gn in gn_seq.clone() {
         let py_gn = parse_general_name(py, gn)?;
@@ -485,7 +484,10 @@ pub(crate) fn parse_general_names<'a>(
     Ok(gns.to_object(py))
 }
 
-fn create_ip_network(py: pyo3::Python<'_>, data: &[u8]) -> Result<pyo3::PyObject, PyAsn1Error> {
+fn create_ip_network(
+    py: pyo3::Python<'_>,
+    data: &[u8],
+) -> Result<pyo3::PyObject, CryptographyError> {
     let ip_module = py.import("ipaddress")?;
     let x509_module = py.import("cryptography.x509")?;
     let prefix = match data.len() {
@@ -497,7 +499,7 @@ fn create_ip_network(py: pyo3::Python<'_>, data: &[u8]) -> Result<pyo3::PyObject
             let num = u128::from_be_bytes(data[16..].try_into().unwrap());
             ipv6_netmask(num)
         }
-        _ => Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
+        _ => Err(CryptographyError::from(pyo3::exceptions::PyValueError::new_err(
             format!("Invalid IPNetwork, must be 8 bytes for IPv4 and 32 bytes for IPv6. Found length: {}", data.len()),
         ))),
     };
@@ -517,31 +519,31 @@ fn create_ip_network(py: pyo3::Python<'_>, data: &[u8]) -> Result<pyo3::PyObject
         .to_object(py))
 }
 
-fn ipv4_netmask(num: u32) -> Result<u32, PyAsn1Error> {
+fn ipv4_netmask(num: u32) -> Result<u32, CryptographyError> {
     // we invert and check leading zeros because leading_ones wasn't stabilized
     // until 1.46.0. When we raise our MSRV we should change this
     if (!num).leading_zeros() + num.trailing_zeros() != 32 {
-        return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-            "Invalid netmask",
-        )));
+        return Err(CryptographyError::from(
+            pyo3::exceptions::PyValueError::new_err("Invalid netmask"),
+        ));
     }
     Ok((!num).leading_zeros())
 }
 
-fn ipv6_netmask(num: u128) -> Result<u32, PyAsn1Error> {
+fn ipv6_netmask(num: u128) -> Result<u32, CryptographyError> {
     // we invert and check leading zeros because leading_ones wasn't stabilized
     // until 1.46.0. When we raise our MSRV we should change this
     if (!num).leading_zeros() + num.trailing_zeros() != 128 {
-        return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-            "Invalid netmask",
-        )));
+        return Err(CryptographyError::from(
+            pyo3::exceptions::PyValueError::new_err("Invalid netmask"),
+        ));
     }
     Ok((!num).leading_zeros())
 }
 
 pub(crate) fn parse_and_cache_extensions<
     'p,
-    F: Fn(&asn1::ObjectIdentifier, &[u8]) -> Result<Option<&'p pyo3::PyAny>, PyAsn1Error>,
+    F: Fn(&asn1::ObjectIdentifier, &[u8]) -> Result<Option<&'p pyo3::PyAny>, CryptographyError>,
 >(
     py: pyo3::Python<'p>,
     cached_extensions: &mut Option<pyo3::PyObject>,
@@ -589,7 +591,11 @@ pub(crate) fn parse_and_cache_extensions<
 
 pub(crate) fn encode_extensions<
     'p,
-    F: Fn(pyo3::Python<'_>, &asn1::ObjectIdentifier, &pyo3::PyAny) -> PyAsn1Result<Option<Vec<u8>>>,
+    F: Fn(
+        pyo3::Python<'_>,
+        &asn1::ObjectIdentifier,
+        &pyo3::PyAny,
+    ) -> CryptographyResult<Option<Vec<u8>>>,
 >(
     py: pyo3::Python<'p>,
     py_exts: &'p pyo3::PyAny,
diff --git a/src/rust/src/x509/crl.rs b/src/rust/src/x509/crl.rs
index 5f4ff09e7..75ac22541 100644
--- a/src/rust/src/x509/crl.rs
+++ b/src/rust/src/x509/crl.rs
@@ -4,7 +4,7 @@
 
 use crate::asn1::{
     big_byte_slice_to_py_int, encode_der_data, oid_to_py_oid, py_uint_to_big_endian_bytes,
-    PyAsn1Error, PyAsn1Result,
+    CryptographyError, CryptographyResult,
 };
 use crate::x509;
 use crate::x509::{certificate, extensions, oid, sign};
@@ -16,7 +16,7 @@ use std::sync::Arc;
 fn load_der_x509_crl(
     py: pyo3::Python<'_>,
     data: &[u8],
-) -> Result<CertificateRevocationList, PyAsn1Error> {
+) -> Result<CertificateRevocationList, CryptographyError> {
     let raw = OwnedRawCertificateRevocationList::try_new(
         Arc::from(data),
         |data| asn1::parse_single(data),
@@ -26,7 +26,7 @@ fn load_der_x509_crl(
     let version = raw.borrow_value().tbs_cert_list.version.unwrap_or(1);
     if version != 1 {
         let x509_module = py.import("cryptography.x509")?;
-        return Err(PyAsn1Error::from(pyo3::PyErr::from_instance(
+        return Err(CryptographyError::from(pyo3::PyErr::from_instance(
             x509_module
                 .getattr(crate::intern!(py, "InvalidVersion"))?
                 .call1((format!("{} is not a valid CRL version", version), version))?,
@@ -43,7 +43,7 @@ fn load_der_x509_crl(
 fn load_pem_x509_crl(
     py: pyo3::Python<'_>,
     data: &[u8],
-) -> Result<CertificateRevocationList, PyAsn1Error> {
+) -> Result<CertificateRevocationList, CryptographyError> {
     let block = x509::find_in_pem(
         data,
         |p| p.tag == "X509 CRL",
@@ -72,7 +72,7 @@ struct CertificateRevocationList {
 }
 
