o
    Dfِ                  	   @  sp  d dl mZ d dlZd dlZd dlZd dlZd dlZd dlmZ d dl	m
Z d dlmZmZ d dlmZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZm Z  d d	l!m"Z"m#Z# d d
l$m%Z% edddZ&ej'ej(ej)ej*ej+ej,ej-ej.ej/f Z0G dd de1Z2d?ddZ3d@ddZ4dAdd Z5G d!d" d"Z6G d#d$ d$Z7G d%d& d&ej8Z9G d'd( d(e1Z:G d)d* d*ej;d+Z<e<=ej< G d,d- d-ej;d+Z>e>=ej> G d.d/ d/e>Z?G d0d1 d1ej;d+Z@e@=ej@ G d2d3 d3ej;d+ZAeA=ejA ejBZBejCZCejDZDejEZEejFZFejGZGejHZHG d4d5 d5ZIG d6d7 d7ZJG d8d9 d9ZKG d:d; d;ZLdBd=d>ZMdS )C    )annotationsN)utils)x509)hashesserialization)dsaeced448ed25519paddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificateIssuerPublicKeyTypesCertificatePublicKeyTypes)	Extension
ExtensionsExtensionType_make_sequence_methods)Name	_ASN1Type)ObjectIdentifieri     c                         e Zd Zd	 fddZ  ZS )
AttributeNotFoundmsgstroidr   returnNonec                      t  | || _d S N)super__init__r   )selfr   r   	__class__ O/home/ubuntu/webapp/venv/lib/python3.10/site-packages/cryptography/x509/base.pyr$   9      
zAttributeNotFound.__init__)r   r   r   r   r   r    __name__
__module____qualname__r$   __classcell__r(   r(   r&   r)   r   8       r   	extensionExtension[ExtensionType]
extensionslist[Extension[ExtensionType]]r   r    c                 C  s"   |D ]}|j | j krtdqd S )Nz$This extension has already been set.)r   
ValueError)r1   r3   er(   r(   r)   _reject_duplicate_extension>   s
   r7   r   r   
attributes0list[tuple[ObjectIdentifier, bytes, int | None]]c                 C  s$   |D ]\}}}|| krt dqd S )Nz$This attribute has already been set.)r5   )r   r8   attr_oid_r(   r(   r)   _reject_duplicate_attributeH   s
   r<   timedatetime.datetimec                 C  s6   | j dur|  }|r|nt }| jdd| S | S )zNormalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    Ntzinfo)r@   	utcoffsetdatetime	timedeltareplace)r=   offsetr(   r(   r)   _convert_to_naive_utc_timeR   s
   
rF   c                   @  sX   e Zd Zejjfdd	d
ZedddZedddZdddZ	dddZ
dddZdS ) 	Attributer   r   valuebytes_typeintr   r    c                 C     || _ || _|| _d S r"   )_oid_valuerJ   )r%   r   rH   rJ   r(   r(   r)   r$   a      
zAttribute.__init__c                 C     | j S r"   )rM   r%   r(   r(   r)   r   k      zAttribute.oidc                 C  rP   r"   )rN   rQ   r(   r(   r)   rH   o   rR   zAttribute.valuer   c                 C  s   d| j  d| jdS )Nz<Attribute(oid=z, value=)>)r   rH   rQ   r(   r(   r)   __repr__s      zAttribute.__repr__otherobjectboolc                 C  s2   t |tstS | j|jko| j|jko| j|jkS r"   )
isinstancerG   NotImplementedr   rH   rJ   r%   rV   r(   r(   r)   __eq__v   s   


zAttribute.__eq__c                 C  s   t | j| j| jfS r"   )hashr   rH   rJ   rQ   r(   r(   r)   __hash__   s   zAttribute.__hash__N)r   r   rH   rI   rJ   rK   r   r    r   r   r   rI   r   r   rV   rW   r   rX   r   rK   )r,   r-   r.   r   
UTF8StringrH   r$   propertyr   rT   r\   r^   r(   r(   r(   r)   rG   `   s    



