U
    ΂d]                  	   @  s  d dl mZ d dlZd dlZd dlZd dlZd dlmZ d dlm	Z
 d dlmZmZ d dlmZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZmZ d d	l m!Z!m"Z" d d
l#m$Z$ edddZ%ej&ej'ej(ej)ej*ej+ej,ej-ej.f Z/G dd de0Z1ddddddZ2ddddddZ3dddddZ4G dd dZ5G d d! d!Z6G d"d# d#ej7Z8G d$d% d%e0Z9G d&d' d'ej:d(Z;e;<e
j; G d)d* d*ej:d(Z=e=<e
j= G d+d, d,e=Z>G d-d. d.ej:d(Z?e?<e
j? G d/d0 d0ej:d(Z@e@<e
j@ dPd1d2d'd3d4d5ZAd1d6d7d8d9ZBdQd1d2d'd3d:d;ZCdRd1d2d0d3d<d=ZDdSd1d2d0d3d>d?ZEdTd1d2d.d3d@dAZFdUd1d2d.d3dBdCZGG dDdE dEZHG dFdG dGZIG dHdI dIZJG dJdK dKZKdLdMdNdOZLdS )V    )annotationsN)utils)x509)hashesserialization)dsaeced448ed25519paddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificateIssuerPublicKeyTypesCertificatePublicKeyTypes)	Extension
ExtensionsExtensionType_make_sequence_methods)Name	_ASN1Type)ObjectIdentifieri     c                      s&   e Zd Zdddd fddZ  ZS )AttributeNotFoundstrr   None)msgoidreturnc                   s   t  | || _d S N)super__init__r   )selfr   r   	__class__ S/var/www/html/myproject/myenv/lib/python3.8/site-packages/cryptography/x509/base.pyr"   8   s    zAttributeNotFound.__init____name__
__module____qualname__r"   __classcell__r&   r&   r$   r'   r   7   s   r   zExtension[ExtensionType]%typing.List[Extension[ExtensionType]]r   )	extension
extensionsr   c                 C  s"   |D ]}|j | j krtdqd S )Nz$This extension has already been set.)r   
ValueError)r.   r/   er&   r&   r'   _reject_duplicate_extension=   s    r2   r   Htyping.List[typing.Tuple[ObjectIdentifier, bytes, typing.Optional[int]]])r   
attributesr   c                 C  s$   |D ]\}}}|| krt dqd S )Nz$This attribute has already been set.)r0   )r   r4   Zattr_oid_r&   r&   r'   _reject_duplicate_attributeG   s    r6   datetime.datetimetimer   c                 C  s:   | j dk	r2|  }|r|nt }| jdd| S | S dS )zNormalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    N)tzinfo)r:   	utcoffsetdatetime	timedeltareplace)r9   offsetr&   r&   r'   _convert_to_naive_utc_timeS   s
    
r@   c                   @  sx   e Zd ZejjfdddddddZeddd	d
ZeddddZddddZ	dddddZ
ddddZdS )	Attributer   bytesintr   )r   value_typer   c                 C  s   || _ || _|| _d S r    )_oid_valuerE   )r#   r   rD   rE   r&   r&   r'   r"   b   s    zAttribute.__init__r   c                 C  s   | j S r    )rF   r#   r&   r&   r'   r   l   s    zAttribute.oidc                 C  s   | j S r    )rG   rI   r&   r&   r'   rD   p   s    zAttribute.valuer   c                 C  s   d| j  d| jdS )Nz<Attribute(oid=z, value=)>)r   rD   rI   r&   r&   r'   __repr__t   s    zAttribute.__repr__objectboolotherr   c                 C  s2   t |tstS | j|jko0| j|jko0| j|jkS r    )
isinstancerA   NotImplementedr   rD   rE   r#   rO   r&   r&   r'   __eq__w   s    


zAttribute.__eq__c                 C  s   t | j| j| jfS r    )hashr   rD   rE   rI   r&   r&   r'   __hash__   s    zAttribute.__hash__N)r)   r*   r+   r   Z
UTF8StringrD   r"   propertyr   rK   rS   rU   r&   r&   r&   r'   rA   a   s   

