o
    %zhRn                    @   st  d Z ddlmZmZmZmZ ddlmZ ddlm	Z	 ddl
Z
ddlZddlZddlZddlZddlZddlmZ ddlmZmZ dd	lmZ dd
lmZmZmZ ddlmZmZmZmZ ddl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z< ddl=m>Z> ddl?m@Z@mAZAmBZBmCZC G dd de*ZDG dd de*ZEG dd de*ZFG dd de0ZGG dd de3ZHG dd de4ZIG dd de"ZJG dd de3ZKG dd  d e7ZLed!d" ZMG d#d$ d$e%ZNG d%d& d&e.ZOG d'd( d(e3ZPG d)d* d*e6ZQG d+d, d,e4ZRG d-d. d.e%ZSG d/d0 d0e3ZTG d1d2 d2e%ZUG d3d4 d4e%ZVG d5d6 d6e%ZWG d7d8 d8e5ZXG d9d: d:e5ZYG d;d< d<e4ZZG d=d> d>e4Z[G d?d@ d@e3Z\G dAdB dBe3Z]G dCdD dDe4Z^G dEdF dFe3Z_G dGdH dHe4Z`G dIdJ dJe%ZaG dKdL dLe%ZbG dMdN dNe5ZcG dOdP dPe4ZdG dQdR dRe5ZeG dSdT dTe3ZfG dUdV dVe6ZgG dWdX dXe3ZhG dYdZ dZe%ZiG d[d\ d\e+ZjG d]d^ d^e+ZkG d_d` d`e3ZlG dadb dbe4ZmG dcdd dde3ZnG dedf dfe3ZoG dgdh dhe%ZpG didj dje4ZqG dkdl dle%ZrG dmdn dne3ZsG dodp dpe3ZtG dqdr dre3ZuG dsdt dte%ZvG dudv dve"ZwG dwdx dxe3ZxG dydz dze4ZyG d{d| d|e3ZzG d}d~ d~e3Z{G dd de4Z|G dd de%Z}G dd de4Z~G dd de3ZG dd de3ZG dd de.ZG dd de3ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de3ZG dd de4ZG dd de3ZG dd de.ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de4ZG dd de4ZG dd de3ZG dd de"ZG dd de+ZG dd de3ZG dd de6ZG dd de3ZG dd de3ZG dd de6ZG dd de'ZG dd de'ZG dd de'ZG dd de'ZG dd de'ZG ddĄ de'ZG ddƄ de3ZG ddȄ de3ZG ddʄ de'ZG dd̄ de3ZG dd΄ de3ZG ddЄ de6ZG dd҄ de.ZG ddԄ de6ZG ddք de6ZG dd؄ de6ZG ddڄ de3ZG dd܄ de6ZG ddބ de3ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de3ZG dd de3ZG dd de4ZG dd de4ZG dd de3ZG dd de&ZdS )z
ASN.1 type classes for X.509 certificates. Exports the following items:

 - Attributes()
 - Certificate()
 - Extensions()
 - GeneralName()
 - GeneralNames()
 - Name()

Other type classes are defined that help compose the types listed above.
    )unicode_literalsdivisionabsolute_importprint_function)contextmanager)idnaN   )unwrap)
iri_to_uri
uri_to_iri)OrderedDict)	type_namestr_clsbytes_to_list)AlgorithmIdentifierAnyAlgorithmIdentifierDigestAlgorithmSignedDigestAlgorithm)Any	BitString	BMPStringBooleanChoiceConcat
EnumeratedGeneralizedTimeGeneralString	IA5StringIntegerNullNumericStringObjectIdentifierOctetBitStringOctetStringParsableOctetStringPrintableStringSequence
SequenceOfSetSetOfTeletexStringUniversalStringUTCTime
UTF8StringVisibleStringVOID)PublicKeyInfo)int_to_bytesint_from_bytes	inet_ntop	inet_ptonc                   @   s,   e Zd ZdZdZdd Zdd Zdd Zd	S )
DNSNamer         c                 C   
   | |k S N selfotherr;   r;   J/var/www/html/kangema/venv/lib/python3.10/site-packages/asn1crypto/x509.py__ne__L      
zDNSName.__ne__c                 C   s&   t |tsdS |   |  kS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2

        :param other:
            Another DNSName object

        :return:
            A boolean
        F)
isinstancer5   __unicode__lowerr<   r;   r;   r?   __eq__O      
zDNSName.__eq__c                 C   s|   t |tsttdt| t||dr#d|dd | j }n|| j}|| _|| _	d| _
| jdkr<d| _dS dS )zd
        Sets the value of the DNS name