rG   c                   @  s8   e Zd ZdddZed\ZZZdd	d
ZdddZ	dS )
Attributesr8   typing.Iterable[Attribute]r   r    c                 C  s   t || _d S r"   )list_attributes)r%   r8   r(   r(   r)   r$      s   zAttributes.__init__ri   r   c                 C  s   d| j  dS )Nz<Attributes(rS   )ri   rQ   r(   r(   r)   rT      s   zAttributes.__repr__r   r   rG   c                 C  s.   | D ]}|j |kr|  S qtd| d|)NzNo z attribute was found)r   r   )r%   r   attrr(   r(   r)   get_attribute_for_oid   s
   
z Attributes.get_attribute_for_oidN)r8   rg   r   r    ra   )r   r   r   rG   )
r,   r-   r.   r$   r   __len____iter____getitem__rT   rk   r(   r(   r(   r)   rf      s
    

rf   c                   @  s   e Zd ZdZdZdS )Versionr      N)r,   r-   r.   v1v3r(   r(   r(   r)   ro      s    ro   c                      r   )
InvalidVersionr   r   parsed_versionrK   r   r    c                   r!   r"   )r#   r$   rt   )r%   r   rt   r&   r(   r)   r$      r*   zInvalidVersion.__init__)r   r   rt   rK   r   r    r+   r(   r(   r&   r)   rs      r0   rs   c                   @  s  e Zd ZejdBddZeejdCdd	ZeejdDddZejdEddZ	eejdFddZ
eejdGddZeejdGddZeejdGddZeejdGddZeejdHddZeejdHdd ZeejdId"d#ZeejdFd$d%ZeejdJd'd(ZeejdKd*d+ZeejdLd,d-ZeejdLd.d/ZeejdLd0d1ZejdMd5d6ZejdCd7d8ZejdNd;d<ZejdOd?d@ZdAS )PCertificate	algorithmhashes.HashAlgorithmr   rI   c                 C     dS z4
        Returns bytes using digest passed.
        Nr(   r%   rv   r(   r(   r)   fingerprint       zCertificate.fingerprintrK   c                 C  rx   )z3
        Returns certificate serial number
        Nr(   rQ   r(   r(   r)   serial_number   r|   zCertificate.serial_numberro   c                 C  rx   )z1
        Returns the certificate version
        Nr(   rQ   r(   r(   r)   version   r|   zCertificate.versionr   c                 C  rx   z(
        Returns the public key
        Nr(   rQ   r(   r(   r)   
public_key   r|   zCertificate.public_keyr   c                 C  rx   )zA
        Returns the ObjectIdentifier of the public key.
        Nr(   rQ   r(   r(   r)   public_key_algorithm_oid   r|   z$Certificate.public_key_algorithm_oidr>   c                 C  rx   )z?
        Not before time (represented as UTC datetime)
        Nr(   rQ   r(   r(   r)   not_valid_before   r|   zCertificate.not_valid_beforec                 C  rx   )zK
        Not before time (represented as a non-naive UTC datetime)
        Nr(   rQ   r(   r(   r)   not_valid_before_utc   r|   z Certificate.not_valid_before_utcc                 C  rx   )z>
        Not after time (represented as UTC datetime)
        Nr(   rQ   r(   r(   r)   not_valid_after   r|   zCertificate.not_valid_afterc                 C  rx   )zJ
        Not after time (represented as a non-naive UTC datetime)
        Nr(   rQ   r(   r(   r)   not_valid_after_utc   r|   zCertificate.not_valid_after_utcr   c                 C  rx   )z1
        Returns the issuer name object.
        Nr(   rQ   r(   r(   r)   issuer   r|   zCertificate.issuerc                 C  rx   z2
        Returns the subject name object.
        Nr(   rQ   r(   r(   r)   subject   r|   zCertificate.subjecthashes.HashAlgorithm | Nonec                 C  rx   zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nr(   rQ   r(   r(   r)   signature_hash_algorithm   r|   z$Certificate.signature_hash_algorithmc                 C  rx   zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nr(   rQ   r(   r(   r)   signature_algorithm_oid   r|   z#Certificate.signature_algorithm_oid0None | padding.PSS | padding.PKCS1v15 | ec.ECDSAc                 C  rx   z=
        Returns the signature algorithm parameters.
        Nr(   rQ   r(   r(   r)   signature_algorithm_parameters   r|   z*Certificate.signature_algorithm_parametersr   c                 C  rx   )z/