rA   c                   @  sH   e Zd ZdddddZed\ZZZddd	d
ZdddddZ	dS )
Attributesztyping.Iterable[Attribute]r   )r4   r   c                 C  s   t || _d S r    )list_attributes)r#   r4   r&   r&   r'   r"      s    zAttributes.__init__rY   r   rH   c                 C  s   d| j  dS )Nz<Attributes(rJ   )rY   rI   r&   r&   r'   rK      s    zAttributes.__repr__r   rA   r   r   c                 C  s2   | D ]}|j |kr|  S qtd| d|d S )NzNo z attribute was found)r   r   )r#   r   attrr&   r&   r'   get_attribute_for_oid   s    

z Attributes.get_attribute_for_oidN)
r)   r*   r+   r"   r   __len____iter____getitem__rK   r\   r&   r&   r&   r'   rW      s   rW   c                   @  s   e Zd ZdZdZdS )Versionr      N)r)   r*   r+   Zv1v3r&   r&   r&   r'   r`      s   r`   c                      s&   e Zd Zdddd fddZ  ZS )InvalidVersionr   rC   r   )r   parsed_versionr   c                   s   t  | || _d S r    )r!   r"   rd   )r#   r   rd   r$   r&   r'   r"      s    zInvalidVersion.__init__r(   r&   r&   r$   r'   rc      s   rc   c                   @  s  e Zd ZejdddddZeejdddd	Zeejd
dddZejddddZ	eejddddZ
eejddddZeejddddZeejddddZeejddddZeejddddZeejd dd!d"Zeejd#dd$d%Zeejddd&d'Zeejddd(d)Zeejddd*d+Zejd,d-d.d/d0Zejddd1d2Zejd3dd4d5d6Zejd d7d8d9d:Zd;S )<Certificatehashes.HashAlgorithmrB   	algorithmr   c                 C  s   dS z4
        Returns bytes using digest passed.
        Nr&   r#   rh   r&   r&   r'   fingerprint   s    zCertificate.fingerprintrC   rH   c                 C  s   dS )z3
        Returns certificate serial number
        Nr&   rI   r&   r&   r'   serial_number   s    zCertificate.serial_numberr`   c                 C  s   dS )z1
        Returns the certificate version
        Nr&   rI   r&   r&   r'   version   s    zCertificate.versionr   c                 C  s   dS z(
        Returns the public key
        Nr&   rI   r&   r&   r'   
public_key   s    zCertificate.public_keyr7   c                 C  s   dS )z?
        Not before time (represented as UTC datetime)
        Nr&   rI   r&   r&   r'   not_valid_before   s    zCertificate.not_valid_beforec                 C  s   dS )z>
        Not after time (represented as UTC datetime)
        Nr&   rI   r&   r&   r'   not_valid_after   s    zCertificate.not_valid_afterr   c                 C  s   dS )z1
        Returns the issuer name object.
        Nr&   rI   r&   r&   r'   issuer   s    zCertificate.issuerc                 C  s   dS z2
        Returns the subject name object.
        Nr&   rI   r&   r&   r'   subject   s    zCertificate.subject%typing.Optional[hashes.HashAlgorithm]c                 C  s   dS zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nr&   rI   r&   r&   r'   signature_hash_algorithm   s    z$Certificate.signature_hash_algorithmr   c                 C  s   dS zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nr&   rI   r&   r&   r'   signature_algorithm_oid   s    z#Certificate.signature_algorithm_oidz;typing.Union[None, padding.PSS, padding.PKCS1v15, ec.ECDSA]c                 C  s   dS )z=
        Returns the signature algorithm parameters.
        Nr&   rI   r&   r&   r'   signature_algorithm_parameters   s    z*Certificate.signature_algorithm_parametersr   c                 C  s   dS )z/
        Returns an Extensions object.
        Nr&   rI   r&   r&   r'   r/      s    zCertificate.extensionsc                 C  s   dS z.
        Returns the signature bytes.
        Nr&   rI   r&   r&   r'   	signature   s    zCertificate.signaturec                 C  s   dS )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nr&   rI   r&   r&   r'   tbs_certificate_bytes  s    z!Certificate.tbs_certificate_bytesc                 C  s   dS )zh
        Returns the tbsCertificate payload bytes with the SCT list extension
        stripped.
        Nr&   rI   r&   r&   r'   tbs_precertificate_bytes
  s    z$Certificate.tbs_precertificate_bytesrL   rM   rN   c                 C  s   dS z"
        Checks equality.
        Nr&   rR   r&   r&   r'   rS     s    zCertificate.__eq__c                 C  s   dS z"
        Computes a hash.
        Nr&   rI   r&   r&   r'   rU     s    zCertificate.__hash__serialization.Encodingencodingr   c                 C  s   dS )zB
        Serializes the certificate to PEM or DER format.
        Nr&   r#   r   r&   r&   r'   public_bytes  s    zCertificate.public_bytesr   )rr   r   c                 C  s   dS )z