        :param value:
            A unicode string
        K
                %s value must be a unicode string, not %s
                .   .r   N    )rB   r   	TypeErrorr	   r   
startswithencode	_encoding_unicodecontents_header_trailer)r=   valueencoded_valuer;   r;   r?   set_   s   



zDNSName.setN)__name__
__module____qualname__rN   _bad_tagr@   rE   rU   r;   r;   r;   r?   r5   G   s    r5   c                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
URIc                 C   sP   t |tsttdt| t||| _t|| _d| _| j	dkr&d| _	dS dS )b
        Sets the value of the string

        :param value:
            A unicode string
        rG   NrJ   )
rB   r   rK   r	   r   rO   r
   rP   rQ   rR   r=   rS   r;   r;   r?   rU   ~   s   



zURI.setc                 C   r9   r:   r;   r<   r;   r;   r?   r@      rA   z
URI.__ne__c                 C   s&   t |tsdS t| jdt|jdkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4

        :param other:
            Another URI object

        :return:
            A boolean
        FT)rB   rZ   r
   nativer<   r;   r;   r?   rE      rF   z
URI.__eq__c                 C   s,   | j du rdS | jdu rt|  | _| jS 7
        :return:
            A unicode string
        N )rP   rO   r   _merge_chunksr=   r;   r;   r?   rC      s
   

zURI.__unicode__N)rV   rW   rX   rU   r@   rE   rC   r;   r;   r;   r?   rZ   |   s
    rZ   c                   @   sR   e Zd ZdZdZdZedd Zejdd Zdd Z	d	d
 Z
dd Zdd ZdS )EmailAddressNFr6   c                 C   s   | j S )z`
        :return:
            A byte string of the DER-encoded contents of the sequence
        )	_contentsrb   r;   r;   r?   rP      s   zEmailAddress.contentsc                 C   s   d| _ || _dS )ze
        :param value:
            A byte string of the DER-encoded contents of the sequence
        FN)_normalizedrd   r\   r;   r;   r?   rP      s   
c                 C   s   t |tsttdt| t||ddkr-|dd\}}|dd |d }n|d}d| _|| _	|| _
d	| _| jd
krHd
| _d	S d	S )r[   rG   @r   ascii   @r   TNrJ   )rB   r   rK   r	   r   findrsplitrM   re   rO   rP   rQ   rR   )r=   rS   mailboxhostnamerT   r;   r;   r?   rU      s"   



zEmailAddress.setc                 C   sb   | j du r.|  }|ddkr|d| _ | j S |dd\}}|dd |d | _ | j S )r_   Nri   rg   cp1252r   rf   r   )rO   ra   rj   decoderk   )r=   rP   rl   rm   r;   r;   r?   rC      s   
zEmailAddress.__unicode__c                 C   r9   r:   r;   r<   r;   r;   r?   r@     rA   zEmailAddress.__ne__c                 C   s   t |tsdS | js| | j |js||j | jddks)|jddkr/| j|jkS |jdd\}}| jdd\}}||krGdS | | krQdS dS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5

        :param other:
            Another EmailAddress object

        :return:
            A boolean
        Fri   rg   r   T)	rB   rc   re   rU   r]   rd   rj   rk   rD   )r=   r>   other_mailboxother_hostnamerl   rm   r;   r;   r?   rE     s   
 zEmailAddress.__eq__)rV   rW   rX   rd   re   rY   propertyrP   setterrU   rC   r@   rE   r;   r;   r;   r?   rc      s    

	rc   c                   @   s:   e Zd ZdddZdd Zedd Zdd	 Zd
d ZdS )	IPAddressNc                 C   s   t td)z?
        This method is not applicable to IP addresses
        z=
            IP address values can not be parsed
            )
ValueErrorr	   )r=   specspec_paramsr;   r;   r?   parse'  s   zIPAddress.parsec           
      C   sT  t |tsttdt| t||}|ddk}d}|r;|dd}|d }t|d }|dk r;ttdt| |ddkrUt	j
}|dkrRttd	t| d}nt	j}|d
krettdt| d
}d}|rd| }	|	d|t|	  7 }	tt|	d}d|d t|  | }|| _t||| | _| j| _d| _| jdkrd| _dS dS )z
        Sets the value of the object