        Returns an Extensions object.
        Nr(   rQ   r(   r(   r)   r3   	  r|   zCertificate.extensionsc                 C  rx   z.
        Returns the signature bytes.
        Nr(   rQ   r(   r(   r)   	signature  r|   zCertificate.signaturec                 C  rx   )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nr(   rQ   r(   r(   r)   tbs_certificate_bytes  r|   z!Certificate.tbs_certificate_bytesc                 C  rx   )zh
        Returns the tbsCertificate payload bytes with the SCT list extension
        stripped.
        Nr(   rQ   r(   r(   r)   tbs_precertificate_bytes  r|   z$Certificate.tbs_precertificate_bytesrV   rW   rX   c                 C  rx   z"
        Checks equality.
        Nr(   r[   r(   r(   r)   r\   &  r|   zCertificate.__eq__c                 C  rx   z"
        Computes a hash.
        Nr(   rQ   r(   r(   r)   r^   ,  r|   zCertificate.__hash__encodingserialization.Encodingc                 C  rx   )zB
        Serializes the certificate to PEM or DER format.
        Nr(   r%   r   r(   r(   r)   public_bytes2  r|   zCertificate.public_bytesr   r    c                 C  rx   )z
        This method verifies that certificate issuer name matches the
        issuer subject name and that the certificate is signed by the
        issuer's private key. No other validation is performed.
        Nr(   )r%   r   r(   r(   r)   verify_directly_issued_by8  r|   z%Certificate.verify_directly_issued_byNrv   rw   r   rI   rc   )r   ro   r   r   r_   r   r>   r   r   r   r   r   r   r   r   r`   rb   r   r   r   rI   )r   ru   r   r    )r,   r-   r.   abcabstractmethodr{   re   r}   r~   r   r   r   r   r   r   r   r   r   r   r   r3   r   r   r   r\   r^   r   r   r(   r(   r(   r)   ru      sz    ru   )	metaclassc                   @  s\   e Zd ZeejdddZeejdddZeejddd	ZeejdddZ	dS )RevokedCertificater   rK   c                 C  rx   )zG
        Returns the serial number of the revoked certificate.
        Nr(   rQ   r(   r(   r)   r}   F  r|   z RevokedCertificate.serial_numberr>   c                 C  rx   )zH
        Returns the date of when this certificate was revoked.
        Nr(   rQ   r(   r(   r)   revocation_dateM  r|   z"RevokedCertificate.revocation_datec                 C  rx   )zl
        Returns the date of when this certificate was revoked as a non-naive
        UTC datetime.
        Nr(   rQ   r(   r(   r)   revocation_date_utcT  r|   z&RevokedCertificate.revocation_date_utcr   c                 C  rx   )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nr(   rQ   r(   r(   r)   r3   \  r|   zRevokedCertificate.extensionsNrc   r   r   )
r,   r-   r.   re   r   r   r}   r   r   r3   r(   r(   r(   r)   r   E  s    r   c                   @  sN   e Zd ZdddZedd
dZedddZedddZedddZdS )_RawRevokedCertificater}   rK   r   r>   r3   r   c                 C  rL   r"   _serial_number_revocation_date_extensionsr%   r}   r   r3   r(   r(   r)   r$   i  rO   z_RawRevokedCertificate.__init__r   c                 C  rP   r"   )r   rQ   r(   r(   r)   r}   s  rR   z$_RawRevokedCertificate.serial_numberc                 C  s   t jdtjdd | jS )Nuk   Properties that return a naïve datetime object have been deprecated. Please switch to revocation_date_utc.rp   )
stacklevel)warningswarnr   DeprecatedIn42r   rQ   r(   r(   r)   r   w  s   z&_RawRevokedCertificate.revocation_datec                 C  s   | j jtjjdS )Nr?   )r   rD   rB   timezoneutcrQ   r(   r(   r)   r     s   z*_RawRevokedCertificate.revocation_date_utcc                 C  rP   r"   )r   rQ   r(   r(   r)   r3     rR   z!_RawRevokedCertificate.extensionsN)r}   rK   r   r>   r3   r   rc   r   r   )	r,   r-   r.   r$   re   r}   r   r   r3   r(   r(   r(   r)   r   h  s    