        This method verifies that certificate issuer name matches the
        issuer subject name and that the certificate is signed by the
        issuer's private key. No other validation is performed.
        Nr&   )r#   rr   r&   r&   r'   verify_directly_issued_by$  s    z%Certificate.verify_directly_issued_byN)r)   r*   r+   abcabstractmethodrk   rV   rl   rm   ro   rp   rq   rr   rt   rw   ry   rz   r/   r|   r}   r~   rS   rU   r   r   r&   r&   r&   r'   re      sf   re   )	metaclassc                   @  sT   e Zd ZeejddddZeejddddZeejddd	d
ZdS )RevokedCertificaterC   rH   c                 C  s   dS )zG
        Returns the serial number of the revoked certificate.
        Nr&   rI   r&   r&   r'   rl   2  s    z RevokedCertificate.serial_numberr7   c                 C  s   dS )zH
        Returns the date of when this certificate was revoked.
        Nr&   rI   r&   r&   r'   revocation_date9  s    z"RevokedCertificate.revocation_dater   c                 C  s   dS )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nr&   rI   r&   r&   r'   r/   @  s    zRevokedCertificate.extensionsN)	r)   r*   r+   rV   r   r   rl   r   r/   r&   r&   r&   r'   r   1  s   r   c                   @  sT   e Zd ZddddddZedddd	Zeddd
dZeddddZdS )_RawRevokedCertificaterC   r7   r   rl   r   r/   c                 C  s   || _ || _|| _d S r    _serial_number_revocation_date_extensionsr#   rl   r   r/   r&   r&   r'   r"   M  s    z_RawRevokedCertificate.__init__rH   c                 C  s   | j S r    )r   rI   r&   r&   r'   rl   W  s    z$_RawRevokedCertificate.serial_numberc                 C  s   | j S r    )r   rI   r&   r&   r'   r   [  s    z&_RawRevokedCertificate.revocation_datec                 C  s   | j S r    )r   rI   r&   r&   r'   r/   _  s    z!_RawRevokedCertificate.extensionsN)r)   r*   r+   r"   rV   rl   r   r/   r&   r&   r&   r'   r   L  s   
r   c                   @  s  e Zd ZejdddddZejddddd	Zejd
ddddZeejddddZ	eejddddZ
eejddddZeejddddZeejddddZeejddd d!Zeejddd"d#Zeejddd$d%Zejd&d'd(d)d*Zejd
dd+d,Zejd
d-d.d/d0Zejd1d2d.d3d0Zejd4d5d.d6d0Zejd7dd8d9Zejd:d'd;d<d=Zd>S )?CertificateRevocationListr   rB   r   c                 C  s   dS )z:
        Serializes the CRL to PEM or DER format.
        Nr&   r   r&   r&   r'   r   e  s    z&CertificateRevocationList.public_bytesrf   rg   c                 C  s   dS ri   r&   rj   r&   r&   r'   rk   k  s    z%CertificateRevocationList.fingerprintrC   z#typing.Optional[RevokedCertificate])rl   r   c                 C  s   dS )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nr&   )r#   rl   r&   r&   r'   (get_revoked_certificate_by_serial_numberq  s    zBCertificateRevocationList.get_revoked_certificate_by_serial_numberru   rH   c                 C  s   dS rv   r&   rI   r&   r&   r'   rw   z  s    z2CertificateRevocationList.signature_hash_algorithmr   c                 C  s   dS rx   r&   rI   r&   r&   r'   ry     s    z1CertificateRevocationList.signature_algorithm_oidr   c                 C  s   dS )zC
        Returns the X509Name with the issuer of this CRL.
        Nr&   rI   r&   r&   r'   rr     s    z CertificateRevocationList.issuer"typing.Optional[datetime.datetime]c                 C  s   dS )z?
        Returns the date of next update for this CRL.
        Nr&   rI   r&   r&   r'   next_update  s    z%CertificateRevocationList.next_updater7   c                 C  s   dS )z?
        Returns the date of last update for this CRL.
        Nr&   rI   r&   r&   r'   last_update  s    z%CertificateRevocationList.last_updater   c                 C  s   dS )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nr&   rI   r&   r&   r'   r/     s    z$CertificateRevocationList.extensionsc                 C  s   dS r{   r&   rI   r&   r&   r'   r|     s    z#CertificateRevocationList.signaturec                 C  s   dS )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nr&   rI   r&   r&   r'   tbs_certlist_bytes  s    z,CertificateRevocationList.tbs_certlist_bytesrL   rM   rN   c                 C  s   dS r   r&   rR   r&   r&   r'   rS     s    z CertificateRevocationList.__eq__c                 C  s   dS )z<
        Number of revoked certificates in the CRL.