        :param value:
            A unicode string containing an IPv4 address, IPv4 address with CIDR,
            an IPv6 address or IPv6 address with CIDR
        rG   /rg   r   r   zT
                    %s value contains a CIDR range less than 0
                    :   z
                    %s value contains a CIDR range bigger than 128, the maximum
                    value for an IPv6 address
                        z
                    %s value contains a CIDR range bigger than 32, the maximum
                    value for an IPv4 address
                    rJ   10          N)rB   r   rK   r	   r   rj   splitintru   socketAF_INET6AF_INETlenr1   _nativer4   rP   _bytesrQ   rR   )
r=   rS   original_valuehas_cidrcidrpartsfamily	cidr_size
cidr_bytes	cidr_maskr;   r;   r?   rU   2  s\   
	

zIPAddress.setc                 C   s   | j du rdS | jdu rp|  }t|}d}d}|tddgv r7ttj|dd }|dkr6t|dd }n|tddgv rUttj	|dd }|dkrUt|dd }|durmd
|}t|d}|d	 t| }|| _| jS )
z
        The native Python datatype representation of this value

        :return:
            A unicode string or None
        Nr|      r   r      z{0:b}r~   ry   )rP   r   	__bytes__r   rU   r3   r   r   r2   r   formatrstripr   )r=   byte_stringbyte_lenrS   cidr_int	cidr_bitsr   r;   r;   r?   r]   y  s,   
	

zIPAddress.nativec                 C   r9   r:   r;   r<   r;   r;   r?   r@     rA   zIPAddress.__ne__c                 C   s   t |tsdS |  | kS )zl
        :param other:
            Another IPAddress object

        :return:
            A boolean
        F)rB   rt   r   r<   r;   r;   r?   rE     s   
	zIPAddress.__eq__)NN)	rV   rW   rX   rx   rU   rr   r]   r@   rE   r;   r;   r;   r?   rt   &  s    
G
rt   c                   @   s"   e Zd ZdefdedeifgZdS )	Attributetypevaluesrv   N)rV   rW   rX   r!   r)   r   _fieldsr;   r;   r;   r?   r         r   c                   @      e Zd ZeZdS )
AttributesN)rV   rW   rX   r   _child_specr;   r;   r;   r?   r         r   c                
   @   $   e Zd Zddddddddd	d
	ZdS )KeyUsagedigital_signaturenon_repudiationkey_enciphermentdata_enciphermentkey_agreementkey_cert_signcrl_signencipher_onlydecipher_only	r   r   r      r            r   NrV   rW   rX   _mapr;   r;   r;   r?   r         
r   c                   @   ,   e Zd ZdedddfdedddfgZdS )PrivateKeyUsagePeriod
not_beforer   Timplicitoptional	not_afterr   N)rV   rW   rX   r   r   r;   r;   r;   r?   r         r   c                   @   s   e Zd ZdZdZdd ZdS )NotReallyTeletexStringa6  
    OpenSSL (and probably some other libraries) puts ISO-8859-1
    into TeletexString instead of ITU T.61. We use Windows-1252 when
    decoding since it is a superset of ISO-8859-1, and less likely to
    cause encoding issues, but we stay strict with encoding to prevent
    us from creating bad data.
    rn   c                 C   s0   | j du rdS | jdu r|  | j| _| jS r^   )rP   rO   ra   ro   _decoding_encodingrb   r;   r;   r?   rC     s
   

z"NotReallyTeletexString.__unicode__N)rV   rW   rX   __doc__r   rC   r;   r;   r;   r?   r     s    r   c                   c   s$    zdt _d V  W dt _d S dt _w )Nteletexrn   )r   r   r;   r;   r;   r?   strict_teletex  s
   r   c                   @   s4   e Zd ZdefdefdefdefdefdefgZ	dS )DirectoryStringteletex_stringprintable_stringuniversal_stringutf8_string
bmp_string
ia5_stringN)
rV   rW   rX   r   r%   r+   r-   r   r   _alternativesr;   r;   r;   r?   r     s    r   c                   @   s   e Zd Zi ddddddddd	d
dddddddddddddddddddddd d!d"i d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDZg dEZedFdG ZedHdI ZdJS )KNameTypez2.5.4.3common_namez2.5.4.4surnamez2.5.4.5serial_numberz2.5.4.6country_namez2.5.4.7locality_namez2.5.4.8state_or_province_namez2.5.4.9street_addressz2.5.4.10organization_namez2.5.4.11organizational_unit_namez2.5.4.12titlez2.5.4.15business_categoryz2.5.4.17postal_codez2.5.4.20telephone_numberz2.5.4.41namez2.5.4.42
given_namez2.5.4.43initialsz2.5.4.44generation_qualifierz2.5.4.45unique_identifierz2.5.4.46dn_qualifierz2.5.4.65	pseudonymz2.5.4.97organization_identifierz2.23.133.2.1tpm_manufacturerz2.23.133.2.2	tpm_modelz2.23.133.2.3tpm_versionz2.23.133.2.4platform_manufacturerz2.23.133.2.5platform_modelz2.23.133.2.6platform_versionz1.2.840.113549.1.9.1email_addressz1.3.6.1.4.1.311.60.2.1.1incorporation_localityz1.3.6.1.4.1.311.60.2.1.2incorporation_state_or_provincez1.3.6.1.4.1.311.60.2.1.3incorporation_countryz0.9.2342.19200300.100.1.1user_idz0.9.2342.19200300.100.1.25domain_componentz0.2.262.1.10.7.20name_distinguisher)!r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   c                 C   s:   |  |}|| jv r| j|}||fS t| j}||fS )z
        Returns an ordering value for a particular attribute key.