	r   c                   @  s  e Zd ZejdFddZejdGd	d
ZejdHddZeejdIddZ	eejdJddZ
eejdKddZeejdLddZeejdMddZeejdMdd ZeejdNd"d#ZeejdNd$d%ZeejdOd'd(ZeejdPd)d*ZeejdPd+d,ZejdQd0d1ZejdRd2d3ZejdSd6d7ZejdTd:d7ZejdUd=d7ZejdVd?d@ZejdWdCdDZdES )XCertificateRevocationListr   r   r   rI   c                 C  rx   )z:
        Serializes the CRL to PEM or DER format.
        Nr(   r   r(   r(   r)   r     r|   z&CertificateRevocationList.public_bytesrv   rw   c                 C  rx   ry   r(   rz   r(   r(   r)   r{     r|   z%CertificateRevocationList.fingerprintr}   rK   RevokedCertificate | Nonec                 C  rx   )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nr(   )r%   r}   r(   r(   r)   (get_revoked_certificate_by_serial_number  r|   zBCertificateRevocationList.get_revoked_certificate_by_serial_numberr   c                 C  rx   r   r(   rQ   r(   r(   r)   r     r|   z2CertificateRevocationList.signature_hash_algorithmr   c                 C  rx   r   r(   rQ   r(   r(   r)   r     r|   z1CertificateRevocationList.signature_algorithm_oidr   c                 C  rx   r   r(   rQ   r(   r(   r)   r     r|   z8CertificateRevocationList.signature_algorithm_parametersr   c                 C  rx   )zC
        Returns the X509Name with the issuer of this CRL.
        Nr(   rQ   r(   r(   r)   r     r|   z CertificateRevocationList.issuerdatetime.datetime | Nonec                 C  rx   )z?
        Returns the date of next update for this CRL.
        Nr(   rQ   r(   r(   r)   next_update  r|   z%CertificateRevocationList.next_updatec                 C  rx   )zc
        Returns the date of next update for this CRL as a non-naive UTC
        datetime.
        Nr(   rQ   r(   r(   r)   next_update_utc  r|   z)CertificateRevocationList.next_update_utcr>   c                 C  rx   )z?
        Returns the date of last update for this CRL.
        Nr(   rQ   r(   r(   r)   last_update  r|   z%CertificateRevocationList.last_updatec                 C  rx   )zc
        Returns the date of last update for this CRL as a non-naive UTC
        datetime.
        Nr(   rQ   r(   r(   r)   last_update_utc  r|   z)CertificateRevocationList.last_update_utcr   c                 C  rx   )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nr(   rQ   r(   r(   r)   r3     r|   z$CertificateRevocationList.extensionsc                 C  rx   r   r(   rQ   r(   r(   r)   r     r|   z#CertificateRevocationList.signaturec                 C  rx   )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nr(   rQ   r(   r(   r)   tbs_certlist_bytes  r|   z,CertificateRevocationList.tbs_certlist_bytesrV   rW   rX   c                 C  rx   r   r(   r[   r(   r(   r)   r\     r|   z CertificateRevocationList.__eq__c                 C  rx   )z<
        Number of revoked certificates in the CRL.
        Nr(   rQ   r(   r(   r)   rl     r|   z!CertificateRevocationList.__len__idxr   c                 C     d S r"   r(   r%   r   r(   r(   r)   rn         z%CertificateRevocationList.__getitem__slicelist[RevokedCertificate]c                 C  r   r"   r(   r   r(   r(   r)   rn     r   int | slice-RevokedCertificate | list[RevokedCertificate]c                 C  rx   )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nr(   r   r(   r(   r)   rn     r|   #typing.Iterator[RevokedCertificate]c                 C  rx   )z8
        Iterator over the revoked certificates
        Nr(   rQ   r(   r(   r)   rm     r|   z"CertificateRevocationList.__iter__r   r   c                 C  rx   )zQ