        Nr&   rI   r&   r&   r'   r]     s    z!CertificateRevocationList.__len__r   )idxr   c                 C  s   d S r    r&   r#   r   r&   r&   r'   r_     s    z%CertificateRevocationList.__getitem__slicetyping.List[RevokedCertificate]c                 C  s   d S r    r&   r   r&   r&   r'   r_     s    ztyping.Union[int, slice]zAtyping.Union[RevokedCertificate, typing.List[RevokedCertificate]]c                 C  s   dS )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nr&   r   r&   r&   r'   r_     s    z#typing.Iterator[RevokedCertificate]c                 C  s   dS )z8
        Iterator over the revoked certificates
        Nr&   rI   r&   r&   r'   r^     s    z"CertificateRevocationList.__iter__r   )ro   r   c                 C  s   dS )zQ
        Verifies signature of revocation list against given public key.
        Nr&   )r#   ro   r&   r&   r'   is_signature_valid  s    z,CertificateRevocationList.is_signature_validN)r)   r*   r+   r   r   r   rk   r   rV   rw   ry   rr   r   r   r/   r|   r   rS   r]   typingoverloadr_   r^   r   r&   r&   r&   r'   r   d  sX   r   c                   @  s6  e Zd ZejdddddZejdddd	Zejd
dddZeejddddZ	eejddddZ
eejddddZeejddddZeejddddZejddddd Zeejddd!d"Zeejddd#d$Zeejddd%d&Zejddd'd(d)Zd*S )+CertificateSigningRequestrL   rM   rN   c                 C  s   dS r   r&   rR   r&   r&   r'   rS     s    z CertificateSigningRequest.__eq__rC   rH   c                 C  s   dS r   r&   rI   r&   r&   r'   rU     s    z"CertificateSigningRequest.__hash__r   c                 C  s   dS rn   r&   rI   r&   r&   r'   ro     s    z$CertificateSigningRequest.public_keyr   c                 C  s   dS rs   r&   rI   r&   r&   r'   rt     s    z!CertificateSigningRequest.subjectru   c                 C  s   dS rv   r&   rI   r&   r&   r'   rw     s    z2CertificateSigningRequest.signature_hash_algorithmr   c                 C  s   dS rx   r&   rI   r&   r&   r'   ry     s    z1CertificateSigningRequest.signature_algorithm_oidr   c                 C  s   dS )z@
        Returns the extensions in the signing request.
        Nr&   rI   r&   r&   r'   r/     s    z$CertificateSigningRequest.extensionsrW   c                 C  s   dS )z/
        Returns an Attributes object.
        Nr&   rI   r&   r&   r'   r4     s    z$CertificateSigningRequest.attributesr   rB   r   c                 C  s   dS )z;
        Encodes the request to PEM or DER format.
        Nr&   r   r&   r&   r'   r     s    z&CertificateSigningRequest.public_bytesc                 C  s   dS r{   r&   rI   r&   r&   r'   r|   "  s    z#CertificateSigningRequest.signaturec                 C  s   dS )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nr&   rI   r&   r&   r'   tbs_certrequest_bytes)  s    z/CertificateSigningRequest.tbs_certrequest_bytesc                 C  s   dS )z8
        Verifies signature of signing request.
        Nr&   rI   r&   r&   r'   r   1  s    z,CertificateSigningRequest.is_signature_validrZ   c                 C  s   dS )z:
        Get the attribute value for a given OID.
        Nr&   )r#   r   r&   r&   r'   r\   8  s    z/CertificateSigningRequest.get_attribute_for_oidN)r)   r*   r+   r   r   rS   rU   ro   rV   rt   rw   ry   r/   r4   r   r|   r   r   r\   r&   r&   r&   r'   r     sD   r   rB   
typing.Any)databackendr   c                 C  s
   t | S r    )	rust_x509load_pem_x509_certificater   r   r&   r&   r'   r   D  s    r   ztyping.List[Certificate])r   r   c                 C  s
   t | S r    )r   load_pem_x509_certificates)r   r&   r&   r'   r   J  s    r   c                 C  s
   t | S r    )r   load_der_x509_certificater   r&   r&   r'   r   O  s    r   c                 C  s
   t | S r    )r   load_pem_x509_csrr   r&   r&   r'   r   V  s    r   c                 C  s
   t | S r    )r   load_der_x509_csrr   r&   r&   r'   r   ]  s    r   c                 C  s
   t | S r    )r   load_pem_x509_crlr   r&   r&   r'   r   d  s    r   c                 C  s
   t | S r    )r   load_der_x509_crlr   r&   r&   r'   r   k  s    r   c                   @  sx   e Zd Zdg g fddddddZdd d	d
dZddd dddZdddddd dddZddddddddZdS )  CertificateSigningRequestBuilderNtyping.Optional[Name]r-   r3   )subject_namer/   r4   c                 C  s   || _ || _|| _dS )zB
        Creates an empty X.509 certificate request (v1).
        N)_subject_namer   rY   )r#   r   r/   r4   r&   r&   r'   r"   r  s    z)CertificateSigningRequestBuilder.__init__r   namer   c                 C  s4   t |tstd| jdk	r$tdt|| j| jS )zF
        Sets the certificate requestor's distinguished name.
        Expecting x509.Name object.N&The subject name may only be set once.)rP   r   	TypeErrorr   r0   r   r   rY   r#   r   r&   r&   r'   r     s    

