
    >wgRn                       d Z ddlmZmZmZmZ ddlmZ ddlm	Z	 ddl
Z
ddlZddlZddlZddlZddlZddlmZ ddlmZmZ dd	lmZ dd
lmZmZmZ ddlmZmZmZmZ ddl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z< ddl=m>Z> ddl?m@Z@mAZAmBZBmCZC  G d de*      ZD G d de*      ZE G d de*      ZF G d de0      ZG G d de3      ZH G d de4      ZI G d de"      ZJ G d de3      ZK G d d e7      ZLed!        ZM G d" d#e%      ZN G d$ d%e.      ZO G d& d'e3      ZP G d( d)e6      ZQ G d* d+e4      ZR G d, d-e%      ZS G d. d/e3      ZT G d0 d1e%      ZU G d2 d3e%      ZV G d4 d5e%      ZW G d6 d7e5      ZX G d8 d9e5      ZY G d: d;e4      ZZ G d< d=e4      Z[ G d> d?e3      Z\ G d@ dAe3      Z] G dB dCe4      Z^ G dD dEe3      Z_ G dF dGe4      Z` G dH dIe%      Za G dJ dKe%      Zb G dL dMe5      Zc G dN dOe4      Zd G dP dQe5      Ze G dR dSe3      Zf G dT dUe6      Zg G dV dWe3      Zh G dX dYe%      Zi G dZ d[e+      Zj G d\ d]e+      Zk G d^ d_e3      Zl G d` dae4      Zm G db dce3      Zn G dd dee3      Zo G df dge%      Zp G dh die4      Zq G dj dke%      Zr G dl dme3      Zs G dn doe3      Zt G dp dqe3      Zu G dr dse%      Zv G dt due"      Zw G dv dwe3      Zx G dx dye4      Zy G dz d{e3      Zz G d| d}e3      Z{ G d~ de4      Z| G d de%      Z} G d de4      Z~ G d de3      Z G d de3      Z G d de.      Z G d de3      Z G d de4      Z G d de.      Z G d de3      Z G d de4      Z G d de3      Z G d de4      Z G d de3      Z G d de.      Z G d de4      Z G d de.      Z G d de3      Z G d de4      Z G d de4      Z G d de4      Z G d de3      Z G d de"      Z G d de+      Z G d de3      Z G d de6      Z G d de3      Z G d de3      Z G d de6      Z G d de'      Z G d de'      Z G d de'      Z G d de'      Z G d de'      Z G d de'      Z G dĄ de3      Z G dƄ de3      Z G dȄ de'      Z G dʄ de3      Z G d̄ de3      Z G d΄ de6      Z G dЄ de.      Z G d҄ de6      Z G dԄ de6      Z G dք de6      Z G d؄ de3      Z G dڄ de6      Z G d܄ de3      Z G dބ de4      Z G d de.      Z G d de3      Z G d de4      Z G d de3      Z G d de3      Z G d de4      Z G d de4      Z G d de3      Z G d de&      Zy)z
ASN.1 type classes for X.509 certificates. Exports the following items:

 - Attributes()
 - Certificate()
 - Extensions()
 - GeneralName()
 - GeneralNames()
 - Name()

Other type classes are defined that help compose the types listed above.
    )unicode_literalsdivisionabsolute_importprint_function)contextmanager)idnaN   )unwrap)
iri_to_uri
uri_to_iri)OrderedDict)	type_namestr_clsbytes_to_list)AlgorithmIdentifierAnyAlgorithmIdentifierDigestAlgorithmSignedDigestAlgorithm)Any	BitString	BMPStringBooleanChoiceConcat
EnumeratedGeneralizedTimeGeneralString	IA5StringIntegerNullNumericStringObjectIdentifierOctetBitStringOctetStringParsableOctetStringPrintableStringSequence
SequenceOfSetSetOfTeletexStringUniversalStringUTCTime
UTF8StringVisibleStringVOID)PublicKeyInfo)int_to_bytesint_from_bytes	inet_ntop	inet_ptonc                   &    e Zd ZdZdZd Zd Zd Zy)DNSNamer         c                     | |k(   S N selfothers     F/var/www/horilla/myenv/lib/python3.12/site-packages/asn1crypto/x509.py__ne__zDNSName.__ne__L       5=      c                     t        |t              sy| j                         j                         |j                         j                         k(  S )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2

        :param other:
            Another DNSName object

        :return:
            A boolean
        F)
isinstancer7   __unicode__lowerr>   s     rA   __eq__zDNSName.__eq__O   s@     %)!'')U->->-@-F-F-HHHrD   c           	      h   t        |t              s(t        t        dt	        |       t	        |                  |j                  d      r"d|dd j                  | j                        z   }n|j                  | j                        }|| _        || _	        d| _
        | j                  dk7  rd| _        yy)zd
        Sets the value of the DNS name

        :param value:
            A unicode string
        K
                %s value must be a unicode string, not %s
                .   .r	   NrD   )rF   r   	TypeErrorr
   r   
startswithencode	_encoding_unicodecontents_header_trailer)r?   valueencoded_values      rA   setzDNSName.set_   s     %)F $%    C  59#3#3DNN#CCM!LL8M%==CDM  rD   N)__name__
__module____qualname__rQ   _bad_tagrB   rI   rX   r=   rD   rA   r7   r7   G   s    IH!I  rD   r7   c                   $    e Zd Zd Zd Zd Zd Zy)URIc           	          t        |t              s(t        t        dt	        |       t	        |                  || _        t        |      | _        d| _        | j                  dk7  rd| _	        yy)b
        Sets the value of the string

        :param value:
            A unicode string
        rK   NrD   )
rF   r   rN   r
   r   rR   r   rS   rT   rU   r?   rV   s     rA   rX   zURI.set~   sl     %)F $%    "5)==CDM  rD   c                     | |k(   S r<   r=   r>   s     rA   rB   z
URI.__ne__   rC   rD   c                 ~    t        |t              syt        | j                  d      t        |j                  d      k(  S )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4

        :param other:
            Another URI object

        :return:
            A boolean
        FT)rF   r^   r   nativer>   s     rA   rI   z
URI.__eq__   s2     %%$++t,
5<<0NNNrD   c                     | j                   y| j                  t        | j                               | _        | j                  S 7
        :return:
            A unicode string
         )rS   rR   r   _merge_chunksr?   s    rA   rG   zURI.__unicode__   s:     == == &t'9'9';<DM}}rD   N)rY   rZ   r[   rX   rB   rI   rG   r=   rD   rA   r^   r^   |   s     .!O 
rD   r^   c                   d    e Zd ZdZdZdZed        Zej                  d        Zd Z	d Z
d Zd	 Zy)
EmailAddressNFr8   c                     | j                   S )z`
        :return:
            A byte string of the DER-encoded contents of the sequence
        )	_contentsrj   s    rA   rS   zEmailAddress.contents   s     ~~rD   c                      d| _         || _        y)ze
        :param value:
            A byte string of the DER-encoded contents of the sequence
        FN)_normalizedrn   ra   s     rA   rS   zEmailAddress.contents   s     !rD   c           	         t        |t              s(t        t        dt	        |       t	        |                  |j                  d      dk7  r<|j                  dd      \  }}|j                  d      dz   |j                  d      z   }n|j                  d      }d| _        || _	        || _
        d	| _        | j                  d
k7  rd
| _        y	y	)r`   rK   @r	   ascii   @r   TNrD   )rF   r   rN   r
   r   findrsplitrP   rp   rR   rS   rT   rU   )r?   rV   mailboxhostnamerW   s        rA   rX   zEmailAddress.set   s     %)F $%    ::c?b  %S! 4GX#NN73d:X__V=TTM!LL1M%==CDM  rD   c                 >   | j                   | j                         }|j                  d      dk(  r"|j                  d      | _         | j                   S |j	                  dd      \  }}|j                  d      dz   |j                  d      z   | _         | j                   S )rg   ru   rs   cp1252r	   rr   r   )rR   ri   rv   decoderw   )r?   rS   rx   ry   s       rA   rG   zEmailAddress.__unicode__   s     == ))+H}}T"b( ( 9 }} %-OOD!$<! 'x 83 >QWAX X}}rD   c                     | |k(   S r<   r=   r>   s     rA   rB   zEmailAddress.__ne__  rC   rD   c                 8   t        |t              sy| j                  s| j                  | j                         |j                  s|j                  |j                         | j
                  j                  d      dk(  s|j
                  j                  d      dk(  r| j
                  |j
                  k(  S |j
                  j                  dd      \  }}| j
                  j                  dd      \  }}||k7  ry|j                         |j                         k7  ryy)z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5

        :param other:
            Another EmailAddress object

        :return:
            A boolean
        Fru   rs   r	   T)	rF   rl   rp   rX   rd   rn   rv   rw   rH   )r?   r@   other_mailboxother_hostnamerx   ry   s         rA   rI   zEmailAddress.__eq__  s     %.HHT[[!  IIell#>>t$*eoo.B.B4.HB.N>>U__44(-(>(>tQ(G%~ NN11$:m#>>~3355rD   )rY   rZ   r[   rn   rp   r\   propertyrS   setterrX   rG   rB   rI   r=   rD   rA   rl   rl      sS    I K H  __  <"!rD   rl   c                   6    e Zd ZddZd Zed        Zd Zd Zy)	IPAddressNc                 *    t        t        d            )z?
        This method is not applicable to IP addresses
        z=
            IP address values can not be parsed
            )
ValueErrorr
   )r?   specspec_paramss      rA   parsezIPAddress.parse'  s    
 
  	rD   c           	      \   t        |t              s(t        t        dt	        |       t	        |                  |}|j                  d      dk7  }d}|rH|j                  dd      }|d   }t        |d         }|dk  rt        t        dt	        |                   |j                  d      dk7  r6t        j                  }|dkD  rt        t        d	t	        |                   d}n5t        j                  }|d
kD  rt        t        dt	        |                   d
}d}|rEd|z  }	|	d|t        |	      z
  z  z  }	t        t        |	d            }d|dz  t        |      z
  z  |z   }|| _        t        ||      |z   | _        | j                   | _        d| _        | j&                  dk7  rd| _        yy)z
        Sets the value of the object

        :param value:
            A unicode string containing an IPv4 address, IPv4 address with CIDR,
            an IPv6 address or IPv6 address with CIDR
        rK   /rs   r   r	   zT
                    %s value contains a CIDR range less than 0
                    :   z
                    %s value contains a CIDR range bigger than 128, the maximum
                    value for an IPv6 address
                        z
                    %s value contains a CIDR range bigger than 32, the maximum
                    value for an IPv4 address
                    rD   10          N)rF   r   rN   r
   r   rv   splitintr   socketAF_INET6AF_INETlenr2   _nativer5   rS   _bytesrT   rU   )
r?   rV   original_valuehas_cidrcidrpartsfamily	cidr_size
cidr_bytes	cidr_masks
             rA   rX   zIPAddress.set2  s    %)F $%    ::c?b(KKQ'E!HEuQx=Dax  dO	"   ::c?b __Fcz  dO"   I^^Fby  dO"   I
d
I	C	N :;;I%c)Q&78J!i1nJ%GHJVJ%!&%0:=mm==CDM  rD   c                    | j                   y| j                  | j                         }t        |      }d}d}|t	        ddg      v r1t        t        j                  |dd       }|dkD  rNt        |dd       }n?|t	        ddg      v r0t        t        j                  |dd       }|dkD  rt        |dd       }|<dj                  |      }t        |j                  d            }|d	z   t        |      z   }|| _        | j                  S )
z
        The native Python datatype representation of this value