        Verifies signature of revocation list against given public key.
        Nr(   )r%   r   r(   r(   r)   is_signature_valid  r|   z,CertificateRevocationList.is_signature_validNr   r   )r}   rK   r   r   r   r_   r   r   )r   r   r   r   r`   rb   rc   )r   rK   r   r   )r   r   r   r   )r   r   r   r   )r   r   )r   r   r   rX   )r,   r-   r.   r   r   r   r{   r   re   r   r   r   r   r   r   r   r   r3   r   r   r\   rl   typingoverloadrn   rm   r   r(   r(   r(   r)   r     sl    r   c                   @  s  e Zd Zejd.ddZejd/dd	Zejd0ddZeejd1ddZ	eejd2ddZ
eejd3ddZeejd4ddZeejd5ddZeejd6ddZejd7d"d#Zeejd8d$d%Zeejd8d&d'Zeejd9d(d)Zejd:d+d,Zd-S );CertificateSigningRequestrV   rW   r   rX   c                 C  rx   r   r(   r[   r(   r(   r)   r\   !  r|   z CertificateSigningRequest.__eq__rK   c                 C  rx   r   r(   rQ   r(   r(   r)   r^   '  r|   z"CertificateSigningRequest.__hash__r   c                 C  rx   r   r(   rQ   r(   r(   r)   r   -  r|   z$CertificateSigningRequest.public_keyr   c                 C  rx   r   r(   rQ   r(   r(   r)   r   3  r|   z!CertificateSigningRequest.subjectr   c                 C  rx   r   r(   rQ   r(   r(   r)   r   :  r|   z2CertificateSigningRequest.signature_hash_algorithmr   c                 C  rx   r   r(   rQ   r(   r(   r)   r   D  r|   z1CertificateSigningRequest.signature_algorithm_oidr   c                 C  rx   r   r(   rQ   r(   r(   r)   r   K  r|   z8CertificateSigningRequest.signature_algorithm_parametersr   c                 C  rx   )z@
        Returns the extensions in the signing request.
        Nr(   rQ   r(   r(   r)   r3   T  r|   z$CertificateSigningRequest.extensionsrf   c                 C  rx   )z/
        Returns an Attributes object.
        Nr(   rQ   r(   r(   r)   r8   [  r|   z$CertificateSigningRequest.attributesr   r   rI   c                 C  rx   )z;
        Encodes the request to PEM or DER format.
        Nr(   r   r(   r(   r)   r   b  r|   z&CertificateSigningRequest.public_bytesc                 C  rx   r   r(   rQ   r(   r(   r)   r   h  r|   z#CertificateSigningRequest.signaturec                 C  rx   )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nr(   rQ   r(   r(   r)   tbs_certrequest_byteso  r|   z/CertificateSigningRequest.tbs_certrequest_bytesc                 C  rx   )z8
        Verifies signature of signing request.
        Nr(   rQ   r(   r(   r)   r   w  r|   z,CertificateSigningRequest.is_signature_validr   c                 C  rx   )z:
        Get the attribute value for a given OID.
        Nr(   )r%   r   r(   r(   r)   rk   ~  r|   z/CertificateSigningRequest.get_attribute_for_oidNrb   rc   r   r   r   r_   r   r   )r   rf   r   r`   )r   rX   )r   r   r   rI   )r,   r-   r.   r   r   r\   r^   r   re   r   r   r   r   r3   r8   r   r   r   r   rk   r(   r(   r(   r)   r      sL    r   c                   @  sV   e Zd Zdg g fd*dd	Zd+ddZd,ddZddd-ddZ	d.ddd/d(d)ZdS )0 CertificateSigningRequestBuilderNsubject_nameName | Noner3   r4   r8   r9   c                 C  s   || _ || _|| _dS )zB
        Creates an empty X.509 certificate request (v1).
        N)_subject_namer   ri   )r%   r   r3   r8   r(   r(   r)   r$     s   	
z)CertificateSigningRequestBuilder.__init__namer   r   c                 C  s4   t |ts	td| jdurtdt|| j| jS )zF
        Sets the certificate requestor's distinguished name.
        Expecting x509.Name object.N&The subject name may only be set once.)rY   r   	TypeErrorr   r5   r   r   ri   r%   r   r(   r(   r)   r     s   


