def extract_ids(cert):
    """
    Extract all valid IDs from a certificate for service verification.

    If *cert* doesn't contain any identifiers, the ``CN``s are used as DNS-IDs
    as fallback.

    :param cryptography.x509.Certificate cert: The certificate to be dissected.

    :return: List of IDs.
    """
    ids = []
    try:
        ext = cert.extensions.get_extension_for_oid(
            ExtensionOID.SUBJECT_ALTERNATIVE_NAME
        )
    except ExtensionNotFound:
        pass
    else:
        ids.extend(
            [
                DNSPattern(name.encode("utf-8"))
                for name in ext.value.get_values_for_type(DNSName)
            ]
        )
        ids.extend(
            [
                URIPattern(uri.encode("utf-8"))
                for uri in ext.value.get_values_for_type(
                    UniformResourceIdentifier
                )
            ]
        )
        ids.extend(
            [
                IPAddressPattern(ip)
                for ip in ext.value.get_values_for_type(IPAddress)
            ]
        )
        for other in ext.value.get_values_for_type(OtherName):
            if other.type_id == ID_ON_DNS_SRV:
                srv, _ = decode(other.value)
                if isinstance(srv, IA5String):
                    ids.append(SRVPattern(srv.asOctets()))
                else:  # pragma: nocover
                    raise CertificateError("Unexpected certificate content.")

    if not ids:
        # https://tools.ietf.org/search/rfc6125#section-6.4.4
        # A client MUST NOT seek a match for a reference identifier of CN-ID if
        # the presented identifiers include a DNS-ID, SRV-ID, URI-ID, or any
        # application-specific identifier types supported by the client.
        cns = [
            n.value
            for n in cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)
        ]
        cn = next(iter(cns), b"<not given>")
        ids = [DNSPattern(n.encode("utf-8")) for n in cns]
        warnings.warn(
            "Certificate with CN {!r} has no `subjectAltName`, falling back "
            "to check for a `commonName` for now.  This feature is being "
            "removed by major browsers and deprecated by RFC 2818.".format(cn),
            SubjectAltNameWarning,
        )
    return ids

    Extract all valid IDs from a certificate for service verification.

    If *cert* doesn't contain any identifiers, the ``CN``s are used as DNS-IDs
    as fallback.

    :param cryptography.x509.Certificate cert: The certificate to be dissected.

    :return: List of IDs.
    
stackoverflow/venv/lib/python3.6/site-packages/service_identity/cryptography.py