        :return:
            A unicode string or None
        Nr      r   r      z{0:b}r   r   )rS   r   	__bytes__r   rX   r4   r   r   r3   r   formatrstripr   )r?   byte_stringbyte_lenrV   cidr_int	cidr_bitsr   s          rA   rd   zIPAddress.nativey  s    == <<..*K;'HEH3Bx=(!&//;q3DEb=-k"#.>?HS!Q[(!&..+a2BCa<-k!"o>H##NN84	9++C01gdm3 DL||rD   c                     | |k(   S r<   r=   r>   s     rA   rB   zIPAddress.__ne__  rC   rD   c                 f    t        |t              sy| j                         |j                         k(  S )zl
        :param other:
            Another IPAddress object

        :return:
            A boolean
        F)rF   r   r   r>   s     rA   rI   zIPAddress.__eq__  s*     %+~~5??#444rD   )NN)	rY   rZ   r[   r   rX   r   rd   rB   rI   r=   rD   rA   r   r   &  s,    	E N  >!5rD   r   c                   "    e Zd ZdefdedeifgZy)	Attributetypevaluesr   N)rY   rZ   r[   r"   r*   r   _fieldsr=   rD   rA   r   r     s     	!"	563-(GrD   r   c                       e Zd ZeZy)
AttributesN)rY   rZ   r[   r   _child_specr=   rD   rA   r   r         KrD   r   c            
       $    e Zd Zddddddddd	d
	Zy)KeyUsagedigital_signaturenon_repudiationkey_enciphermentdata_enciphermentkey_agreementkey_cert_signcrl_signencipher_onlydecipher_only	r   r	   r      r            r   NrY   rZ   r[   _mapr=   rD   rA   r   r     s$    
DrD   r   c                   ,    e Zd ZdedddfdedddfgZy)PrivateKeyUsagePeriod
not_beforer   Timplicitoptional	not_afterr	   N)rY   rZ   r[   r   r   r=   rD   rA   r   r     s'    	QD(IJ	oA4'HIGrD   r   c                       e Zd ZdZdZd Zy)NotReallyTeletexStringa6  
    OpenSSL (and probably some other libraries) puts ISO-8859-1
    into TeletexString instead of ITU T.61. We use Windows-1252 when
    decoding since it is a superset of ISO-8859-1, and less likely to
    cause encoding issues, but we stay strict with encoding to prevent
    us from creating bad data.
    r{   c                     | j                   y| j                  .| j                         j                  | j                        | _        | j                  S rf   )rS   rR   ri   r|   _decoding_encodingrj   s    rA   rG   z"NotReallyTeletexString.__unicode__  sF     == ==  ..0778O8OPDM}}rD   N)rY   rZ   r[   __doc__r   rG   r=   rD   rA   r   r     s     "
rD   r   c               #   b   K   	 dt         _        d  dt         _        y # dt         _        w xY ww)Nteletexr{   )r   r   r=   rD   rA   strict_teletexr     s)     =4=14<1H1s   / /,/c                   4    e Zd ZdefdefdefdefdefdefgZ	y)DirectoryStringteletex_stringprintable_stringuniversal_stringutf8_string
bmp_string
ia5_stringN)
rY   rZ   r[   r   r&   r,   r.   r   r   _alternativesr=   rD   rA   r   r     s:    	12	_-	_-	
#	y!	y!MrD   r   c                      e Zd Zi ddddddddd	d
dddddddddddddddddddddd d!d"i d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDZg dEZedF        ZedG        ZyH)INameTypez2.5.4.3common_namez2.5.4.4surnamez2.5.4.5serial_numberz2.5.4.6country_namez2.5.4.7locality_namez2.5.4.8state_or_province_namez2.5.4.9street_addressz2.5.4.10organization_namez2.5.4.11organizational_unit_namez2.5.4.12titlez2.5.4.15business_categoryz2.5.4.17postal_codez2.5.4.20telephone_numberz2.5.4.41namez2.5.4.42
given_namez2.5.4.43initialsz2.5.4.44generation_qualifierz2.5.4.45unique_identifierz2.5.4.46dn_qualifierz2.5.4.65	pseudonymz2.5.4.97organization_identifierz2.23.133.2.1tpm_manufacturerz2.23.133.2.2	tpm_modelz2.23.133.2.3tpm_versionz2.23.133.2.4platform_manufacturerz2.23.133.2.5platform_modelz2.23.133.2.6platform_versionz1.2.840.113549.1.9.1email_addressz1.3.6.1.4.1.311.60.2.1.1incorporation_localityz1.3.6.1.4.1.311.60.2.1.2incorporation_state_or_provincez1.3.6.1.4.1.311.60.2.1.3incorporation_countryz0.9.2342.19200300.100.1.1user_idz0.9.2342.19200300.100.1.25domain_componentz0.2.262.1.10.7.20name_distinguisher)!r  r  r  r   r   r   r   r   r   r   r   r   r   r   r  r   r   r   r   r   r   r   r   r   r  r  r   r   r   r   r   r   r   c                     | j                  |      }|| j                  v r| j                  j                  |      }||fS t        | j                        }||fS )z
        Returns an ordering value for a particular attribute key.

        Unrecognized attributes and OIDs will be sorted lexically at the end.

        :return:
            An orderable value.

        )mappreferred_orderindexr   )cls	attr_nameordinals      rA   preferred_ordinalzNameType.preferred_ordinalK  s`     GGI&	+++))//	:G ## #--.G##rD   c                    i ddddddddd	d
dddddddddddddddddddddd d!d"i d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDj                  | j                  | j                        S )EzZ
        :return:
            A human-friendly unicode string to display to users
        r   zCommon Namer   Surnamer   zSerial Numberr   Countryr   Localityr   zState/Provincer   zStreet Addressr   Organizationr   zOrganizational Unitr   Titler   zBusiness Categoryr   zPostal Coder   zTelephone Numberr   Namer   z
Given Namer   Initialsr   zGeneration Qualifierr   zUnique Identifierr   zDN Qualifierr   	Pseudonymr   zEmail Addressr  zIncorporation Localityr  zIncorporation State/Provincer  zIncorporation Countryr  zDomain Componentr  zName Distinguisherr   zOrganization Identifierr   zTPM Manufacturerr   z	TPM Modelr   zTPM Versionr   zPlatform Manufacturerr   zPlatform Modelr   zPlatform Versionr  zUser ID)getrd   rj   s    rA   human_friendlyzNameType.human_friendly_  s   #
=#
y#
 _#
 I	#

 Z#
 %&6#
 .#
  #
 '(=#
 W#
  !4#
 =#
  2#
 F#
 ,#
  
!#
" #$:##
$  !4%#
& N'#
( )#
* _+#
, %&>-#
. ./M/#
0 $%<1#
2  23#
4 !"65#
6 &'@7#
8  29#
: ;#
< ==#
> $%<?#
@ .A#
B  2C#
D yE#
F #dkk4;;
'G#	(rD   N)	rY   rZ   r[   r   r	  classmethodr  r   r  r=   rD   rA   r   r     s   )=)9) 	?) 	>	)
 	?) 	+) 	#) 	') 	.) 	G) 	') 	M) 	&) 	F) 	L)  	J!)" 	*#)$ 	'%)& 	N')( 	K))* 	-+). 	*/)0 	1)2 	3)4 	/5)6 	(7)8 	*9)< 	=)@ 	#$<A)B 	#$EC)D 	#$;E)H 	$YI)L 	%&8M)P 	1Q)D\"OH $ $& )( )(rD   r   c                      e Zd ZdefdefgZdZi dededededed	ed
ededededededededededei de	dedede
dededededededed ed!ed"ed#ed$ed%eZd&Zed'        Zd( Zd) Zd* Zy&)+NameTypeAndValuer   rV   r   rV   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r   r   r   r   r   r   r   r  Nc                 x    | j                   #| j                  | d   j                        | _         | j                   S )z
        Returns the value after being processed by the internationalized string
        preparation as specified by RFC 5280

        :return:
            A unicode string
        rV   )_prepped_ldap_string_preprd   rj   s    rA   prepped_valuezNameTypeAndValue.prepped_value  s4     ==  224=3G3GHDM}}rD   c                     | |k(   S r<   r=   r>   s     rA   rB   zNameTypeAndValue.__ne__  rC   rD   c                     t        |t              sy|d   j                  | d   j                  k7  ry|j                  | j                  k(  S )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another NameTypeAndValue object

        :return:
            A boolean
        Fr   )rF   r  rd   r!  r>   s     rA   rI   zNameTypeAndValue.__eq__  sH     %!12=4<#6#66""d&8&888rD   c                 "   t        j                  dd|      }t        j                  dd|      }t        j                  dk(  rt        j                  dd|      }nt        j                  dd|      }t        j                  dd|      }|j	                  d	d      }t        j                  d
d|      }dj                  t        t        j                  |            }t        j                  d|      }|D ]  }t        j                  |      rt        t        d            t        j                  |      rt        t        d            t        j                  |      rt        t        d            t        j                   |      rt        t        d            t        j"                  |      rt        t        d            |dk(  st        t        d             d}d}|D ]2  }t        j$                  |      rd}t        j&                  |      s1d}4 |rJt        j$                  |d         }t        j$                  |d         }|s|r|st        t        d            dt        j                  dd|      j)                         z   dz   }|S )a"  
        Implements the internationalized string preparation algorithm from
        RFC 4518. https://tools.ietf.org/html/rfc4518#section-2