 impl CertificateRevocationList {
-    fn public_bytes_der(&self) -> PyAsn1Result<Vec<u8>> {
+    fn public_bytes_der(&self) -> CryptographyResult<Vec<u8>> {
         Ok(asn1::write_single(self.raw.borrow_value())?)
     }
 
@@ -208,7 +208,7 @@ impl CertificateRevocationList {
     fn tbs_certlist_bytes<'p>(
         &self,
         py: pyo3::Python<'p>,
-    ) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+    ) -> CryptographyResult<&'p pyo3::types::PyBytes> {
         let b = asn1::write_single(&self.raw.borrow_value().tbs_cert_list)?;
         Ok(pyo3::types::PyBytes::new(py, &b))
     }
@@ -217,7 +217,7 @@ impl CertificateRevocationList {
         &self,
         py: pyo3::Python<'p>,
         encoding: &'p pyo3::PyAny,
-    ) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+    ) -> CryptographyResult<&'p pyo3::types::PyBytes> {
         let result = asn1::write_single(self.raw.borrow_value())?;
 
         encode_der_data(py, "X509 CRL".to_string(), result, encoding)
@@ -373,7 +373,7 @@ impl CertificateRevocationList {
         slf: pyo3::PyRef<'_, Self>,
         py: pyo3::Python<'p>,
         public_key: &'p pyo3::PyAny,
-    ) -> PyAsn1Result<bool> {
+    ) -> CryptographyResult<bool> {
         if slf.raw.borrow_value().tbs_cert_list.signature
             != slf.raw.borrow_value().signature_algorithm
         {
@@ -588,7 +588,7 @@ pub(crate) type CRLReason = asn1::Enumerated;
 pub(crate) fn parse_crl_reason_flags<'p>(
     py: pyo3::Python<'p>,
     reason: &CRLReason,
-) -> PyAsn1Result<&'p pyo3::PyAny> {
+) -> CryptographyResult<&'p pyo3::PyAny> {
     let x509_module = py.import("cryptography.x509")?;
     let flag_name = match reason.value() {
         0 => "unspecified",
@@ -602,9 +602,12 @@ pub(crate) fn parse_crl_reason_flags<'p>(
         9 => "privilege_withdrawn",
         10 => "aa_compromise",
         value => {
-            return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                format!("Unsupported reason code: {}", value),
-            )))
+            return Err(CryptographyError::from(
+                pyo3::exceptions::PyValueError::new_err(format!(
+                    "Unsupported reason code: {}",
+                    value
+                )),
+            ))
         }
     };
     Ok(x509_module
@@ -616,7 +619,7 @@ pub fn parse_crl_entry_ext<'p>(
     py: pyo3::Python<'p>,
     oid: asn1::ObjectIdentifier,
     data: &[u8],
-) -> PyAsn1Result<Option<&'p pyo3::PyAny>> {
+) -> CryptographyResult<Option<&'p pyo3::PyAny>> {
     let x509_module = py.import("cryptography.x509")?;
     match oid {
         oid::CRL_REASON_OID => {
@@ -655,7 +658,7 @@ fn create_x509_crl(
     builder: &pyo3::PyAny,
     private_key: &pyo3::PyAny,
     hash_algorithm: &pyo3::PyAny,
-) -> PyAsn1Result<CertificateRevocationList> {
+) -> CryptographyResult<CertificateRevocationList> {
     let sigalg = x509::sign::compute_signature_algorithm(py, private_key, hash_algorithm)?;
 
     let mut revoked_certs = vec![];
diff --git a/src/rust/src/x509/csr.rs b/src/rust/src/x509/csr.rs
index cb9056c80..66ce3413b 100644
--- a/src/rust/src/x509/csr.rs
+++ b/src/rust/src/x509/csr.rs
@@ -2,7 +2,9 @@
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
 
-use crate::asn1::{encode_der_data, oid_to_py_oid, py_oid_to_oid, PyAsn1Error, PyAsn1Result};
+use crate::asn1::{
+    encode_der_data, oid_to_py_oid, py_oid_to_oid, CryptographyError, CryptographyResult,
+};
 use crate::x509;
 use crate::x509::{certificate, oid, sign};
 use asn1::SimpleAsn1Readable;
@@ -41,18 +43,20 @@ pub(crate) struct Attribute<'a> {
     >,
 }
 