z-CertificateSigningRequestBuilder.subject_nameextvalr   criticalrX   c                 C  sF   t |ts	tdt|j||}t|| j t| jg | j|| j	S )zE
        Adds an X.509 extension to the certificate request.
        "extension must be an ExtensionType)
rY   r   r   r   r   r7   r   r   r   ri   r%   r   r   r1   r(   r(   r)   add_extension  s   
z.CertificateSigningRequestBuilder.add_extension)_tagr   r   rH   rI   r   _ASN1Type | Nonec                C  s~   t |ts	tdt |tstd|durt |tstdt|| j |dur-|j}nd}t| j	| j
g | j|||fS )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type)rY   r   r   rI   r   r<   ri   rH   r   r   r   )r%   r   rH   r   tagr(   r(   r)   add_attribute  s   


z.CertificateSigningRequestBuilder.add_attributersa_paddingprivate_keyr   rv   _AllowedHashTypes | Nonebackend
typing.Anyr   %padding.PSS | padding.PKCS1v15 | Noner   c                C  sX   | j du r	td|dur$t|tjtjfstdt|tjs$tdt	
| |||S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subjectPadding must be PSS or PKCS1v15&Padding is only supported for RSA keys)r   r5   rY   r   PSSPKCS1v15r   r   RSAPrivateKey	rust_x509create_x509_csrr%   r   rv   r   r   r(   r(   r)   sign  s   
z%CertificateSigningRequestBuilder.sign)r   r   r3   r4   r8   r9   )r   r   r   r   )r   r   r   rX   r   r   )r   r   rH   rI   r   r   r   r   r"   )
r   r   rv   r   r   r   r   r   r   r   )r,   r-   r.   r$   r   r   r   r   r(   r(   r(   r)   r     s    

$r   c                   @  s   e Zd ZU ded< ddddddg fd9ddZd:ddZd:ddZd;ddZd<dd Zd=d#d$Z	d=d%d&Z
d>d+d,Z	d?dd-d@d7d8ZdS )ACertificateBuilderr4   r   Nissuer_namer   r   r    CertificatePublicKeyTypes | Noner}   
int | Noner   r   r   r3   r   r    c                 C  s6   t j| _|| _|| _|| _|| _|| _|| _|| _	d S r"   )
ro   rr   _version_issuer_namer   _public_keyr   _not_valid_before_not_valid_afterr   )r%   r   r   r   r}   r   r   r3   r(   r(   r)   r$     s   

zCertificateBuilder.__init__r   r   c                 C  sD   t |ts	td| jdurtdt|| j| j| j| j	| j
| jS )z3
        Sets the CA's distinguished name.
        r   N%The issuer name may only be set once.)rY   r   r   r   r5   r   r   r   r   r   r   r   r   r(   r(   r)   r     s   

zCertificateBuilder.issuer_namec                 C  sD   t |ts	td| jdurtdt| j|| j| j| j	| j
| jS )z:
        Sets the requestor's distinguished name.
        r   Nr   )rY   r   r   r   r5   r   r   r   r   r   r   r   r   r(   r(   r)   r   "  s   

zCertificateBuilder.subject_namekeyr   c              	   C  s`   t |tjtjtjtjt	j
tjtjfstd| jdur tdt| j| j|| j| j| j| jS )zT
        Sets the requestor's public key (as found in the signing request).
        zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rY   r   DSAPublicKeyr   RSAPublicKeyr   EllipticCurvePublicKeyr
   Ed25519PublicKeyr	   Ed448PublicKeyr   X25519PublicKeyr   X448PublicKeyr   r   r5   r   r   r   r   r   r   r   )r%   r   r(   r(   r)   r   4  s2   
zCertificateBuilder.public_keynumberrK   c                 C  sh   t |ts	td| jdurtd|dkrtd| dkr$tdt| j| j| j	|| j
| j| jS )z5
        Sets the certificate serial number.
        'Serial number must be of integral type.N'The serial number may only be set once.r   z%The serial number should be positive.   3The serial number should not be more than 159 bits.)rY   rK   r   r   r5   
bit_lengthr   r   r   r   r   r   r   r%   r  r(   r(   r)   r}   Y  s&   