        :param string:
            A unicode string to prepare

        :return:
            A prepared unicode string, ready for comparison
        u   [­᠆͏᠋-᠍️-＀￼]+rh   u	   [	
] i  u   [-]|[-]|󠀁u   [𝅳-𝅺󠀠-󠁿󠀁]u?   [ ----۝܏᠎‌-‏‪-‮⁠-⁣⁪-⁯﻿￹-￻]+u   ​u   [   -  -   　]NFKCzc
                    X.509 Name objects may not contain unassigned code points
                    z
                    X.509 Name objects may not contain change display or
                    zzzzdeprecated characters
                    zc
                    X.509 Name objects may not contain private use characters
                    zf
                    X.509 Name objects may not contain non-character code points
                    zb
                    X.509 Name objects may not contain surrogate code points
                    u   �zf
                    X.509 Name objects may not contain the replacement character
                    FTr   rs   z{
                    X.509 Name object contains a malformed bidirectional
                    sequence
                    z +z  )resubsys
maxunicodereplacejoinr  
stringprepmap_table_b2unicodedata	normalizein_table_a1r   r
   in_table_c8in_table_c3in_table_c4in_table_c5in_table_d1in_table_d2strip)r?   stringcharhas_r_and_al_cat	has_l_catfirst_is_r_and_allast_is_r_and_als          rA   r   z"NameTypeAndValue._ldap_string_prep  s    OQSU[\@#vN>>V# VVTVXZ`aFVVTVXZ`aFK	
 "-TVY[abZ44f=> &&vv6  *	D%%d+ "   %%d+ "   %%d+ "   %%d+ "   %%d+ "   x "  M*	\ !	 	!D%%d+#' ''- 			!  * 6 6vay A)55fRjA 19I "   rvvdD&17799C?rD   )rY   rZ   r[   r   r   r   	_oid_pairr   r&   r#   rl   r7   r.   
_oid_specsr  r   r!  rB   rI   r   r=   rD   rA   r  r    s   		#G
 "I%%?% 	% 		%
 	% 	!/% 	/% 	_% 	#O% 	% 	_% 	% 	O% 	% 	o%  	O!%" 	#%$ 	^%%& 	'%( 	_)%, 	-%0 	!/1%2 	*?3%4 	 5%6 	G7%8 	o9%: 	"?;%< 	J=%> 	Z?%@ 	zA%B 	 C%D 	*E%F 	JG%H 	?I%JN H !9&jrD   r  c                   8    e Zd ZeZed        Zd Zd Zd Z	d Z
y)RelativeDistinguishedNamec                     g }| j                  |       }t        |j                               D ]  }|j                  |d||           dj	                  |      S )b
        :return:
            A unicode string that can be used as a dict key or in a set
        : )_get_valuessortedkeysappendr,  )r?   outputr   keys       rA   hashablez"RelativeDistinguishedName.hashableP  sY     !!$'&++-( 	9CMMc6#;78	9
 {{6""rD   c                     | |k(   S r<   r=   r>   s     rA   rB   z RelativeDistinguishedName.__ne__`  rC   rD   c                    t        |t              syt        |       t        |      k7  ry| j                  |       }| j                  |      }||k7  ry| j	                  |       }| j	                  |      }|D ]  }||   ||   k7  s y y)z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RelativeDistinguishedName object

        :return:
            A boolean
        FT)rF   rB  r   
_get_typesrG  )r?   r@   
self_typesother_typesself_valuesother_values
type_name_s          rA   rI   z RelativeDistinguishedName.__eq__c  s     %!:;t9E
"__T*
ooe,$&&t,''.$ 	J:&,z*BB	 rD   c                 X    t        |D cg c]  }|d   j                   c}      S c c}w )z
        Returns a set of types contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A set object with unicode strings of NameTypeAndValue type field
            values
        r   )rX   rd   )r?   rdnntvs      rA   rP  z$RelativeDistinguishedName._get_types  s'     #63CK&&6776s   'c                     i }|D cg c]-  }|j                  |d   j                  |j                  fg      / c} |S c c}w )a$  
        Returns a dict of prepped values contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A dict object with unicode strings of NameTypeAndValue value field
            values that have been prepped for comparison
        r   )updaterd   r!  )r?   rW  rK  rX  s       rA   rG  z%RelativeDistinguishedName._get_values  sC     MPQcV++S->->?@	AQ 	Rs   2>N)rY   rZ   r[   r  r   r   rM  rB   rI   rP  rG  r=   rD   rA   rB  rB  M  s.    "K# #!@8rD   rB  c                   ,    e Zd ZeZed        Zd Zd Zy)RDNSequencec                 2    dj                  d | D              S )rD  c              3   4   K   | ]  }|j                     y wr<   )rM  ).0rW  s     rA   	<genexpr>z'RDNSequence.hashable.<locals>.<genexpr>  s     8C3<<8s   )r,  rj   s    rA   rM  zRDNSequence.hashable  s     {{84888rD   c                     | |k(   S r<   r=   r>   s     rA   rB   zRDNSequence.__ne__  rC   rD   c                     t        |t              syt        |       t        |      k7  ryt        |       D ]  \  }}||   |k7  s y y)z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RDNSequence object

        :return:
            A boolean
        FT)rF   r\  r   	enumerate)r?   r@   r
  self_rdns       rA   rI   zRDNSequence.__eq__  sO     %-t9E
"( 	OE8U|x'	 rD   N)	rY   rZ   r[   rB  r   r   rM  rB   rI   r=   rD   rA   r\  r\    s#    +K	9 	9!rD   r\  c                       e Zd ZdefgZdZdZdZedd       Z	e
d        Zd Zd Zd Ze
d        Ze
d	        Zd
 Ze
d        Ze
d        Zy)r  rh   Nc           
         g }|s	d}t         }nd}t        }t        t        |j	                         d             }|j	                         D ]  \  }}t
        j                  |      }|dk(  rt        |      }nJ|dk(  rt        |      }n9|t        g d      v rt        dt        |            }nt        | ||            }|j                  t        t        ||d	      g               | d
t        |            S )aY  
        Creates a Name object from a dict of unicode string keys and values.
        The keys should be from NameType._map, or a dotted-integer OID unicode
        string.

        :param name_dict:
            A dict of name information, e.g. {"common_name": "Will Bond",
            "country_name": "US", "organization_name": "Codex Non Sufficit LC"}

        :param use_printable:
            A bool - if PrintableString should be used for encoding instead of
            UTF8String. This is for backwards compatibility with old software.

        :return:
            An x509.Name object
        r   r   c                 2    t         j                  | d         S )Nr   )r   r  )items    rA   <lambda>zName.build.<locals>.<lambda>  s    !;!;DG!D rD   )rL  r   r  )r   r   r   )r   rV   r  rh   )r.   r&   r   rH  itemsr   r  rl   r7   rX   r   rJ  rB  r  r\  )	r  	name_dictuse_printablerdnsencoding_nameencoding_classattribute_nameattribute_valuerV   s	            rA   buildz
Name.build  s   & )M'N.M,N  !D
	 09/@ 	+NO%\\.9N0$_5#5503'X#YY'+)/:
 (&(9
 KK1 *"" 3  #	0 +d"344rD   c                 .    | j                   j                  S )rD  )chosenrM  rj   s    rA   rM  zName.hashable  s     {{###rD   c                 ,    t        | j                        S r<   )r   ru  rj   s    rA   __len__zName.__len__  s    4;;rD   c                     | |k(   S r<   r=   r>   s     rA   rB   zName.__ne__  rC   rD   c                 V    t        |t              sy| j                  |j                  k(  S )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another Name object

        :return:
            A boolean
        F)rF   r  ru  r>   s     rA   rI   zName.__eq__!  s$     %&{{ell**rD   c                 j   | j                   t               | _         | j                  j                  D ]t  }|D ]m  }|d   }|| j                   v rF| j                   |   }t	        |t
              s|gx}| j                   |<   |j                  |d          \|d   | j                   |<   o v | j                   S )Nr   rV   )r   r   ru  rd   rF   listrJ  )r?   rW  type_val
field_nameexistings        rA   rd   zName.native0  s    <<&=DL{{)) 	E # EH!)&!1J!T\\1#'<<
#;)(D9CK*LHt||J'? (9:3;G3DZ0E	E ||rD   c                 :   | j                   t               }d}| j                  D ]G  }|D ]@  }|d   j                  }|}||v r!||   g||<   ||   j	                  |d          9|d   ||<   B I g }|j                         }|dk(  rt        t        |            }|D ].  }||   }	| j                  |	      }
|j	                  |d|
       0 d}|D ]  }|j                  d      dk7  sd	} n |sd
nd}|j                  |ddd         | _         | j                   S )zg
        :return:
            A human-friendly unicode string containing the parts of the name
        Nr   rV   r  rE  F,rs   T, z; )_human_friendlyr   ru  r  rJ  rI  reversedr{  _recursive_humanizerv   r,  )r?   data
last_fieldrW  r|  r}  to_joinrI  rL  rV   native_value	has_commaelement	separators                 rA   r  zName.human_friendly@  sT    '=DJ{{ = # =H!)&!1!@!@J!+J!T),0,<+=Z(Z(//0AB+3G+<Z(== G99;DY&T
+ ?S	#77>3=>?
 I" <<$* $I
 %.4I#,>>'$B$-#@D ###rD   c           
          t        |t              r7dj                  t        |D cg c]  }| j	                  |       c}            S |j
                  S c c}w )z
        Recursively serializes data compiled from the RDNSequence