-fn check_attribute_length<'a>(values: asn1::SetOf<'a, asn1::Tlv<'a>>) -> Result<(), PyAsn1Error> {
+fn check_attribute_length<'a>(
+    values: asn1::SetOf<'a, asn1::Tlv<'a>>,
+) -> Result<(), CryptographyError> {
     if values.count() > 1 {
-        Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-            "Only single-valued attributes are supported",
-        )))
+        Err(CryptographyError::from(
+            pyo3::exceptions::PyValueError::new_err("Only single-valued attributes are supported"),
+        ))
     } else {
         Ok(())
     }
 }
 
 impl CertificationRequestInfo<'_> {
-    fn get_extension_attribute(&self) -> Result<Option<x509::Extensions<'_>>, PyAsn1Error> {
+    fn get_extension_attribute(&self) -> Result<Option<x509::Extensions<'_>>, CryptographyError> {
         for attribute in self.attributes.unwrap_read().clone() {
             if attribute.type_id == oid::EXTENSION_REQUEST
                 || attribute.type_id == oid::MS_EXTENSION_REQUEST
@@ -106,7 +110,7 @@ impl pyo3::basic::PyObjectProtocol for CertificateSigningRequest {
 
 #[pyo3::prelude::pymethods]
 impl CertificateSigningRequest {
-    fn public_key<'p>(&self, py: pyo3::Python<'p>) -> PyAsn1Result<&'p pyo3::PyAny> {
+    fn public_key<'p>(&self, py: pyo3::Python<'p>) -> CryptographyResult<&'p pyo3::PyAny> {
         // This makes an unnecessary copy. It'd be nice to get rid of it.
         let serialized = pyo3::types::PyBytes::new(
             py,
@@ -130,7 +134,7 @@ impl CertificateSigningRequest {
     fn tbs_certrequest_bytes<'p>(
         &self,
         py: pyo3::Python<'p>,
-    ) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+    ) -> CryptographyResult<&'p pyo3::types::PyBytes> {
         let result = asn1::write_single(&self.raw.borrow_value().csr_info)?;
         Ok(pyo3::types::PyBytes::new(py, &result))
     }
@@ -144,14 +148,14 @@ impl CertificateSigningRequest {
     fn signature_hash_algorithm<'p>(
         &self,
         py: pyo3::Python<'p>,
-    ) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    ) -> Result<&'p pyo3::PyAny, CryptographyError> {
         let sig_oids_to_hash = py
             .import("cryptography.hazmat._oid")?
             .getattr(crate::intern!(py, "_SIG_OIDS_TO_HASH"))?;
         let hash_alg = sig_oids_to_hash.get_item(self.signature_algorithm_oid(py)?);
         match hash_alg {
             Ok(data) => Ok(data),
-            Err(_) => Err(PyAsn1Error::from(pyo3::PyErr::from_instance(
+            Err(_) => Err(CryptographyError::from(pyo3::PyErr::from_instance(
                 py.import("cryptography.exceptions")?.call_method1(
                     "UnsupportedAlgorithm",
                     (format!(
@@ -172,7 +176,7 @@ impl CertificateSigningRequest {
         &self,
         py: pyo3::Python<'p>,
         encoding: &'p pyo3::PyAny,
-    ) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+    ) -> CryptographyResult<&'p pyo3::types::PyBytes> {
         let result = asn1::write_single(self.raw.borrow_value())?;
 
         encode_der_data(py, "CERTIFICATE REQUEST".to_string(), result, encoding)
@@ -243,7 +247,7 @@ impl CertificateSigningRequest {
             let val = attribute.values.unwrap_read().clone().next().unwrap();
             let serialized = pyo3::types::PyBytes::new(py, val.data());
             let tag = val.tag().as_u8().ok_or_else(|| {
-                PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
+                CryptographyError::from(pyo3::exceptions::PyValueError::new_err(
                     "Long-form tags are not supported in CSR attribute values",
                 ))
             })?;
@@ -266,7 +270,10 @@ impl CertificateSigningRequest {
     }
 
     #[getter]
-    fn is_signature_valid(slf: pyo3::PyRef<'_, Self>, py: pyo3::Python<'_>) -> PyAsn1Result<bool> {
+    fn is_signature_valid(
+        slf: pyo3::PyRef<'_, Self>,
+        py: pyo3::Python<'_>,
+    ) -> CryptographyResult<bool> {
         Ok(sign::verify_signature_with_oid(
             py,
             slf.public_key(py)?,
@@ -279,7 +286,10 @@ impl CertificateSigningRequest {
 }
 
 #[pyo3::prelude::pyfunction]
-fn load_pem_x509_csr(py: pyo3::Python<'_>, data: &[u8]) -> PyAsn1Result<CertificateSigningRequest> {
+fn load_pem_x509_csr(
+    py: pyo3::Python<'_>,
+    data: &[u8],
+) -> CryptographyResult<CertificateSigningRequest> {
     // We support both PEM header strings that OpenSSL does
     // https://github.com/openssl/openssl/blob/5e2d22d53ed322a7124e26a4fbd116a8210eb77a/include/openssl/pem.h#L35-L36
     let parsed = x509::find_in_pem(
@@ -291,13 +301,16 @@ fn load_pem_x509_csr(py: pyo3::Python<'_>, data: &[u8]) -> PyAsn1Result<Certific
 }
 