  z-CertificateSigningRequestBuilder.subject_namer   rM   extvalcriticalr   c                 C  sD   t |tstdt|j||}t|| j t| j| j|g | j	S )zE
        Adds an X.509 extension to the certificate request.
        "extension must be an ExtensionType)
rP   r   r   r   r   r2   r   r   r   rY   r#   r   r   r.   r&   r&   r'   add_extension  s    

z.CertificateSigningRequestBuilder.add_extension)_tagr   rB   ztyping.Optional[_ASN1Type])r   rD   r   r   c                C  s|   t |tstdt |ts$td|dk	r>t |ts>tdt|| j |dk	rZ|j}nd}t| j	| j
| j|||fg S )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type)rP   r   r   rB   r   r6   rY   rD   r   r   r   )r#   r   rD   r   tagr&   r&   r'   add_attribute  s    


z.CertificateSigningRequestBuilder.add_attributer   "typing.Optional[_AllowedHashTypes]r   r   private_keyrh   r   r   c                 C  s    | j dkrtdt| ||S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subject)r   r0   r   Zcreate_x509_csrr#   r   rh   r   r&   r&   r'   sign  s    	
z%CertificateSigningRequestBuilder.sign)N)r)   r*   r+   r"   r   r   r   r   r&   r&   r&   r'   r   q  s   $ r   c                
   @  s   e Zd ZU ded< ddddddg fddddddddd	d
dZdd dddZdd dddZdd dddZdd dddZdd dddZ	dd dddZ
d d!d d"d#d$Zd.dd%d&d'd(d)d*d+d,d-ZdS )/CertificateBuilderr-   r   Nr   z*typing.Optional[CertificatePublicKeyTypes]typing.Optional[int]r   r   )issuer_namer   ro   rl   rp   rq   r/   r   c                 C  s6   t j| _|| _|| _|| _|| _|| _|| _|| _	d S r    )
r`   rb   _version_issuer_namer   _public_keyr   _not_valid_before_not_valid_afterr   )r#   r   r   ro   rl   rp   rq   r/   r&   r&   r'   r"     s    
zCertificateBuilder.__init__r   r   c                 C  sD   t |tstd| jdk	r$tdt|| j| j| j| j	| j
| jS )z3
        Sets the CA's distinguished name.
        r   N%The issuer name may only be set once.)rP   r   r   r   r0   r   r   r   r   r   r   r   r   r&   r&   r'   r     s    