        :param value:
            An Asn1Value object, or a list of Asn1Value objects

        :return:
            A unicode string
        r  )rF   r{  r,  r  r  rd   )r?   rV   	sub_values      rA   r  zName._recursive_humanizeg  sO     eT"99uU)$229=UV  || Vs   Ac                     | j                   6t        j                  | j                               j	                         | _         | j                   S )zZ
        :return:
            The SHA1 hash of the DER-encoded bytes of this name
        _sha1hashlibsha1dumpdigestrj   s    rA   r  z	Name.sha1x  7     :: diik299;DJzzrD   c                     | j                   6t        j                  | j                               j	                         | _         | j                   S )z]
        :return:
            The SHA-256 hash of the DER-encoded bytes of this name
        _sha256r  sha256r  r  rj   s    rA   r  zName.sha256  s7     <<">>$))+6==?DL||rD   )F)rY   rZ   r[   r\  r   r  r  r  r  rs  r   rM  rw  rB   rI   rd   r  r  r  r  r=   rD   rA   r  r    s    	[M OEG:5 :5x $ $ !+   $$ $$L"    rD   r  c                   "    e Zd ZdefdeddifgZy)AnotherNametype_idrV   explicitr   N)rY   rZ   r[   r"   r   r   r=   rD   rA   r  r    s     	$%	#
A'GrD   r  c                   $    e Zd ZdZdZdefdefgZy)CountryNamer	   x121_dcc_codeiso_3166_alpha2_codeNrY   rZ   r[   class_tagr!   r&   r   r=   rD   rA   r  r    s%    F
C 
-(	1MrD   r  c                   $    e Zd ZdZdZdefdefgZy)AdministrationDomainNamer	   r   numeric	printableNr  r=   rD   rA   r  r    s%    F
C 
M"	o&MrD   r  c                       e Zd ZdefdefgZy)PrivateDomainNamer  r  NrY   rZ   r[   r!   r&   r   r=   rD   rA   r  r    s    	M"	o&MrD   r  c                   F    e Zd Zdeddifdedddfded	ddfd
edddfgZy)PersonalNamer   r   r   r   r	   Tr   r   r   r   r   NrY   rZ   r[   r&   r   r=   rD   rA   r  r    sD    	Oj!_5	QD(IJ	_1$&GH	qd2ST	GrD   r  c                   F    e Zd Zdeddifdedddfded	ddfd
edddfgZy)TeletexPersonalNamer   r   r   r   r	   Tr   r   r   r   r   NrY   rZ   r[   r+   r   r=   rD   rA   r  r    sD    	MJ?3	}1$&GH	]$EF	QD0QR	GrD   r  c                       e Zd ZeZy)OrganizationalUnitNamesNrY   rZ   r[   r&   r   r=   rD   rA   r  r        !KrD   r  c                       e Zd ZeZy)TeletexOrganizationalUnitNamesN)rY   rZ   r[   r+   r   r=   rD   rA   r  r        KrD   r  c                       e Zd Zdeddifdeddifdedddfded	ddfd
edddfdedddfdedddfdedddfde	dddfg	Z
y)BuiltInStandardAttributesr   r   Tadministration_domain_namenetwork_addressr   r   terminal_identifierr	   private_domain_namer   r  r   r   r   numeric_user_identifierr   personal_namer   organizational_unit_namesr   N)rY   rZ   r[   r  r  r!   r&   r  r  r  r   r=   rD   rA   r  r    s    	z4&89	%'?*dAST	Mt+LM	aT1RS	 1t3TU	oA4/PQ	"Mt3TU	,QD(IJ	$&=A[_?`a
GrD   r  c                       e Zd ZdefdefgZy)BuiltInDomainDefinedAttributer   rV   Nr  r=   rD   rA   r  r    s    	!	/"GrD   r  c                       e Zd ZeZy)BuiltInDomainDefinedAttributesN)rY   rZ   r[   r  r   r=   rD   rA   r  r        /KrD   r  c                       e Zd ZdefdefgZy)TeletexDomainDefinedAttributer   rV   Nr  r=   rD   rA   r  r    s    		- GrD   r  c                       e Zd ZeZy)TeletexDomainDefinedAttributesN)rY   rZ   r[   r  r   r=   rD   rA   r  r    r  rD   r  c                       e Zd ZdefdefgZy)PhysicalDeliveryCountryNamer  r  Nr  r=   rD   rA   r  r    s    	-(	1MrD   r  c                       e Zd ZdefdefgZy)
PostalCodenumeric_codeprintable_codeNr  r=   rD   rA   r  r    s    	'	?+MrD   r  c                   (    e Zd ZdeddifdeddifgZy)PDSParameterr   r   Tr   N)rY   rZ   r[   r&   r+   r   r=   rD   rA   r  r    s'    	_z4.@A	=:t*<=GrD   r  c                       e Zd ZeZy)PrintableAddressNr  r=   rD   rA   r  r    r  rD   r  c                   (    e Zd ZdeddifdeddifgZy)UnformattedPostalAddressprintable_addressr   Tr   N)rY   rZ   r[   r  r+   r   r=   rD   rA   r  r    s(    	.T0BC	=:t*<=GrD   r  c                   *    e Zd ZdeddifdedddfgZy)	E1634Addressnumberr   r   sub_addressr	   Tr   N)rY   rZ   r[   r!   r   r=   rD   rA   r  r    s&    	=:q/2	A4'HIGrD   r  c                       e Zd ZeZy)
NAddressesN)rY   rZ   r[   r$   r   r=   rD   rA   r  r        KrD   r  c                   F    e Zd Zdedddfdedddfdedddfd	ed
difgZy)PresentationAddress
p_selectorr   Tr  
s_selectorr	   
t_selectorr   n_addressesr  r   N)rY   rZ   r[   r$   r  r   r=   rD   rA   r  r    sD    	{$EF	{$EF	{$EF	
ZO4	GrD   r  c                   "    e Zd ZdefdeddifgZy)ExtendedNetworkAddresse163_4_addresspsap_addressr   r   N)rY   rZ   r[   r  r  r   r=   rD   rA   r  r  #  s     	<(	,z1o>MrD   r  c                       e Zd ZdddddddZy)	TerminalTypetelexr   g3_facsimileg4_facsimileia5_terminalvideotex)r   r   r   r   r   r   Nr   r=   rD   rA   r  r  *  s    DrD   r  c                       e Zd Zi ddddddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)Zy*)+ExtensionAttributeTyper	   r   r   teletex_common_namer   teletex_organization_namer   teletex_personal_namer   teletex_organization_unit_namesr   !teletex_domain_defined_attributesr   pds_namer   physical_delivery_country_name	   r   
   physical_delivery_office_name   physical_delivery_office_numberr9   extension_of_address_components   physical_delivery_personal_name   #physical_delivery_organization_name   .extension_physical_delivery_address_componentsr   unformatted_postal_address   r   post_office_box_addressposte_restante_addressunique_postal_namelocal_postal_attributesextended_network_addressterminal_type)   r:               Nr   r=   rD   rA   r  r  5  s    	=	  	
& 	
"	
 	
, 	
. 	
: 	
+ 	
= 	+ 	- 	- 	- 	1 	<  	(!" 	#$ &$ %&/DrD   r  c                       e Zd ZdeddifdeddifgZdZi ded	ed
ede	de
dedededededededededededeeeeeeedZy)ExtensionAttributeextension_attribute_typer   r   extension_attribute_valuer  r	   )r  r  r   r  r  r  r  r  r  r  r   r  r  r  r  r  r  r  r   )r  r	  r
  r  r  r  N)rY   rZ   r[   r  r   r   r?  r&   r+   r  r  r  r  r  r  r  r  r  r@  r=   rD   rA   r  r  Q  s   	#%;j!_M	$cJ?;G
 JI} 	$] 	 !4	
 	*+I 	,-K 	O 	)*E 	z 	( 	*< 	*< 	*< 	.| 	9,  	%&>!" 	,#$ $0".*#/$:%/JrD   r  c                       e Zd ZeZy)ExtensionAttributesN)rY   rZ   r[   r  r   r=   rD   rA   r  r  s      $KrD   r  c                   .    e Zd ZdefdeddifdeddifgZy)	ORAddressbuilt_in_standard_attributes"built_in_domain_defined_attributesr   Textension_attributesN)rY   rZ   r[   r  r  r  r   r=   rD   rA   r  r  w  s4    	')BC	-/MPZ\`Oab	!4z46HIGrD   r  c                   *    e Zd ZdedddfdeddifgZy)	EDIPartyNamename_assignerr   Tr   
party_namer   r	   N)rY   rZ   r[   r   r   r=   rD   rA   r   r     s&    	/t+LM	Q8GrD   r   c                       e Zd Zdeddifdeddifdeddifdedd	ifd
eddifdeddifde	ddifde
ddifdeddifg	Zd Zd Zy)GeneralName
other_namer   r   rfc822_namer	   dns_namer   x400_addressr   directory_namer  r   edi_party_namer   uniform_resource_identifierr   
ip_addressr   registered_idr   c                     | |k(   S r<   r=   r>   s     rA   rB   zGeneralName.__ne__  rC   rD   c                    | j                   dv rt        t        d| j                               |j                   dv rt        t        d|j                               | j                   |j                   k7  ry| j                  |j                  k(  S )z
        Does not support other_name, x400_address or edi_party_name

        :param other:
            The other GeneralName to compare to

        :return:
            A boolean
        )r%  r(  r*  zr
                Comparison is not supported for GeneralName objects of
                choice %s
                za
                Comparison is not supported for GeneralName objects of choice
                %sF)r   r   r
   ru  r>   s     rA   rI   zGeneralName.__eq__  s     99HHV 		   ::IIV 