 #[pyo3::prelude::pyfunction]
-fn load_der_x509_csr(py: pyo3::Python<'_>, data: &[u8]) -> PyAsn1Result<CertificateSigningRequest> {
+fn load_der_x509_csr(
+    py: pyo3::Python<'_>,
+    data: &[u8],
+) -> CryptographyResult<CertificateSigningRequest> {
     let raw = OwnedRawCsr::try_new(data.to_vec(), |data| asn1::parse_single(data))?;
 
     let version = raw.borrow_value().csr_info.version;
     if version != 0 {
         let x509_module = py.import("cryptography.x509")?;
-        return Err(PyAsn1Error::from(pyo3::PyErr::from_instance(
+        return Err(CryptographyError::from(pyo3::PyErr::from_instance(
             x509_module
                 .getattr(crate::intern!(py, "InvalidVersion"))?
                 .call1((format!("{} is not a valid CSR version", version), version))?,
@@ -316,7 +329,7 @@ fn create_x509_csr(
     builder: &pyo3::PyAny,
     private_key: &pyo3::PyAny,
     hash_algorithm: &pyo3::PyAny,
-) -> PyAsn1Result<CertificateSigningRequest> {
+) -> CryptographyResult<CertificateSigningRequest> {
     let sigalg = x509::sign::compute_signature_algorithm(py, private_key, hash_algorithm)?;
     let serialization_mod = py.import("cryptography.hazmat.primitives.serialization")?;
     let der_encoding = serialization_mod
@@ -354,9 +367,11 @@ fn create_x509_csr(
             asn1::Tag::from_bytes(&[tag])?.0
         } else {
             if std::str::from_utf8(value).is_err() {
-                return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                    "Attribute values must be valid utf-8.",
-                )));
+                return Err(CryptographyError::from(
+                    pyo3::exceptions::PyValueError::new_err(
+                        "Attribute values must be valid utf-8.",
+                    ),
+                ));
             }
             asn1::Utf8String::TAG
         };
diff --git a/src/rust/src/x509/extensions.rs b/src/rust/src/x509/extensions.rs
index 537106a36..f8dd28a45 100644
--- a/src/rust/src/x509/extensions.rs
+++ b/src/rust/src/x509/extensions.rs
@@ -2,14 +2,16 @@
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
 
-use crate::asn1::{py_oid_to_oid, py_uint_to_big_endian_bytes, PyAsn1Error, PyAsn1Result};
+use crate::asn1::{
+    py_oid_to_oid, py_uint_to_big_endian_bytes, CryptographyError, CryptographyResult,
+};
 use crate::x509;
 use crate::x509::{certificate, crl, oid, sct};
 
 fn encode_general_subtrees<'a>(
     py: pyo3::Python<'a>,
     subtrees: &'a pyo3::PyAny,
-) -> Result<Option<certificate::SequenceOfSubtrees<'a>>, PyAsn1Error> {
+) -> Result<Option<certificate::SequenceOfSubtrees<'a>>, CryptographyError> {
     if subtrees.is_none() {
         Ok(None)
     } else {
@@ -120,7 +122,7 @@ pub(crate) fn encode_extension(
     py: pyo3::Python<'_>,
     oid: &asn1::ObjectIdentifier,
     ext: &pyo3::PyAny,
-) -> PyAsn1Result<Option<Vec<u8>>> {
+) -> CryptographyResult<Option<Vec<u8>>> {
     match oid {
         &oid::BASIC_CONSTRAINTS_OID => {
             let bc = ext.extract::<certificate::BasicConstraints>()?;
diff --git a/src/rust/src/x509/ocsp.rs b/src/rust/src/x509/ocsp.rs
index de5ace7d0..d06487021 100644
--- a/src/rust/src/x509/ocsp.rs
+++ b/src/rust/src/x509/ocsp.rs
@@ -2,7 +2,7 @@
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
 