zCertificateBuilder.issuer_namec                 C  sD   t |tstd| jdk	r$tdt| j|| j| j| j	| j
| jS )z:
        Sets the requestor's distinguished name.
        r   Nr   )rP   r   r   r   r0   r   r   r   r   r   r   r   r   r&   r&   r'   r     s    

zCertificateBuilder.subject_namer   )keyr   c              	   C  s`   t |tjtjtjtjt	j
tjtjfs.td| jdk	r@tdt| j| j|| j| j| j| jS )zT
        Sets the requestor's public key (as found in the signing request).
        zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rP   r   ZDSAPublicKeyr   ZRSAPublicKeyr   ZEllipticCurvePublicKeyr
   ZEd25519PublicKeyr	   ZEd448PublicKeyr   ZX25519PublicKeyr   ZX448PublicKeyr   r   r0   r   r   r   r   r   r   r   )r#   r   r&   r&   r'   ro     s2    
zCertificateBuilder.public_keyrC   numberr   c                 C  sh   t |tstd| jdk	r$td|dkr4td| dkrHtdt| j| j| j	|| j
| j| jS )z5
        Sets the certificate serial number.
        'Serial number must be of integral type.N'The serial number may only be set once.r   z%The serial number should be positive.   3The serial number should not be more than 159 bits.)rP   rC   r   r   r0   
bit_lengthr   r   r   r   r   r   r   r#   r   r&   r&   r'   rl   ,  s&    

z CertificateBuilder.serial_numberr7   r8   c                 C  sz   t |tjstd| jdk	r&tdt|}|tk r>td| jdk	rZ|| jkrZtdt| j	| j
| j| j|| j| jS )z7
        Sets the certificate activation time.
        Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rP   r<   r   r   r0   r@   _EARLIEST_UTC_TIMEr   r   r   r   r   r   r   r#   r9   r&   r&   r'   rp   G  s,    
z#CertificateBuilder.not_valid_beforec                 C  sz   t |tjstd| jdk	r&tdt|}|tk r>td| jdk	rZ|| jk rZtdt| j	| j
| j| j| j|| jS )z7
        Sets the certificate expiration time.
        r   Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rP   r<   r   r   r0   r@   r   r   r   r   r   r   r   r   r   r&   r&   r'   rq   d  s2    
z"CertificateBuilder.not_valid_afterr   rM   r   c              	   C  sT   t |tstdt|j||}t|| j t| j| j	| j
| j| j| j| j|g S )z=
        Adds an X.509 extension to the certificate.
        r   )rP   r   r   r   r   r2   r   r   r   r   r   r   r   r   r   r&   r&   r'   r     s    

z CertificateBuilder.add_extension)rsa_paddingr   r   r   z<typing.Optional[typing.Union[padding.PSS, padding.PKCS1v15]]re   )r   rh   r   r   r   c                C  s   | j dkrtd| jdkr$td| jdkr6td| jdkrHtd| jdkrZtd| jdkrltd|dk	rt|tj	tj
fstdt|tjstd	t| |||S )
zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public keyzPadding must be PSS or PKCS1v15z&Padding is only supported for RSA keys)r   r0   r   r   r   r   r   rP   r   ZPSSZPKCS1v15r   r   ZRSAPrivateKeyr   Zcreate_x509_certificate)r#   r   rh   r   r   r&   r&   r'   r     s.    





   zCertificateBuilder.sign)N)r)   r*   r+   __annotations__r"   r   r   ro   rl   rp   rq   r   r   r&   r&   r&   r'   r     s(   
%  r   c                   @  s   e Zd ZU ded< ded< dddg g fddddddd	d
Zdd dddZdd dddZdd dddZddd dddZdd dddZ	d&dd d!d"d#d$d%Z
dS )' CertificateRevocationListBuilderr-   r   r   _revoked_certificatesNr   r   )r   r   r   r/   revoked_certificatesc                 C  s"   || _ || _|| _|| _|| _d S r    )r   _last_update_next_updater   r   )r#   r   r   r   r/   r   r&   r&   r'   r"     s
    z)CertificateRevocationListBuilder.__init__r   )r   r   c                 C  s<   t |tstd| jd k	r$tdt|| j| j| j| j	S )Nr   r   )
rP   r   r   r   r0   r   r   r   r   r   )r#   r   r&   r&   r'   r     s    