	   99

"{{ell**rD   N)rY   rZ   r[   r  rl   r7   r  r  r   r^   r   r"   r   rB   rI   r=   rD   rA   r$  r$    s    	{ZO4	z1o6	Wz1o.	ZO4	4*a1	<*a9	&j!_=	y:q/2	*ZO<
M!+rD   r$  c                       e Zd ZeZy)GeneralNamesN)rY   rZ   r[   r$  r   r=   rD   rA   r1  r1    r  rD   r1  c                       e Zd ZdefdefgZy)Timeutc_timegeneral_timeN)rY   rZ   r[   r-   r   r   r=   rD   rA   r3  r3    s    	W	)MrD   r3  c                       e Zd ZdefdefgZy)Validityr   r   N)rY   rZ   r[   r3  r   r=   rD   rA   r7  r7    s    	t	dGrD   r7  c                   (    e Zd ZdeddifdeddifgZy)BasicConstraintscadefaultFpath_len_constraintr   TN)rY   rZ   r[   r   r   r   r=   rD   rA   r9  r9    s'    	wE*+	*d);<GrD   r9  c                   :    e Zd ZdedddfdedddfdedddfgZy	)
AuthorityKeyIdentifierkey_identifierr   Tr   authority_cert_issuerr	   authority_cert_serial_numberr   N)rY   rZ   r[   r$   r1  r   r   r=   rD   rA   r>  r>    s6    	;QD(IJ	 ,QD0QR	'qd2STGrD   r>  c                   (    e Zd ZdeddifdeddifgZy)DistributionPointName	full_namer   r   name_relative_to_crl_issuerr	   N)rY   rZ   r[   r1  rB  r   r=   rD   rA   rC  rC    s'    	lZO4	&(AJPQ?SMrD   rC  c            
       $    e Zd Zddddddddd	d
	Zy)ReasonFlagsunusedkey_compromiseca_compromiseaffiliation_changed
supersededcessation_of_operationcertificate_holdprivilege_withdrawnaa_compromiser   Nr   r=   rD   rA   rG  rG    s$     # 
DrD   rG  c                   2    e Zd ZdefdedddfdedddfgZy	)
GeneralSubtreebaseminimumr   r   r;  maximumr	   Tr   N)rY   rZ   r[   r$  r   r   r=   rD   rA   rR  rR    s/    		G!:;	G!>?GrD   rR  c                       e Zd ZeZy)GeneralSubtreesN)rY   rZ   r[   rR  r   r=   rD   rA   rX  rX    s     KrD   rX  c                   ,    e Zd ZdedddfdedddfgZy)NameConstraintspermitted_subtreesr   Tr   excluded_subtreesr	   N)rY   rZ   r[   rX  r   r=   rD   rA   rZ  rZ    s'    	QD0QR	oA4/PQGrD   rZ  c                   N    e Zd Zdedddfdedddfded	ddfgZd
Zed        Z	y)DistributionPointdistribution_pointr   Tr  reasonsr	   r   
crl_issuerr   Fc                 T   | j                   du rd| _         | d   }|j                  dk7  rt        t        d            |j                  D ]Q  }|j                  dk(  s|j
                  }|j                         j                  d      s?|| _          | j                   S  | j                   S )z_
        :return:
            None or a unicode string of the distribution point's URL
        FNr_  rD  z
                    CRL distribution points that are relative to the issuer are
                    not supported
                    r+  zhttp://zhttps://zldap://zldaps://)_urlr   r   r
   ru  rd   rH   rO   )r?   r   general_nameurls       rA   rf  zDistributionPoint.url
  s     99DI,-DyyK' "   !% $$(EE&--Cyy{--.\]$'	yy yyrD   N)
rY   rZ   r[   rC  rG  r1  r   rd  r   rf  r=   rD   rA   r^  r^    sQ    	41RV6WX	KaT!BC	|!%FGG D rD   r^  c                       e Zd ZeZy)CRLDistributionPointsN)rY   rZ   r[   r^  r   r=   rD   rA   rh  rh  &      #KrD   rh  c                   (    e Zd ZdefdefdefdefgZy)DisplayTextr   visible_stringr   r   N)rY   rZ   r[   r   r/   r   r.   r   r=   rD   rA   rk  rk  *  s)    	y!	=)	y!	
#	MrD   rk  c                       e Zd ZeZy)NoticeNumbersNrY   rZ   r[   r   r   r=   rD   rA   rn  rn  3      KrD   rn  c                       e Zd ZdefdefgZy)NoticeReferenceorganizationnotice_numbersN)rY   rZ   r[   rk  rn  r   r=   rD   rA   rr  rr  7  s    	%	=)GrD   rr  c                   (    e Zd ZdeddifdeddifgZy)
UserNotice
notice_refr   Texplicit_textN)rY   rZ   r[   rr  rk  r   r=   rD   rA   rv  rv  >  s'    	T(:;	+
D'9:GrD   rv  c                       e Zd ZdddZy)PolicyQualifierId certification_practice_statementuser_notice)z1.3.6.1.5.5.7.2.1z1.3.6.1.5.5.7.2.2Nr   r=   rD   rA   rz  rz  E  s    ?*DrD   rz  c                   *    e Zd ZdefdefgZdZeedZ	y)PolicyQualifierInfopolicy_qualifier_id	qualifier)r  r  )r{  r|  N)
rY   rZ   r[   rz  r   r   r?  r   rv  r@  r=   rD   rA   r~  r~  L  s.    	 12	cG
 5I,5!JrD   r~  c                       e Zd ZeZy)PolicyQualifierInfosN)rY   rZ   r[   r~  r   r=   rD   rA   r  r  Y      %KrD   r  c                       e Zd ZddiZy)PolicyIdentifierz2.5.29.32.0
any_policyNr   r=   rD   rA   r  r  ]  s    |DrD   r  c                   "    e Zd ZdefdeddifgZy)PolicyInformationpolicy_identifierpolicy_qualifiersr   TN)rY   rZ   r[   r  r  r   r=   rD   rA   r  r  c  s"    	./	2Z4FGGrD   r  c                       e Zd ZeZy)CertificatePoliciesN)rY   rZ   r[   r  r   r=   rD   rA   r  r  j  ri  rD   r  c                       e Zd ZdefdefgZy)PolicyMappingissuer_domain_policysubject_domain_policyN)rY   rZ   r[   r  r   r=   rD   rA   r  r  n  s    	!12	 "23GrD   r  c                       e Zd ZeZy)PolicyMappingsN)rY   rZ   r[   r  r   r=   rD   rA   r  r  u  r  rD   r  c                   ,    e Zd ZdedddfdedddfgZy)PolicyConstraintsrequire_explicit_policyr   Tr   inhibit_policy_mappingr	   NrY   rZ   r[   r   r   r=   rD   rA   r  r  y  s'    	"G!-NO	!7,MNGrD   r  c                      e Zd Zi ddddddddd	d
dddddddddddddddddddddd d!d"i d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDi dEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfi dgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~ddddddddddi ddddddddddddddddddddddddddddddddddZy)KeyPurposeIdz2.5.29.37.0any_extended_key_usagez1.3.6.1.5.5.7.3.1server_authz1.3.6.1.5.5.7.3.2client_authz1.3.6.1.5.5.7.3.3code_signingz1.3.6.1.5.5.7.3.4email_protectionz1.3.6.1.5.5.7.3.5ipsec_end_systemz1.3.6.1.5.5.7.3.6ipsec_tunnelz1.3.6.1.5.5.7.3.7
ipsec_userz1.3.6.1.5.5.7.3.8time_stampingz1.3.6.1.5.5.7.3.9ocsp_signingz1.3.6.1.5.5.7.3.10dvcsz1.3.6.1.5.5.7.3.13eap_over_pppz1.3.6.1.5.5.7.3.14eap_over_lanz1.3.6.1.5.5.7.3.15scvp_serverz1.3.6.1.5.5.7.3.16scvp_clientz1.3.6.1.5.5.7.3.17	ipsec_ikez1.3.6.1.5.5.7.3.18	capwap_acz1.3.6.1.5.5.7.3.19
capwap_wtpz1.3.6.1.5.5.7.3.20
sip_domainz1.3.6.1.5.5.7.3.21secure_shell_clientz1.3.6.1.5.5.7.3.22secure_shell_serverz1.3.6.1.5.5.7.3.23send_routerz1.3.6.1.5.5.7.3.24send_proxied_routerz1.3.6.1.5.5.7.3.25
send_ownerz1.3.6.1.5.5.7.3.26send_proxied_ownerz1.3.6.1.5.5.7.3.27cmc_caz1.3.6.1.5.5.7.3.28cmc_raz1.3.6.1.5.5.7.3.29cmc_archivez1.3.6.1.5.5.7.3.30bgpspec_routerz1.3.6.1.5.5.8.2.2ike_intermediatez1.3.6.1.4.1.311.10.3.1microsoft_trust_list_signingz1.3.6.1.4.1.311.10.3.2microsoft_time_stamp_signingz1.3.6.1.4.1.311.10.3.3microsoft_server_gatedz1.3.6.1.4.1.311.10.3.3.1microsoft_serializedz1.3.6.1.4.1.311.10.3.4microsoft_efsz1.3.6.1.4.1.311.10.3.4.1microsoft_efs_recoveryz1.3.6.1.4.1.311.10.3.5microsoft_whqlz1.3.6.1.4.1.311.10.3.6microsoft_nt5z1.3.6.1.4.1.311.10.3.7microsoft_oem_whqlz1.3.6.1.4.1.311.10.3.8microsoft_embedded_ntz1.3.6.1.4.1.311.10.3.9microsoft_root_list_signerz1.3.6.1.4.1.311.10.3.10!microsoft_qualified_subordinationz1.3.6.1.4.1.311.10.3.11microsoft_key_recoveryz1.3.6.1.4.1.311.10.3.12microsoft_document_signingz1.3.6.1.4.1.311.10.3.13microsoft_lifetime_signingz1.3.6.1.4.1.311.10.3.14 microsoft_mobile_device_softwarez1.3.6.1.4.1.311.20.2.2microsoft_smart_card_logonz1.2.840.113635.100.1.2apple_x509_basicz1.2.840.113635.100.1.3	apple_sslz1.2.840.113635.100.1.4apple_local_cert_genz1.2.840.113635.100.1.5apple_csr_genz1.2.840.113635.100.1.6apple_revocation_crlz1.2.840.113635.100.1.7apple_revocation_ocspz1.2.840.113635.100.1.8apple_smimez1.2.840.113635.100.1.9	apple_eapz1.2.840.113635.100.1.10apple_software_update_signingz1.2.840.113635.100.1.11apple_ipsecz1.2.840.113635.100.1.12apple_ichatz1.2.840.113635.100.1.13apple_resource_signingz1.2.840.113635.100.1.14apple_pkinit_clientz1.2.840.113635.100.1.15apple_pkinit_serverz1.2.840.113635.100.1.16apple_code_signingz1.2.840.113635.100.1.17apple_package_signingz1.2.840.113635.100.1.18apple_id_validationz1.2.840.113635.100.1.20apple_time_stampingz1.2.840.113635.100.1.21apple_revocationz1.2.840.113635.100.1.22apple_passbook_signingz1.2.840.113635.100.1.23apple_mobile_storez1.2.840.113635.100.1.24apple_escrow_servicez1.2.840.113635.100.1.25apple_profile_signerz1.2.840.113635.100.1.26apple_qa_profile_signerz1.2.840.113635.100.1.27apple_test_mobile_storez1.2.840.113635.100.1.28apple_otapki_signerz1.2.840.113635.100.1.29apple_test_otapki_signerz1.2.840.113625.100.1.30)apple_id_validation_record_signing_policyz1.2.840.113625.100.1.31apple_smp_encryptionz1.2.840.113625.100.1.32apple_test_smp_encryptionz1.2.840.113635.100.1.33apple_server_authenticationz1.2.840.113635.100.1.34apple_pcs_escrow_servicez2.16.840.1.101.3.6.8piv_card_authenticationz2.16.840.1.101.3.6.7piv_content_signingz1.3.6.1.5.2.3.4pkinit_kpclientauthz1.3.6.1.5.2.3.5pkinit_kpkdcz1.2.840.113583.1.1.5adobe_authentic_documents_trustz2.16.840.1.101.3.8.7fpki_pivi_content_signingNr   r=   rD   rA   r  r    s   l/l 	]l 	]	l
 	^l 	/l 	/l 	^l 	\l 	_l 	^l 	fl 	nl  	n!l$ 	m%l& 	m'l* 	k+l. 	k/l0 	l1l4 	l5l8 	39l: 	3;l> 	m?l@ 	3AlB 	lClD 	2ElH 	hIlJ 	hKlL 	mMlP 	.QlT 	/UlZ 	!"@[l\ 	!"@]l^ 	!":_l` 	#$:alb 	!/cld 	#$<elf 	!"2glh 	!/ilj 	!"6kll 	!"9mln 	!">olp 	"#Fqlr 	"#;slt 	"#?ulv 	"#?wlx 	"#Eyl| 	!">}lD 	!"4ElF 	!+GlH 	!"8IlJ 	!/KlL 	!"8MlN 	!"9OlP 	!-QlR 	!+SlT 	"#BUlV 	"=WlX 	"=YlZ 	"#;[l\ 	"#8]l^ 	"#8_l` 	"#7alb 	"#:cld 	"#8elf 	"#8glh 	"#5ilj 	"#;kll 	"#7mln 	"#9olp 	"#9qlr 	"#<slt 	"#<ulv 	"#8wlx 	"#=ylz 	"#N{l| 	"#9}l~ 	"#>l@ 	"#@AlB 	"#=ClF 	 9GlH 	 5IlL 	0MlN 	>OlR 	 ASlV 	 ;WlDrD   r  c                       e Zd ZeZy)ExtKeyUsageSyntaxNrY   rZ   r[   r  r   r=   rD   rA   r  r        KrD   r  c                       e Zd ZdddddZy)AccessMethodocsp