-use crate::asn1::PyAsn1Result;
+use crate::asn1::CryptographyResult;
 use crate::x509;
 use crate::x509::oid;
 use once_cell::sync::Lazy;
@@ -42,7 +42,7 @@ impl CertID<'_> {
         cert: &'p x509::Certificate,
         issuer: &'p x509::Certificate,
         hash_algorithm: &'p pyo3::PyAny,
-    ) -> PyAsn1Result<CertID<'p>> {
+    ) -> CryptographyResult<CertID<'p>> {
         let issuer_der = asn1::write_single(&cert.raw.borrow_value_public().tbs_cert.issuer)?;
         let issuer_name_hash = hash_data(py, hash_algorithm, &issuer_der)?;
         let issuer_key_hash = hash_data(
@@ -77,7 +77,7 @@ impl CertID<'_> {
         issuer_key_hash: &'p [u8],
         serial_number: asn1::BigInt<'p>,
         hash_algorithm: &'p pyo3::PyAny,
-    ) -> PyAsn1Result<CertID<'p>> {
+    ) -> CryptographyResult<CertID<'p>> {
         Ok(CertID {
             hash_algorithm: x509::AlgorithmIdentifier {
                 oid: HASH_NAME_TO_OIDS[hash_algorithm
diff --git a/src/rust/src/x509/ocsp_req.rs b/src/rust/src/x509/ocsp_req.rs
index 0f7e8f869..078df6050 100644
--- a/src/rust/src/x509/ocsp_req.rs
+++ b/src/rust/src/x509/ocsp_req.rs
@@ -3,7 +3,7 @@
 // for complete details.
 
 use crate::asn1::{
-    big_byte_slice_to_py_int, py_uint_to_big_endian_bytes, PyAsn1Error, PyAsn1Result,
+    big_byte_slice_to_py_int, py_uint_to_big_endian_bytes, CryptographyError, CryptographyResult,
 };
 use crate::x509;
 use crate::x509::{extensions, ocsp, oid};
@@ -18,7 +18,7 @@ struct OwnedRawOCSPRequest {
 }
 
 #[pyo3::prelude::pyfunction]
-fn load_der_ocsp_request(_py: pyo3::Python<'_>, data: &[u8]) -> PyAsn1Result<OCSPRequest> {
+fn load_der_ocsp_request(_py: pyo3::Python<'_>, data: &[u8]) -> CryptographyResult<OCSPRequest> {
     let raw = OwnedRawOCSPRequest::try_new(Arc::from(data), |data| asn1::parse_single(data))?;
 
     if raw
@@ -29,7 +29,7 @@ fn load_der_ocsp_request(_py: pyo3::Python<'_>, data: &[u8]) -> PyAsn1Result<OCS
         .len()
         != 1
     {
-        return Err(PyAsn1Error::from(
+        return Err(CryptographyError::from(
             pyo3::exceptions::PyNotImplementedError::new_err(
                 "OCSP request contains more than one request",
             ),
@@ -76,7 +76,10 @@ impl OCSPRequest {
     }
 
     #[getter]
-    fn hash_algorithm<'p>(&self, py: pyo3::Python<'p>) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    fn hash_algorithm<'p>(
+        &self,
+        py: pyo3::Python<'p>,
+    ) -> Result<&'p pyo3::PyAny, CryptographyError> {
         let cert_id = self.cert_id();
 
         let hashes = py.import("cryptography.hazmat.primitives.hashes")?;
@@ -84,7 +87,7 @@ impl OCSPRequest {
             Some(alg_name) => Ok(hashes.getattr(alg_name)?.call0()?),
             None => {
                 let exceptions = py.import("cryptography.exceptions")?;
-                Err(PyAsn1Error::from(pyo3::PyErr::from_instance(
+                Err(CryptographyError::from(pyo3::PyErr::from_instance(
                     exceptions
                         .getattr(crate::intern!(py, "UnsupportedAlgorithm"))?
                         .call1((format!(
@@ -97,7 +100,10 @@ impl OCSPRequest {
     }
 
     #[getter]
-    fn serial_number<'p>(&self, py: pyo3::Python<'p>) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    fn serial_number<'p>(
+        &self,
+        py: pyo3::Python<'p>,
+    ) -> Result<&'p pyo3::PyAny, CryptographyError> {
         let bytes = self.cert_id().serial_number.as_bytes();
         Ok(big_byte_slice_to_py_int(py, bytes)?)
     }
@@ -131,7 +137,7 @@ impl OCSPRequest {
         &self,
         py: pyo3::Python<'p>,
         encoding: &pyo3::PyAny,
-    ) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+    ) -> CryptographyResult<&'p pyo3::types::PyBytes> {
         let der = py
             .import("cryptography.hazmat.primitives.serialization")?
             .getattr(crate::intern!(py, "Encoding"))?
@@ -181,7 +187,10 @@ struct Request<'a> {
 }
 
 #[pyo3::prelude::pyfunction]
-fn create_ocsp_request(py: pyo3::Python<'_>, builder: &pyo3::PyAny) -> PyAsn1Result<OCSPRequest> {
+fn create_ocsp_request(
+    py: pyo3::Python<'_>,
+    builder: &pyo3::PyAny,
+) -> CryptographyResult<OCSPRequest> {
     let builder_request = builder.getattr(crate::intern!(py, "_request"))?;
 
     // Declare outside the if-block so the lifetimes are right.
diff --git a/src/rust/src/x509/ocsp_resp.rs b/src/rust/src/x509/ocsp_resp.rs
index 90ced614c..35e1d672b 100644
--- a/src/rust/src/x509/ocsp_resp.rs
+++ b/src/rust/src/x509/ocsp_resp.rs
@@ -2,7 +2,7 @@
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
 