z,CertificateRevocationListBuilder.issuer_namer7   )r   r   c                 C  sr   t |tjstd| jd k	r&tdt|}|tk r>td| jd k	rZ|| jkrZtdt| j	|| j| j
| jS )Nr   !Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)rP   r<   r   r   r0   r@   r   r   r   r   r   r   )r#   r   r&   r&   r'   r     s(    
z,CertificateRevocationListBuilder.last_update)r   r   c                 C  sr   t |tjstd| jd k	r&tdt|}|tk r>td| jd k	rZ|| jk rZtdt| j	| j|| j
| jS )Nr   r   r   z8The next update date must be after the last update date.)rP   r<   r   r   r0   r@   r   r   r   r   r   r   )r#   r   r&   r&   r'   r     s(    
z,CertificateRevocationListBuilder.next_updater   rM   r   c                 C  sL   t |tstdt|j||}t|| j t| j| j	| j
| j|g | jS )zM
        Adds an X.509 extension to the certificate revocation list.
        r   )rP   r   r   r   r   r2   r   r   r   r   r   r   r   r&   r&   r'   r     s    

z.CertificateRevocationListBuilder.add_extensionr   )revoked_certificater   c                 C  s2   t |tstdt| j| j| j| j| j|g S )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	rP   r   r   r   r   r   r   r   r   )r#   r   r&   r&   r'   add_revoked_certificate(  s    

z8CertificateRevocationListBuilder.add_revoked_certificater   r   r   r   r   c                 C  sD   | j d krtd| jd kr$td| jd kr6tdt| ||S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r   r0   r   r   r   Zcreate_x509_crlr   r&   r&   r'   r   9  s    


z%CertificateRevocationListBuilder.sign)N)r)   r*   r+   r   r"   r   r   r   r   r   r   r&   r&   r&   r'   r     s   
 r   c                   @  sj   e Zd Zddg fddddddZdd d	d
dZdd dddZddd dddZddddddZdS )RevokedCertificateBuilderNr   r   r-   r   c                 C  s   || _ || _|| _d S r    r   r   r&   r&   r'   r"   L  s    z"RevokedCertificateBuilder.__init__rC   r   c                 C  sX   t |tstd| jd k	r$td|dkr4td| dkrHtdt|| j| jS )Nr   r   r   z$The serial number should be positiver   r   )	rP   rC   r   r   r0   r   r   r   r   r   r&   r&   r'   rl   V  s    

  z'RevokedCertificateBuilder.serial_numberr7   r8   c                 C  sN   t |tjstd| jd k	r&tdt|}|tk r>tdt| j|| j	S )Nr   z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
rP   r<   r   r   r0   r@   r   r   r   r   r   r&   r&   r'   r   h  s    
  z)RevokedCertificateBuilder.revocation_dater   rM   r   c                 C  sD   t |tstdt|j||}t|| j t| j| j	| j|g S )Nr   )
rP   r   r   r   r   r2   r   r   r   r   r   r&   r&   r'   r   x  s    

z'RevokedCertificateBuilder.add_extensionr   r   )r   r   c                 C  s:   | j d krtd| jd kr$tdt| j | jt| jS )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r   r0   r   r   r   r   )r#   r   r&   r&   r'   build  s    

zRevokedCertificateBuilder.build)N)r)   r*   r+   r"   rl   r   r   r   r&   r&   r&   r'   r   K  s   
r   rC   rH   c                   C  s   t tddd? S )N   bigr   )rC   
from_bytesosurandomr&   r&   r&   r'   random_serial_number  s    r   )N)N)N)N)N)N)M
__future__r   r   r<   r   r   Zcryptographyr   Z"cryptography.hazmat.bindings._rustr   r   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   r	   r
   r   r   r   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   r   r   Zcryptography.x509.extensionsr   r   r   r   Zcryptography.x509.namer   r   Zcryptography.x509.oidr   r   UnionSHA224SHA256SHA384SHA512ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512Z_AllowedHashTypes	Exceptionr   r2   r6   r@   rA   rW   Enumr`   rc   ABCMetare   registerr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r&   r&   r&   r'   <module>   s|   (

$ |]      \ x I