ca_issuersr  ca_repository)z1.3.6.1.5.5.7.48.1z1.3.6.1.5.5.7.48.2z1.3.6.1.5.5.7.48.3z1.3.6.1.5.5.7.48.5Nr   r=   rD   rA   r  r    s    $*--	DrD   r  c                       e Zd ZdefdefgZy)AccessDescriptionaccess_methodaccess_locationN)rY   rZ   r[   r  r$  r   r=   rD   rA   r  r    s    	,'	K(GrD   r  c                       e Zd ZeZy)AuthorityInfoAccessSyntaxNrY   rZ   r[   r  r   r=   rD   rA   r  r    ri  rD   r  c                       e Zd ZeZy)SubjectInfoAccessSyntaxNr  r=   rD   rA   r   r     ri  rD   r   c                       e Zd ZeZy)FeaturesNro  r=   rD   rA   r  r    rp  rD   r  c                       e Zd ZdefdefgZy)EntrustVersionInfoentrust_versentrust_info_flagsN)rY   rZ   r[   r   r   r   r=   rD   rA   r  r    s    	'	y)GrD   r  c            	       "    e Zd Zddddddddd	Zy
)NetscapeCertificateType
ssl_client
ssl_serveremailobject_signingreservedssl_caemail_caobject_signing_ca)r   r	   r   r   r   r   r   r   Nr   r=   rD   rA   r  r    s!    	DrD   r  c                       e Zd ZddddZy)Versionv1v2v3r   r	   r   Nr   r=   rD   rA   r  r  %  s    DrD   r  c                   "    e Zd ZdefdefdefgZy)TPMSpecificationr   levelrevisionN)rY   rZ   r[   r.   r   r   r=   rD   rA   r  r  -  s!    	:	'	WGrD   r  c                       e Zd ZeZy)SetOfTPMSpecificationN)rY   rZ   r[   r  r   r=   rD   rA   r  r  5  s    "KrD   r  c                   "    e Zd ZdefdefdefgZy)TCGSpecificationVersionmajor_versionminor_versionr  Nr  r=   rD   rA   r  r  9  s!    	'"	'"	WGrD   r  c                       e Zd ZdefdefgZy)TCGPlatformSpecificationversionplatform_classN)rY   rZ   r[   r  r$   r   r=   rD   rA   r"  r"  A  s    	+,	;'GrD   r"  c                       e Zd ZeZy)SetOfTCGPlatformSpecificationN)rY   rZ   r[   r"  r   r=   rD   rA   r&  r&  H  s    *KrD   r&  c                       e Zd ZdddddZy)EKGenerationTypeinternalinjectedinternal_revocableinjected_revocable)r   r	   r   r   Nr   r=   rD   rA   r(  r(  L  s    	DrD   r(  c                       e Zd ZddddZy)EKGenerationLocationr   r   ek_cert_signerr  Nr   r=   rD   rA   r.  r.  U      "DrD   r.  c                       e Zd ZddddZy)EKCertificateGenerationLocationr   r   r/  r  Nr   r=   rD   rA   r2  r2  ]  r0  rD   r2  c                        e Zd ZddddddddZy	)
EvaluationAssuranceLevellevel1level2level3level4level5level6level7)r	   r   r   r   r   r   r   Nr   r=   rD   rA   r4  r4  e  s    DrD   r4  c                       e Zd ZddddZy)EvaluationStatusdesigned_to_meetevaluation_in_progressevaluation_completedr  Nr   r=   rD   rA   r=  r=  q  s    #!DrD   r=  c                       e Zd ZddddZy)StrengthOfFunctionbasicmediumhighr  Nr   r=   rD   rA   rB  rB  y  s    DrD   rB  c                   .    e Zd ZdefdeddifdeddifgZy)URIReferencer+  hash_algorithmr   T
hash_valueN)rY   rZ   r[   r   r   r   r   r=   rD   rA   rG  rG    s/    	&	2	?Z,>?	y:t"45GrD   rG  c                   t    e Zd Zdefdefdefdeddifdedd	d
fdedd	d
fde	dd	d
fdedd	d
fde	dd	d
fg	Z
y)CommonCriteriaMeasuresr#  assurance_levelevaluation_statusplusr;  Fstrengh_of_functionr   Tr   profile_oidr	   profile_urlr   
target_oidr   
target_urir   N)rY   rZ   r[   r   r4  r=  r   rB  r"   rG  r   r=   rD   rA   rK  rK    s    	I	45	./	9e,-	 2PT4UV	(qd*KL	1$&GH	'aT)JK	|!%FG
GrD   rK  c                       e Zd ZdddddZy)SecurityLevelr5  r6  r7  r8  )r	   r   r   r   Nr   r=   rD   rA   rU  rU    s    	DrD   rU  c                   (    e Zd ZdefdefdeddifgZy)	FIPSLevelr#  r  rN  r;  FN)rY   rZ   r[   r   rU  r   r   r=   rD   rA   rW  rW    s(    	I	- 	9e,-GrD   rW  c                       e Zd Zdeddifdeddifdeddd	fd
eddd	fdeddd	fdeddd	fde	ddd	fdedddfde
ddifg	Zy)TPMSecurityAssertionsr#  r;  r  field_upgradableFek_generation_typer   Tr   ek_generation_locationr	   "ek_certificate_generation_locationr   cc_infor   
fips_levelr   iso_9000_certifiedr   rU  iso_9000_urir   N)rY   rZ   r[   r  r   r(  r.  r2  rK  rW  r   r   r=   rD   rA   rY  rY    s    	Gi./	Wy%&89	/aT1RS	!#7aUY9Z[	-/N]^lpPqr	*,MN	yqd"CD	wQ5(IJ	Z$67
GrD   rY  c                       e Zd ZeZy)SetOfTPMSecurityAssertionsN)rY   rZ   r[   rY  r   r=   rD   rA   rc  rc    s    'KrD   rc  c                   &    e Zd Zddddddddd	d
d
Zy)SubjectDirectoryAttributeIdsupported_algorithmstpm_specificationtcg_platform_specificationtpm_security_assertionspda_date_of_birthpda_place_of_birth
pda_genderpda_country_of_citizenshippda_country_of_residenceentrust_user_role)
z2.5.4.52z2.23.133.2.16z2.23.133.2.17z2.23.133.2.18z1.3.6.1.5.5.7.9.1z1.3.6.1.5.5.7.9.2z1.3.6.1.5.5.7.9.3z1.3.6.1.5.5.7.9.4z1.3.6.1.5.5.7.9.5z1.2.840.113533.7.68.29Nr   r=   rD   rA   re  re    s)     +,5201)97"5DrD   re  c                       e Zd ZeZy)SetOfGeneralizedTimeN)rY   rZ   r[   r   r   r=   rD   rA   rq  rq    r  rD   rq  c                       e Zd ZeZy)SetOfDirectoryStringN)rY   rZ   r[   r   r   r=   rD   rA   rs  rs    r  rD   rs  c                       e Zd ZeZy)SetOfPrintableStringNr  r=   rD   rA   ru  ru    r  rD   ru  c                   2    e Zd ZdefdedddfdedddfgZy)	SupportedAlgorithmalgorithm_identifierintended_usager   Tr  intended_certificate_policiesr	   N)rY   rZ   r[   r   r   r  r   r=   rD   rA   rw  rw    s2    	!78	8!%FG	(*=A[_?`aGrD   rw  c                       e Zd ZeZy)SetOfSupportedAlgorithmN)rY   rZ   r[   rw  r   r=   rD   rA   r|  r|    r  rD   r|  c            
       F    e Zd ZdefdefgZdZeee	e
eeeeed	Zd ZdeiZy)SubjectDirectoryAttributer   r   )r   r   )	rf  rg  rh  ri  rj  rk  rl  rm  rn  c                 f    | d   j                   }|| j                  v r| j                  |   S t        S )Nr   )rd   r@  r*   )r?   type_s     rA   _values_specz&SubjectDirectoryAttribute._values_spec  s1    V##DOO#??5))rD   N)rY   rZ   r[   re  r   r   r?  r|  r  r&  rc  rq  rs  ru  r@  r  _spec_callbacksr=   rD   rA   r~  r~    sU    	,-	3G
 #I 72&C#=12*&:$8
J 	,OrD   r~  c                       e Zd ZeZy)SubjectDirectoryAttributesN)rY   rZ   r[   r~  r   r=   rD   rA   r  r    s    +KrD   r  c            	           e Zd Zi ddddddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*Zy+),ExtensionIdz2.5.29.9subject_directory_attributesz	2.5.29.14r?  z	2.5.29.15	key_usagez	2.5.29.16private_key_usage_periodz	2.5.29.17subject_alt_namez	2.5.29.18issuer_alt_namez	2.5.29.19basic_constraintsz	2.5.29.30name_constraintsz	2.5.29.31crl_distribution_pointsz	2.5.29.32certificate_policiesz	2.5.29.33policy_mappingsz	2.5.29.35authority_key_identifierz	2.5.29.36policy_constraintsz	2.5.29.37extended_key_usagez	2.5.29.46freshest_crlz	2.5.29.54inhibit_any_policyz1.3.6.1.5.5.7.1.1authority_information_accesssubject_information_accesstls_featureocsp_no_checkentrust_version_extensionnetscape_certificate_type!signed_certificate_timestamp_listmicrosoft_enroll_certtype)z1.3.6.1.5.5.7.1.11z1.3.6.1.5.5.7.1.24z1.3.6.1.5.5.7.48.1.5z1.2.840.113533.7.65.0z2.16.840.1.113730.1.1z1.3.6.1.4.1.11129.2.4.2z1.3.6.1.4.1.311.20.2Nr   r=   rD   rA   r  r    s    2% 	[ 	/	
 	' 	& 	( 	' 	. 	+ 	& 	/ 	) 	) 	^  	)!" 	;#$ ;+ /!<!<#F ;7DrD   r  c            	           e Zd ZdefdeddifdefgZdZi dede	d	e
d
edededededededededededededeeeeeee	edZy)	Extensionextn_idcriticalr;  F
extn_value)r  r  r  r?  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  )r  r  r  r  r  r  r  N)rY   rZ   r[   r  r   r%   r   r?  r  r$   r   r   r1  r9  rZ  rh  r  r  r>  r  r  r   r  r   r  r    r  r  r   r@  r=   rD   rA   r  r  '  s'   	K 	Wy%01	*+G *I&(B+ 	X 	#$9	
 	L 	< 	- 	O 	"#8 	 3 	> 	#$: 	/ 	/ 	-  	g!" 	'(A#$ '>%7%<-8 &/5JrD   r  c                       e Zd ZeZy)
ExtensionsN)rY   rZ   r[   r  r   r=   rD   rA   r  r  M  r   rD   r  c                   l    e Zd Zdedddfdefdefdefdefd	efd
efde	dddfde	dddfde
dddfg
Zy)TbsCertificater#  r   r  )r  r;  r   	signatureissuervaliditysubjectsubject_public_key_infoissuer_unique_idr	   Tr   subject_unique_idr   
extensionsr   r  N)rY   rZ   r[   r  r   r   r  r7  r1   r#   r  r   r=   rD   rA   r  r  Q  sv    	G!=>	'"	+,	4	X	D	"M2	^!-NO	n1$.OP	zt#DEGrD   r  c                      e Zd ZdefdefdefgZdZdZdZ	dZ
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&d Z'e(d        Z)e(d        Z*e(d	        Z+e(d
        Z,e(d        Z-e(d        Z.e(d        Z/e(d        Z0e(d        Z1e(d        Z2e(d        Z3e(d        Z4e(d        Z5e(d        Z6e(d        Z7e(d        Z8e(d        Z9e(d        Z:e(d        Z;e(d        Z<e(d        Z=e(d        Z>e(d        Z?e(d        Z@e(d        ZAe(d         ZBe(d!        ZCe(d"        ZDe(d#        ZEe(d$        ZFe(d%        ZGe(d&        ZHe(d'        ZIe(d(        ZJe(d)        ZKe(d*        ZLd+ ZMe(d,        ZNe(d-        ZOe(d.        ZPe(d/        ZQe(d0        ZRe(d1        ZSe(d2        ZTe(d3        ZUe(d4        ZVe(d5        ZWe(d6        ZXd7 ZYd8 ZZd9 Z[y):Certificatetbs_certificatesignature_algorithmsignature_valueFNc                    t               | _        | d   d   D ]g  }|d   j                  }d|z  }t        | |      rt	        | ||d   j
                         |d   j                  sM| j                  j                  |       i d| _        y)	zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r  r  r  z	_%s_valuer  r  TN)rX   _critical_extensionsrd   hasattrsetattrparsedadd_processed_extensions)r?   	extensionr   rq  s       rA   _set_extensionszCertificate._set_extensions  s     %(E!/0> 	4IY'..D(4/Nt^,ni.E.L.LM$++))--d3	4 &*"rD   c                 R    | j                   s| j                          | j                  S )z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r  r  r  rj   s    rA   critical_extensionszCertificate.critical_extensions  s%     ))  "(((rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to constrain the period over which the subject
        private key may be used