-use crate::asn1::{big_byte_slice_to_py_int, oid_to_py_oid, PyAsn1Error, PyAsn1Result};
+use crate::asn1::{big_byte_slice_to_py_int, oid_to_py_oid, CryptographyError, CryptographyResult};
 use crate::x509;
 use crate::x509::{certificate, crl, extensions, ocsp, oid, py_to_chrono, sct};
 use chrono::Timelike;
@@ -11,7 +11,10 @@ use std::sync::Arc;
 const BASIC_RESPONSE_OID: asn1::ObjectIdentifier = asn1::oid!(1, 3, 6, 1, 5, 5, 7, 48, 1, 1);
 
 #[pyo3::prelude::pyfunction]
-fn load_der_ocsp_response(_py: pyo3::Python<'_>, data: &[u8]) -> Result<OCSPResponse, PyAsn1Error> {
+fn load_der_ocsp_response(
+    _py: pyo3::Python<'_>,
+    data: &[u8],
+) -> Result<OCSPResponse, CryptographyError> {
     let raw = OwnedRawOCSPResponse::try_new(Arc::from(data), |data| asn1::parse_single(data))?;
 
     let response = raw.borrow_value();
@@ -19,15 +22,19 @@ fn load_der_ocsp_response(_py: pyo3::Python<'_>, data: &[u8]) -> Result<OCSPResp
         SUCCESSFUL_RESPONSE => match response.response_bytes {
             Some(ref bytes) => {
                 if bytes.response_type != BASIC_RESPONSE_OID {
-                    return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                        "Successful OCSP response does not contain a BasicResponse",
-                    )));
+                    return Err(CryptographyError::from(
+                        pyo3::exceptions::PyValueError::new_err(
+                            "Successful OCSP response does not contain a BasicResponse",
+                        ),
+                    ));
                 }
             }
             None => {
-                return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                    "Successful OCSP response does not contain a BasicResponse",
-                )))
+                return Err(CryptographyError::from(
+                    pyo3::exceptions::PyValueError::new_err(
+                        "Successful OCSP response does not contain a BasicResponse",
+                    ),
+                ))
             }
         },
         MALFORMED_REQUEST_RESPOSNE
@@ -36,9 +43,9 @@ fn load_der_ocsp_response(_py: pyo3::Python<'_>, data: &[u8]) -> Result<OCSPResp
         | SIG_REQUIRED_RESPONSE
         | UNAUTHORIZED_RESPONSE => {}
         _ => {
-            return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                "OCSP response has an unknown status code",
-            )))
+            return Err(CryptographyError::from(
+                pyo3::exceptions::PyValueError::new_err("OCSP response has an unknown status code"),
+            ))
         }
     };
     Ok(OCSPResponse {
@@ -86,7 +93,7 @@ const UNAUTHORIZED_RESPONSE: u32 = 6;
 #[pyo3::prelude::pymethods]
 impl OCSPResponse {
     #[getter]
-    fn responses(&self) -> Result<OCSPResponseIterator, PyAsn1Error> {
+    fn responses(&self) -> Result<OCSPResponseIterator, CryptographyError> {
         self.requires_successful_response()?;
         Ok(OCSPResponseIterator {
             contents: OwnedOCSPResponseIteratorData::try_new(Arc::clone(&self.raw), |v| {
@@ -163,7 +170,7 @@ impl OCSPResponse {
     fn signature_hash_algorithm<'p>(
         &self,
         py: pyo3::Python<'p>,
-    ) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    ) -> Result<&'p pyo3::PyAny, CryptographyError> {
         let sig_oids_to_hash = py
             .import("cryptography.hazmat._oid")?
             .getattr(crate::intern!(py, "_SIG_OIDS_TO_HASH"))?;
@@ -175,7 +182,7 @@ impl OCSPResponse {
                     "Signature algorithm OID: {} not recognized",
                     self.requires_successful_response()?.signature_algorithm.oid
                 );
-                Err(PyAsn1Error::from(pyo3::PyErr::from_instance(
+                Err(CryptographyError::from(pyo3::PyErr::from_instance(
                     py.import("cryptography.exceptions")?
                         .call_method1("UnsupportedAlgorithm", (exc_messsage,))?,
                 )))
@@ -193,14 +200,14 @@ impl OCSPResponse {
     fn tbs_response_bytes<'p>(
         &self,
         py: pyo3::Python<'p>,
-    ) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+    ) -> CryptographyResult<&'p pyo3::types::PyBytes> {
         let resp = self.requires_successful_response()?;
         let result = asn1::write_single(&resp.tbs_response_data)?;
         Ok(pyo3::types::PyBytes::new(py, &result))
     }
 
     #[getter]
-    fn certificates<'p>(&self, py: pyo3::Python<'p>) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    fn certificates<'p>(&self, py: pyo3::Python<'p>) -> Result<&'p pyo3::PyAny, CryptographyError> {
         let resp = self.requires_successful_response()?;
         let py_certs = pyo3::types::PyList::empty(py);
         let certs = match &resp.certs {
@@ -242,21 +249,24 @@ impl OCSPResponse {
     }
 