z CertificateBuilder.serial_numberr=   r>   c                 C  sz   t |tjs
td| jdurtdt|}|tk rtd| jdur-|| jkr-tdt| j	| j
| j| j|| j| jS )z7
        Sets the certificate activation time.
        Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rY   rB   r   r   r5   rF   _EARLIEST_UTC_TIMEr   r   r   r   r   r   r   r%   r=   r(   r(   r)   r   t  s,   
z#CertificateBuilder.not_valid_beforec                 C  sz   t |tjs
td| jdurtdt|}|tk rtd| jdur-|| jk r-tdt| j	| j
| j| j| j|| jS )z7
        Sets the certificate expiration time.
        r  Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rY   rB   r   r   r5   rF   r	  r   r   r   r   r   r   r   r
  r(   r(   r)   r     s.   


z"CertificateBuilder.not_valid_afterr   r   r   rX   c              	   C  sV   t |ts	tdt|j||}t|| j t| j| j	| j
| j| j| jg | j|S )z=
        Adds an X.509 extension to the certificate.
        r   )rY   r   r   r   r   r7   r   r   r   r   r   r   r   r   r   r(   r(   r)   r     s   
z CertificateBuilder.add_extensionr   r   r   rv   r   r   r   r   r   ru   c                C  s   | j du r	td| jdu rtd| jdu rtd| jdu r$td| jdu r-td| jdu r6td|durQt|tj	tj
fsGtdt|tjsQtd	t| |||S )
zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public keyr   r   )r   r5   r   r   r   r   r   rY   r   r   r   r   r   r   r   create_x509_certificater   r(   r(   r)   r     s(   





zCertificateBuilder.sign)r   r   r   r   r   r   r}   r   r   r   r   r   r3   r4   r   r    )r   r   r   r   )r   r   r   r   )r  rK   r   r   )r=   r>   r   r   )r   r   r   rX   r   r   r"   )
r   r   rv   r   r   r   r   r   r   ru   )r,   r-   r.   __annotations__r$   r   r   r   r}   r   r   r   r   r(   r(   r(   r)   r     s*   
 



%


 r   c                   @  sz   e Zd ZU ded< ded< dddg g fd.ddZd/ddZd0ddZd1ddZd2ddZd3d d!Z		d4dd"d5d,d-Z
dS )6 CertificateRevocationListBuilderr4   r   r   _revoked_certificatesNr   r   r   r   r   r3   revoked_certificatesc                 C  s"   || _ || _|| _|| _|| _d S r"   )r   _last_update_next_updater   r  )r%   r   r   r   r3   r  r(   r(   r)   r$     s
   
z)CertificateRevocationListBuilder.__init__r   r   c                 C  s<   t |ts	td| jd urtdt|| j| j| j| j	S )Nr   r   )
rY   r   r   r   r5   r  r  r  r   r  )r%   r   r(   r(   r)   r     s   

z,CertificateRevocationListBuilder.issuer_namer>   c                 C  sr   t |tjs
td| jd urtdt|}|tk rtd| jd ur-|| jkr-tdt| j	|| j| j
| jS )Nr  !Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)rY   rB   r   r  r5   rF   r	  r  r  r   r   r  )r%   r   r(   r(   r)   r     s(   
z,CertificateRevocationListBuilder.last_updatec                 C  sr   t |tjs
td| jd urtdt|}|tk rtd| jd ur-|| jk r-tdt| j	| j|| j
| jS )Nr  r  r  z8The next update date must be after the last update date.)rY   rB   r   r  r5   rF   r	  r  r  r   r   r  )r%   r   r(   r(   r)   r   (  s(   
z,CertificateRevocationListBuilder.next_updater   r   r   rX   c                 C  sN   t |ts	tdt|j||}t|| j t| j| j	| j
g | j|| jS )zM
        Adds an X.509 extension to the certificate revocation list.
        r   )rY   r   r   r   r   r7   r   r  r   r  r  r  r   r(   r(   r)   r   @  s   
z.CertificateRevocationListBuilder.add_extensionrevoked_certificater   c                 C  s4   t |ts	tdt| j| j| j| jg | j|S )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	rY   r   r   r  r   r  r  r   r  )r%   r  r(   r(   r)   add_revoked_certificateS  s   
z8CertificateRevocationListBuilder.add_revoked_certificater   r   r   rv   r   r   r   r   r   r   c                C  s|   | j d u r	td| jd u rtd| jd u rtd|d ur6t|tjtjfs,tdt|t	j
s6tdt| |||S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update timer   r   )r   r5   r  r  rY   r   r   r   r   r   r   r   create_x509_crlr   r(   r(   r)   r   d  s   