        :return:
            None or a PrivateKeyUsagePeriod object
        )r  r  _private_key_usage_period_valuerj   s    rA   private_key_usage_period_valuez*Certificate.private_key_usage_period_value  %     ))  "333rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to contain additional identification attributes
        about the subject.

        :return:
            None or a SubjectDirectoryAttributes object
        )r  r  #_subject_directory_attributes_valuerj   s    rA   "subject_directory_attributes_valuez.Certificate.subject_directory_attributes_value  %     ))  "777rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to help in creating certificate validation paths.
        It contains an identifier that should generally, but is not guaranteed
        to, be unique.

        :return:
            None or an OctetString object
        )r  r  _key_identifier_valuerj   s    rA   key_identifier_valuez Certificate.key_identifier_value  s%     ))  ")))rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to define the purpose of the public key
        contained within the certificate.

        :return:
            None or a KeyUsage
        )r  r  _key_usage_valuerj   s    rA   key_usage_valuezCertificate.key_usage_value  s%     ))  "$$$rD   c                 R    | j                   s| j                          | j                  S )aT  
        This extension allows for additional names to be associate with the
        subject of the certificate. While it may contain a whole host of
        possible names, it is usually used to allow certificates to be used
        with multiple different domain names.

        :return:
            None or a GeneralNames object
        )r  r  _subject_alt_name_valuerj   s    rA   subject_alt_name_valuez"Certificate.subject_alt_name_value  s%     ))  "+++rD   c                 R    | j                   s| j                          | j                  S )z
        This extension allows associating one or more alternative names with
        the issuer of the certificate.

        :return:
            None or an x509.GeneralNames object
        )r  r  _issuer_alt_name_valuerj   s    rA   issuer_alt_name_valuez!Certificate.issuer_alt_name_value  s%     ))  "***rD   c                 R    | j                   s| j                          | j                  S )a'  
        This extension is used to determine if the subject of the certificate
        is a CA, and if so, what the maximum number of intermediate CA certs
        after this are, before an end-entity certificate is found.

        :return:
            None or a BasicConstraints object
        )r  r  _basic_constraints_valuerj   s    rA   basic_constraints_valuez#Certificate.basic_constraints_value  s%     ))  ",,,rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used in CA certificates, and is used to limit the
        possible names of certificates issued.

        :return:
            None or a NameConstraints object
        )r  r  _name_constraints_valuerj   s    rA   name_constraints_valuez"Certificate.name_constraints_value	  s%     ))  "+++rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to help in locating the CRL for this certificate.

        :return:
            None or a CRLDistributionPoints object
            extension
        )r  r  _crl_distribution_points_valuerj   s    rA   crl_distribution_points_valuez)Certificate.crl_distribution_points_value	  s%     ))  "222rD   c                 R    | j                   s| j                          | j                  S )a;  
        This extension defines policies in CA certificates under which
        certificates may be issued. In end-entity certificates, the inclusion
        of a policy indicates the issuance of the certificate follows the
        policy.

        :return:
            None or a CertificatePolicies object
        )r  r  _certificate_policies_valuerj   s    rA   certificate_policies_valuez&Certificate.certificate_policies_value*	  s%     ))  "///rD   c                 R    | j                   s| j                          | j                  S )z
        This extension allows mapping policy OIDs to other OIDs. This is used
        to allow different policies to be treated as equivalent in the process
        of validation.

        :return:
            None or a PolicyMappings object
        )r  r  _policy_mappings_valuerj   s    rA   policy_mappings_valuez!Certificate.policy_mappings_value:	  s%     ))  "***rD   c                 R    | j                   s| j                          | j                  S )z
        This extension helps in identifying the public key with which to
        validate the authenticity of the certificate.

        :return:
            None or an AuthorityKeyIdentifier object
        )r  r  _authority_key_identifier_valuerj   s    rA   authority_key_identifier_valuez*Certificate.authority_key_identifier_valueI	  r  rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to control if policy mapping is allowed and
        when policies are required.

        :return:
            None or a PolicyConstraints object
        )r  r  _policy_constraints_valuerj   s    rA   policy_constraints_valuez$Certificate.policy_constraints_valueW	  %     ))  "---rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to help locate any available delta CRLs

        :return:
            None or an CRLDistributionPoints object
        )r  r  _freshest_crl_valuerj   s    rA   freshest_crl_valuezCertificate.freshest_crl_valuee	  s%     ))  "'''rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to prevent mapping of the any policy to
        specific requirements

        :return:
            None or a Integer object
        )r  r  _inhibit_any_policy_valuerj   s    rA   inhibit_any_policy_valuez$Certificate.inhibit_any_policy_valuer	  r  rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to define additional purposes for the public key
        beyond what is contained in the basic constraints.

        :return:
            None or an ExtKeyUsageSyntax object
        )r  r  _extended_key_usage_valuerj   s    rA   extended_key_usage_valuez$Certificate.extended_key_usage_value	  r  rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to locate the CA certificate used to sign this
        certificate, or the OCSP responder for this certificate.

        :return:
            None or an AuthorityInfoAccessSyntax object
        )r  r  #_authority_information_access_valuerj   s    rA   "authority_information_access_valuez.Certificate.authority_information_access_value	  r  rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to access information about the subject of this
        certificate.

        :return:
            None or a SubjectInfoAccessSyntax object
        )r  r  !_subject_information_access_valuerj   s    rA    subject_information_access_valuez,Certificate.subject_information_access_value	  s%     ))  "555rD   c                 R    | j                   s| j                          | j                  S )z
        This extension is used to list the TLS features a server must respond
        with if a client initiates a request supporting them.

        :return:
            None or a Features object
        )r  r  _tls_feature_valuerj   s    rA   tls_feature_valuezCertificate.tls_feature_value	  s%     ))  "&&&rD   c                 R    | j                   s| j                          | j                  S )a-  
        This extension is used on certificates of OCSP responders, indicating
        that revocation information for the certificate should never need to
        be verified, thus preventing possible loops in path validation.

        :return:
            None or a Null object (if present)
        )r  r  _ocsp_no_check_valuerj   s    rA   ocsp_no_check_valuezCertificate.ocsp_no_check_value	  s%     ))  "(((rD   c                      | d   j                   S )zE
        :return:
            A byte string of the signature
        r  rd   rj   s    rA   r  zCertificate.signature	  s     %&---rD   c                      | d   j                   S )zj
        :return:
            A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
        r  )signature_algorj   s    rA   r  zCertificate.signature_algo	  s     )*999rD   c                      | d   j                   S )z
        :return:
            A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
            "sha384", "sha512", "sha512_224", "sha512_256"
        r  )	hash_algorj   s    rA   r  zCertificate.hash_algo	  s     )*444rD   c                     | d   d   S )zT
        :return:
            The PublicKeyInfo object for this certificate
        r  r  r=   rj   s    rA   
public_keyzCertificate.public_key	  s     %&'@AArD   c                     | d   d   S )zZ
        :return:
            The Name object for the subject of this certificate
        r  r  r=   rj   s    rA   r  zCertificate.subject	  s     %&y11rD   c                     | d   d   S )zY
        :return:
            The Name object for the issuer of this certificate
        r  r  r=   rj   s    rA   r  zCertificate.issuer	  s     %&x00rD   c                 &    | d   d   j                   S )zT
        :return:
            An integer of the certificate's serial number
        r  r   r  rj   s    rA   r   zCertificate.serial_number	  s     %&7>>>rD   c                 H    | j                   sy| j                   j                  S )z
        :return:
            None or a byte string of the certificate's key identifier from the
            key identifier extension
        N)r  rd   rj   s    rA   r?  zCertificate.key_identifier
  s"     ((((///rD   c                     | j                   C| j                  j                  dz   t        | j                        j                  d      z   | _         | j                   S )z
        :return:
            A byte string of the SHA-256 hash of the issuer concatenated with
            the ascii character ":", concatenated with the serial number as
            an ascii string
           :rt   )_issuer_serialr  r  r   r   rP   rj   s    rA   issuer_serialzCertificate.issuer_serial
  sO     &"&++"4"4t";gdFXFX>Y>`>`ah>i"iD"""rD   c                 ,    | d   d   d   j                   S )zd
        :return:
            A datetime of latest time when the certificate is still valid
        r  r  r   r  rj   s    rA   not_valid_afterzCertificate.not_valid_after!
  s      %&z2;?FFFrD   c                 ,    | d   d   d   j                   S )zd
        :return:
            A datetime of the earliest time when the certificate is valid
        r  r  r   r  rj   s    rA   not_valid_beforezCertificate.not_valid_before)
  s      %&z2<@GGGrD   c                 N    | j                   sy| j                   d   j                  S )z
        :return:
            None or a byte string of the key_identifier from the authority key
            identifier extension
        Nr?  )r  rd   rj   s    rA   r  z$Certificate.authority_key_identifier1
  s(     22223CDKKKrD   c                 ~   | j                   du r| j                  }|r|d   j                  r| j                  d   d   j                  }|j	                         }| j                  d   j                  }|j
                  dz   t        |      j                  d      z   | _         | j                   S d| _         | j                   S )a;  
        :return:
            None or a byte string of the SHA-256 hash of the isser from the
            authority key identifier extension concatenated with the ascii
            character ":", concatenated with the serial number from the
            authority key identifier extension as an ascii string
        Fr@  r   rA  r  rt   N)_authority_issuer_serialr  rd   ru  untagr  r   rP   )r?   akivr  authority_serials       rA   authority_issuer_serialz#Certificate.authority_issuer_serial>
  s     ((E166D45<<<<=TUVWX__#'#F#FGe#f#m#m 060DwO_G`GgGghoGp0p- ,,, 15-,,,rD   c                 r    | j                    | j                  | j                        | _         | j                   S )z
        Returns complete CRL URLs - does not include delta CRLs

        :return:
            A list of zero or more DistributionPoint objects
        )_crl_distribution_points!_get_http_crl_distribution_pointsr  rj   s    rA   r  z#Certificate.crl_distribution_pointsT
  s6     ((0,0,R,RSWSuSu,vD),,,rD   c                 r    | j                    | j                  | j                        | _         | j                   S )z
        Returns delta CRL URLs - does not include complete CRLs

        :return:
            A list of zero or more DistributionPoint objects
        )_delta_crl_distribution_pointsr  r  rj   s    rA   delta_crl_distribution_pointsz)Certificate.delta_crl_distribution_pointsa
  s6     ..6262X2XY]YpYp2qD/222rD   c                     g }|g S |D ]R  }|d   }|t         u r|j                  dk(  r!|j                  D ]#  }|j                  dk(  s|j                  |       % T |S )a?  
        Fetches the DistributionPoint object for non-relative, HTTP CRLs
        referenced by the certificate

        :param crl_distribution_points:
            A CRLDistributionPoints object to grab the DistributionPoints from