     #[getter]
-    fn issuer_key_hash(&self) -> Result<&[u8], PyAsn1Error> {
+    fn issuer_key_hash(&self) -> Result<&[u8], CryptographyError> {
         let resp = self.requires_successful_response()?;
         let single_resp = resp.single_response()?;
         Ok(single_resp.cert_id.issuer_key_hash)
     }
 
     #[getter]
-    fn issuer_name_hash(&self) -> Result<&[u8], PyAsn1Error> {
+    fn issuer_name_hash(&self) -> Result<&[u8], CryptographyError> {
         let resp = self.requires_successful_response()?;
         let single_resp = resp.single_response()?;
         Ok(single_resp.cert_id.issuer_name_hash)
     }
 
     #[getter]
-    fn hash_algorithm<'p>(&self, py: pyo3::Python<'p>) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    fn hash_algorithm<'p>(
+        &self,
+        py: pyo3::Python<'p>,
+    ) -> Result<&'p pyo3::PyAny, CryptographyError> {
         let resp = self.requires_successful_response()?;
         let single_resp = resp.single_response()?;
         single_resp.py_hash_algorithm(py)
@@ -276,7 +286,7 @@ impl OCSPResponse {
     }
 
     #[getter]
-    fn revocation_reason<'p>(&self, py: pyo3::Python<'p>) -> PyAsn1Result<&'p pyo3::PyAny> {
+    fn revocation_reason<'p>(&self, py: pyo3::Python<'p>) -> CryptographyResult<&'p pyo3::PyAny> {
         let resp = self.requires_successful_response()?;
         let single_resp = resp.single_response()?;
         single_resp.py_revocation_reason(py)
@@ -367,7 +377,7 @@ impl OCSPResponse {
         &self,
         py: pyo3::Python<'p>,
         encoding: &pyo3::PyAny,
-    ) -> PyAsn1Result<&'p pyo3::types::PyBytes> {
+    ) -> CryptographyResult<&'p pyo3::types::PyBytes> {
         let der = py
             .import("cryptography.hazmat.primitives.serialization")?
             .getattr(crate::intern!(py, "Encoding"))?
@@ -443,12 +453,12 @@ struct BasicOCSPResponse<'a> {
 }
 
 impl BasicOCSPResponse<'_> {
-    fn single_response(&self) -> Result<SingleResponse<'_>, PyAsn1Error> {
+    fn single_response(&self) -> Result<SingleResponse<'_>, CryptographyError> {
         let responses = self.tbs_response_data.responses.unwrap_read();
         let num_responses = responses.len();
 
         if num_responses != 1 {
-            return Err(PyAsn1Error::from(
+            return Err(CryptographyError::from(
                 pyo3::exceptions::PyValueError::new_err(format!(
                     "OCSP response contains {} SINGLERESP structures.  Use .response_iter to iterate through them",
                     num_responses
@@ -511,13 +521,16 @@ impl SingleResponse<'_> {
             .getattr(attr)
     }
 
-    fn py_hash_algorithm<'p>(&self, py: pyo3::Python<'p>) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    fn py_hash_algorithm<'p>(
+        &self,
+        py: pyo3::Python<'p>,
+    ) -> Result<&'p pyo3::PyAny, CryptographyError> {
         let hashes = py.import("cryptography.hazmat.primitives.hashes")?;
         match ocsp::OIDS_TO_HASH.get(&self.cert_id.hash_algorithm.oid) {
             Some(alg_name) => Ok(hashes.getattr(alg_name)?.call0()?),
             None => {
                 let exceptions = py.import("cryptography.exceptions")?;
-                Err(PyAsn1Error::from(pyo3::PyErr::from_instance(
+                Err(CryptographyError::from(pyo3::PyErr::from_instance(
                     exceptions
                         .getattr(crate::intern!(py, "UnsupportedAlgorithm"))?
                         .call1((format!(
@@ -540,7 +553,10 @@ impl SingleResponse<'_> {
         }
     }
 
-    fn py_revocation_reason<'p>(&self, py: pyo3::Python<'p>) -> PyAsn1Result<&'p pyo3::PyAny> {
+    fn py_revocation_reason<'p>(
+        &self,
+        py: pyo3::Python<'p>,
+    ) -> CryptographyResult<&'p pyo3::PyAny> {
         match &self.cert_status {
             CertStatus::Revoked(revoked_info) => match revoked_info.revocation_reason {
                 Some(ref v) => crl::parse_crl_reason_flags(py, v),
@@ -584,7 +600,7 @@ fn create_ocsp_response(
     builder: &pyo3::PyAny,
     private_key: &pyo3::PyAny,
     hash_algorithm: &pyo3::PyAny,
-) -> PyAsn1Result<OCSPResponse> {
+) -> CryptographyResult<OCSPResponse> {
     let response_status = status
         .getattr(crate::intern!(py, "value"))?
         .extract::<u32>()?;
@@ -842,7 +858,10 @@ impl OCSPSingleResponse {
     }
 