z%CertificateRevocationListBuilder.sign)
r   r   r   r   r   r   r3   r4   r  r   )r   r   r   r  )r   r>   r   r  )r   r>   r   r  )r   r   r   rX   r   r  )r  r   r   r  r"   )
r   r   rv   r   r   r   r   r   r   r   )r,   r-   r.   r  r$   r   r   r   r   r  r   r(   r(   r(   r)   r    s$   
 




r  c                   @  sH   e Zd Zddg fddd	ZdddZd ddZd!ddZd"d#ddZdS )$RevokedCertificateBuilderNr}   r   r   r   r3   r4   c                 C  rL   r"   r   r   r(   r(   r)   r$     rO   z"RevokedCertificateBuilder.__init__r  rK   r   c                 C  sX   t |ts	td| jd urtd|dkrtd| dkr$tdt|| j| jS )Nr  r  r   z$The serial number should be positiver  r  )	rY   rK   r   r   r5   r  r  r   r   r  r(   r(   r)   r}     s   


z'RevokedCertificateBuilder.serial_numberr=   r>   c                 C  sN   t |tjs
td| jd urtdt|}|tk rtdt| j|| j	S )Nr  z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
rY   rB   r   r   r5   rF   r	  r  r   r   r
  r(   r(   r)   r     s   

z)RevokedCertificateBuilder.revocation_dater   r   r   rX   c                 C  sF   t |ts	tdt|j||}t|| j t| j| j	g | j|S )Nr   )
rY   r   r   r   r   r7   r   r  r   r   r   r(   r(   r)   r     s   
z'RevokedCertificateBuilder.add_extensionr   r   r   c                 C  s:   | j d u r	td| jd u rtdt| j | jt| jS )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r   r5   r   r   r   r   )r%   r   r(   r(   r)   build  s   

zRevokedCertificateBuilder.build)r}   r   r   r   r3   r4   )r  rK   r   r  )r=   r>   r   r  )r   r   r   rX   r   r  r"   )r   r   r   r   )r,   r-   r.   r$   r}   r   r   r  r(   r(   r(   r)   r    s    



r  rK   c                   C  s   t tddd? S )N   bigr   )rK   
from_bytesosurandomr(   r(   r(   r)   random_serial_number  rU   r  )r1   r2   r3   r4   r   r    )r   r   r8   r9   r   r    )r=   r>   r   r>   rc   )N
__future__r   r   rB   r  r   r   cryptographyr   "cryptography.hazmat.bindings._rustr   r   cryptography.hazmat.primitivesr   r   )cryptography.hazmat.primitives.asymmetricr   r   r	   r
   r   r   r   r   /cryptography.hazmat.primitives.asymmetric.typesr   r   r   cryptography.x509.extensionsr   r   r   r   cryptography.x509.namer   r   cryptography.x509.oidr   r	  UnionSHA224SHA256SHA384SHA512SHA3_224SHA3_256SHA3_384SHA3_512_AllowedHashTypes	Exceptionr   r7   r<   rF   rG   rf   Enumro   rs   ABCMetaru   registerr   r   r   r   load_pem_x509_certificateload_der_x509_certificateload_pem_x509_certificatesload_pem_x509_csrload_der_x509_csrload_pem_x509_crlload_der_x509_crlr   r   r  r  r  r(   r(   r(   r)   <module>   sv   (





$   " fe v I