        :return:
            A list of zero or more DistributionPoint objects
        r_  rE  r+  )r0   r   ru  rJ  )r?   r  rK  r_  distribution_point_namere  s         rA   r  z-Certificate._get_http_crl_distribution_pointsn
  s     "*I"9 
	6&89M&N#&$.&++/LL 7 > > 6$$(EEMM"456
	6 rD   c                    | j                   sg S g }| j                   D ]g  }|d   j                  dk(  s|d   }|j                  dk7  r+|j                  }|j                         j	                  d      sW|j                  |       i |S )zx
        :return:
            A list of zero or more unicode strings of the OCSP URLs for this
            cert
        r  r  r  r+  rc  )r  rd   r   rH   rO   rJ  )r?   rK  entrylocationrf  s        rA   	ocsp_urlszCertificate.ocsp_urls
  s     66I<< 	'E_%,,6 !23==$AAoo99;))*XYMM#&	' rD   c                 <   | j                   g | _         | j                  rk| j                  D ]P  }|j                  dk(  s|j                  | j                   vs,| j                   j	                  |j                         R | j                   S t        j                  d      }| j                  j                  D ]X  }|D ]Q  }|d   j                  dk(  s|d   j                  }|j                  |      s7| j                   j	                  |       S Z | j                   S )z
        :return:
            A list of unicode strings of valid domain names for the certificate.
            Wildcard certificates will have a domain in the form: *.example.com
        r'  zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r   r   rV   )
_valid_domainsr  r   rd   rJ  r'  compiler  ru  match)r?   re  patternrW  name_type_valuerV   s         rA   valid_domainszCertificate.valid_domains
  s    &"$D
 **$($?$? HL#((J6<;N;NVZViVi;i++22<3F3FGH$ """ **%pq<<.. BC+. B*6299]J$3G$<$C$CE&}}U3 $ 3 3 : :5 A	BB """rD   c                     | j                   Yg | _         | j                  rF| j                  D ]7  }|j                  dk(  s| j                   j                  |j                         9 | j                   S )zj
        :return:
            A list of unicode strings of valid IP addresses for the certificate
        r,  )
_valid_ipsr  r   rJ  rd   )r?   re  s     rA   	valid_ipszCertificate.valid_ips
  sg     ??" DO**$($?$? DL#((L8..|/B/BCD rD   c                 P    | j                   xr | j                   d   j                  S )zW
        :return;
            A boolean - if the certificate is marked as a CA
        r:  )r  rd   rj   s    rA   r:  zCertificate.ca
  s&     ++Y0L0LT0R0Y0YYrD   c                 N    | j                   sy| j                  d   j                  S )zT
        :return;
            None or an integer of the maximum path length
        Nr<  )r:  r  rd   rj   s    rA   max_path_lengthzCertificate.max_path_length
  s&     ww++,ABIIIrD   c                 n    | j                   | j                  | j                  k(  | _         | j                   S )zx
        :return:
            A boolean - if the certificate is self-issued, as defined by RFC
            5280
        )_self_issuedr  r  rj   s    rA   self_issuedzCertificate.self_issued
  s1     $ $ ;D   rD   c                    | j                   qd| _         | j                  r^| j                  rK| j                  sd| _         | j                   S | j                  | j                  k(  rd| _         | j                   S d| _         | j                   S )a  
        :return:
            A unicode string of "no" or "maybe". The "maybe" result will
            be returned if the certificate issuer and subject are the same.
            If a key identifier and authority key identifier are present,
            they will need to match otherwise "no" will be returned.

            To verify is a certificate is truly self-signed, the signature
            will need to be verified. See the certvalidator package for
            one possible solution.
        nomaybe)_self_signedr4  r?  r  rj   s    rA   self_signedzCertificate.self_signed
  s     $ $D&&88,3)
    	 66$:M:MM,3)     )0D%   rD   c                     | j                   6t        j                  | j                               j	                         | _         | j                   S )zk
        :return:
            The SHA-1 hash of the DER-encoded bytes of this complete certificate
        r  rj   s    rA   r  zCertificate.sha1  r  rD   c                 X    dj                  d t        | j                        D              S )z
        :return:
            A unicode string of the SHA-1 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r%  c              3   &   K   | ]	  }d |z    ywz%02XNr=   r`  cs     rA   ra  z/Certificate.sha1_fingerprint.<locals>.<genexpr>$  s     Eq
E   )r,  r   r  rj   s    rA   sha1_fingerprintzCertificate.sha1_fingerprint  s"     xxEM$)),DEEErD   c                     | j                   6t        j                  | j                               j	                         | _         | j                   S )zy
        :return:
            The SHA-256 hash of the DER-encoded bytes of this complete
            certificate
        r  rj   s    rA   r  zCertificate.sha256&  s7     <<">>$))+6==?DL||rD   c                 X    dj                  d t        | j                        D              S )z
        :return:
            A unicode string of the SHA-256 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r%  c              3   &   K   | ]	  }d |z    ywr=  r=   r>  s     rA   ra  z1Certificate.sha256_fingerprint.<locals>.<genexpr>:  s     Gq
Gr@  )r,  r   r  rj   s    rA   sha256_fingerprintzCertificate.sha256_fingerprint2  s"     xxGM$++,FGGGrD   c                    t        |t              st        t        dt	        |                  |j                  d      j                  d      j                         }|j                  d      dk7  }| xr t        j                  d|      }| xr | }|r| j                  sy|j                  d      }| j                  D ]  }|j                  d      j                  d      j                         }|j                  d      }	t        |	      t        |      k7  rZ|	|k(  r y	| j                  |      }
|
su| j                  ||	      s y	 y| j                   sy|rt"        j$                  nt"        j&                  }t)        ||      }| j                   D ]I  }|j                  d      dk7  rt"        j$                  nt"        j&                  }t)        ||      }||k(  sI y	 y)
a  
        Check if a domain name or IP address is valid according to the
        certificate

        :param domain_ip:
            A unicode string of a domain name or IP address

        :return:
            A boolean - if the domain or IP is valid for the certificate
        zL
                domain_ip must be a unicode string, not %s
                r   rt   r   rs   z^\d+\.\d+\.\d+\.\d+$FrL   T)rF   r   rN   r
   r   rP   r|   rH   rv   r'  r(  r+  r   r   _is_wildcard_domain_is_wildcard_matchr.  r   r   r   r5   )r?   	domain_ipencoded_domain_ipis_ipv6is_ipv4	is_domaindomain_labelsvalid_domainencoded_valid_domainvalid_domain_labelsis_wildcardr   normalized_ipvalid_ipvalid_familynormalized_valid_ips                   rA   is_valid_domain_ipzCertificate.is_valid_domain_ip<  s    )W-F )$	   &,,V4;;GDJJL#((-3+\"((+HJ["\K/K	 %%-33C8M $ 2 2  '3':':6'B'I'I''R'X'X'Z$&:&@&@&E# *+s=/AA&-7"667KL4#:#:=J]#^   ~~#*!&*;< 	H-5]]3-?2-E6>>6??L"+L("C"m3	 rD   c                     |j                  d      dk7  ry|j                         j                  d      }|sy|d   j                  d      dk(  ry|d   dd dk(  ryy	)
af  
        Checks if a domain is a valid wildcard according to
        https://tools.ietf.org/html/rfc6125#section-6.4.3

        :param domain:
            A unicode string of the domain name, where any U-labels from an IDN
            have been converted to A-labels

        :return:
            A boolean - if the domain is a valid wildcard domain
        *r	   FrL   r   rs   r   zxn--T)countrH   r   rv   )r?   domainlabelss      rA   rG  zCertificate._is_wildcard_domain~  sh     <<!%%c* !9>>#"$ !9Qq>V#rD   c                     |d   }|dd }|d   }|dd }||k7  ry|dk(  ryt        j                  d|j                  dd      z   d	z         }|j                  |      ryy)
a  
        Determines if the labels in a domain are a match for labels from a
        wildcard valid domain name

        :param domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in the domain name to check

        :param valid_domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in a wildcard domain pattern

        :return:
            A boolean - if the domain matches the valid domain
        r   r	   NFrY  T^z.*$)r'  r'  r+  r(  )r?   rN  rQ  first_domain_labelother_domain_labelswildcard_labelother_valid_domain_labelswildcard_regexs           rA   rH  zCertificate._is_wildcard_match  s    " +1-+AB/,Q/$7$;! ";;S C.*@*@d*K$Kc$QR 23rD   )\rY   rZ   r[   r  r   r#   r   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r&  r-  r3  r8  r  r  r  r   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r?  r  r  r  r  r  r  r  r  r$  r+  r.  r:  r1  r4  r9  r  rA  r  rE  rW  rG  rH  r=   rD   rA   r  r  `  s   	N+	 56	N+G "*.' "!#"%)""&!&*# $ $ $*.'(,%&*#N$#%)"NJLLEG*$ ) ) 4 4 8 8 * * % % , , + + - - , , 3 3 0 0 + + 4 4 . . 
( 
( . . . . 8 8 6 6 ' ' ) ) . . : : 5 5 B B 2 2 1 1 ? ? 
0 
0 
# 
# G G H H 
L 
L - -* 
- 
- 
3 
3>  *  #  #D    Z Z J J 	! 	! ! !2   F F 	 	 H H@DB#rD   r  c                       e Zd ZeZy)KeyPurposeIdentifiersNr  r=   rD   rA   rf  rf    r  rD   rf  c                       e Zd ZeZy)SequenceOfAlgorithmIdentifiersN)rY   rZ   r[   r   r   r=   rD   rA   rh  rh    r  rD   rh  c            	       P    e Zd Zdeddifdedddfdeddifdeddifd	ed
ddfgZy)CertificateAuxtrustr   Trejectr   r   aliaskeyidr@   r	   N)rY   rZ   r[   rf  r.   r$   rh  r   r=   rD   rA   rj  rj    sW    	'*d);<	(qd*KL	*z401	+
D12	0qd2STGrD   rj  c                       e Zd ZeegZy)TrustedCertificateN)rY   rZ   r[   r  rj  _child_specsr=   rD   rA   rp  rp    s    0LrD   rp  )r   
__future__r   r   r   r   
contextlibr   	encodingsr   r  r'  r   r-  r)  r/  _errorsr
   _irir   r   _ordereddictr   _typesr   r   r   algosr   r   r   r   corer   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   rI  r1   utilr2   r3   r4   r5   r7   r^   rl   r   r   r   r   r   r   r   r   r   r  rB  r\  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r$  r1  r3  r7  r9  r>  rC  rG  rR  rX  rZ  r^  rh  rk  rn  rr  rv  rz  r~  r  r  r  r  r  r  r  r  r  r  r  r  r   r  r  r  r  r  r  r  r"  r&  r(  r.  r2  r4  r=  rB  rG  rK  rU  rW  rY  rc  re  rq  rs  ru  rw  r|  r~  r  r  r  r  r  r  rf  rh  rj  rp  r=   rD   rA   <module>r|     s   S R %   	   
   ( % 5 5 f f       <   D D2 i 2 j6) 6rn9 nbB5 B5J  y H ] 0 = =	f 	Q( Q(h~x ~BR Rj'* 'T@6 @F( & v  3 # "j " Z   H 0Z 0H 0Z 0&  3 "z "s 8  ( V 7 W 8 D%* % 8 /+& /+d: 6 x x X F ) X !j !h " "J$J $& J h  ( 
( 
&: &'  $* $H  Z   m# m`
 #  $
 $$j $
z  
i 
g x #E #h x +E +z : j 	z 	z  8 X J  H ( ("2 &"5 ""5 ""5 " %e % <, ," @# #L X b( bRJ &Z &X 1 1rD   