     #[getter]
-    fn hash_algorithm<'p>(&self, py: pyo3::Python<'p>) -> Result<&'p pyo3::PyAny, PyAsn1Error> {
+    fn hash_algorithm<'p>(
+        &self,
+        py: pyo3::Python<'p>,
+    ) -> Result<&'p pyo3::PyAny, CryptographyError> {
         self.single_response().py_hash_algorithm(py)
     }
 
@@ -857,7 +876,7 @@ impl OCSPSingleResponse {
     }
 
     #[getter]
-    fn revocation_reason<'p>(&self, py: pyo3::Python<'p>) -> PyAsn1Result<&'p pyo3::PyAny> {
+    fn revocation_reason<'p>(&self, py: pyo3::Python<'p>) -> CryptographyResult<&'p pyo3::PyAny> {
         self.single_response().py_revocation_reason(py)
     }
 
diff --git a/src/rust/src/x509/sct.rs b/src/rust/src/x509/sct.rs
index aaa374b93..363a8187d 100644
--- a/src/rust/src/x509/sct.rs
+++ b/src/rust/src/x509/sct.rs
@@ -2,7 +2,7 @@
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
 
-use crate::asn1::PyAsn1Error;
+use crate::asn1::CryptographyError;
 use pyo3::types::IntoPyDict;
 use pyo3::ToPyObject;
 use std::collections::hash_map::DefaultHasher;
@@ -22,22 +22,22 @@ impl<'a> TLSReader<'a> {
         self.data.is_empty()
     }
 
-    fn read_byte(&mut self) -> Result<u8, PyAsn1Error> {
+    fn read_byte(&mut self) -> Result<u8, CryptographyError> {
         Ok(self.read_exact(1)?[0])
     }
 
-    fn read_exact(&mut self, length: usize) -> Result<&'a [u8], PyAsn1Error> {
+    fn read_exact(&mut self, length: usize) -> Result<&'a [u8], CryptographyError> {
         if length > self.data.len() {
-            return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                "Invalid SCT length",
-            )));
+            return Err(CryptographyError::from(
+                pyo3::exceptions::PyValueError::new_err("Invalid SCT length"),
+            ));
         }
         let (result, data) = self.data.split_at(length);
         self.data = data;
         Ok(result)
     }
 
-    fn read_length_prefixed(&mut self) -> Result<TLSReader<'a>, PyAsn1Error> {
+    fn read_length_prefixed(&mut self) -> Result<TLSReader<'a>, CryptographyError> {
         let length = u16::from_be_bytes(self.read_exact(2)?.try_into().unwrap());
         Ok(TLSReader::new(self.read_exact(length.into())?))
     }
@@ -236,7 +236,7 @@ pub(crate) fn parse_scts(
     py: pyo3::Python<'_>,
     data: &[u8],
     entry_type: LogEntryType,
-) -> Result<pyo3::PyObject, PyAsn1Error> {
+) -> Result<pyo3::PyObject, CryptographyError> {
     let mut reader = TLSReader::new(data).read_length_prefixed()?;
 
     let py_scts = pyo3::types::PyList::empty(py);
@@ -245,9 +245,9 @@ pub(crate) fn parse_scts(
         let raw_sct_data = sct_data.data.to_vec();
         let version = sct_data.read_byte()?;
         if version != 0 {
-            return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-                "Invalid SCT version",
-            )));
+            return Err(CryptographyError::from(
+                pyo3::exceptions::PyValueError::new_err("Invalid SCT version"),
+            ));
         }
         let log_id = sct_data.read_exact(32)?.try_into().unwrap();
         let timestamp = u64::from_be_bytes(sct_data.read_exact(8)?.try_into().unwrap());
diff --git a/src/rust/src/x509/sign.rs b/src/rust/src/x509/sign.rs
index 3a1e0e9a3..4c1e9664f 100644
--- a/src/rust/src/x509/sign.rs
+++ b/src/rust/src/x509/sign.rs
@@ -2,7 +2,7 @@
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
 
-use crate::asn1::{PyAsn1Error, PyAsn1Result};
+use crate::asn1::{CryptographyError, CryptographyResult};
 use crate::x509;
 use crate::x509::oid;
 
@@ -287,13 +287,15 @@ pub(crate) fn verify_signature_with_oid<'p>(
     signature_oid: &asn1::ObjectIdentifier,
     signature: &[u8],
     data: &[u8],
-) -> PyAsn1Result<()> {
+) -> CryptographyResult<()> {
     let key_type = identify_public_key_type(py, issuer_public_key)?;
     let (sig_key_type, sig_hash_type) = identify_key_hash_type_for_oid(signature_oid)?;
     if key_type != sig_key_type {
-        return Err(PyAsn1Error::from(pyo3::exceptions::PyValueError::new_err(
-            "Signature algorithm does not match issuer key type",
-        )));
+        return Err(CryptographyError::from(
+            pyo3::exceptions::PyValueError::new_err(
+                "Signature algorithm does not match issuer key type",
+            ),
+        ));
     }
     let sig_hash_name = py_hash_name_from_hash_type(sig_hash_type);
     let hashes = py.import("cryptography.hazmat.primitives.hashes")?;