        Unrecognized attributes and OIDs will be sorted lexically at the end.

        :return:
            An orderable value.

        )mappreferred_orderindexr   )cls	attr_nameordinalr;   r;   r?   preferred_ordinalK  s   


zNameType.preferred_ordinalc                 C   s   i ddddddddd	d
dddddddddddddddddddddd d!d"i d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdD | j| jS )EzZ
        :return:
            A human-friendly unicode string to display to users
        r   zCommon Namer   Surnamer   zSerial Numberr   Countryr   Localityr   zState/Provincer   zStreet Addressr   Organizationr   zOrganizational Unitr   Titler   zBusiness Categoryr   zPostal Coder   zTelephone Numberr   Namer   z
Given Namer   Initialsr   zGeneration Qualifierr   zUnique Identifierr   zDN Qualifierr   	Pseudonymr   zEmail Addressr   zIncorporation Localityr   zIncorporation State/Provincer   zIncorporation Countryr   zDomain Componentr   zName Distinguisherr   zOrganization Identifierr   zTPM Manufacturerr   z	TPM Modelr   zTPM Versionr   zPlatform Manufacturerr   zPlatform Modelr   zPlatform Versionr   zUser ID)getr]   rb   r;   r;   r?   human_friendly_  s   	
 !"#zNameType.human_friendlyN)	rV   rW   rX   r   r   classmethodr   rr   r   r;   r;   r;   r?   r     s    	
 !"$&(.$
r   c                   @   s  e Zd ZdefdefgZdZi dededededed	ed
ededededededededededei de	dedede
dededededededed ed!ed"ed#ed$ed%eZd&Zed'd( Zd)d* Zd+d, Zd-d. Zd&S )/NameTypeAndValuer   rS   r   rS   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   Nc                 C   s"   | j du r| | d j| _ | j S )z
        Returns the value after being processed by the internationalized string
        preparation as specified by RFC 5280

        :return:
            A unicode string
        NrS   )_prepped_ldap_string_prepr]   rb   r;   r;   r?   prepped_value  s   

zNameTypeAndValue.prepped_valuec                 C   r9   r:   r;   r<   r;   r;   r?   r@     rA   zNameTypeAndValue.__ne__c                 C   s2   t |tsdS |d j| d jkrdS |j| jkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another NameTypeAndValue object

        :return:
            A boolean
        Fr   )rB   r  r]   r  r<   r;   r;   r?   rE     s
   
zNameTypeAndValue.__eq__c                 C   s  t dd|}t dd|}tjdkrt dd|}nt dd|}t dd|}|d	d}t d
d|}dttj|}t	
d|}|D ]C}t|rTttdt|r_ttdt|rjttdt|ruttdt|rttd|dkrttdqGd}d}|D ]}t|rd}qt|rd}q|rt|d }t|d }|s|r|sttddt dd|  d }|S )a"  
        Implements the internationalized string preparation algorithm from
        RFC 4518. https://tools.ietf.org/html/rfc4518#section-2

        :param string:
            A unicode string to prepare

        :return:
            A prepared unicode string, ready for comparison
        u   [­᠆͏᠋-᠍️-＀￼]+r`   u	   [	
] i  u   [-]|[-]|󠀁u   [𝅳-𝅺󠀠-󠁿󠀁]u?   [ ----۝܏᠎‌-‏‪-‮⁠-⁣⁪-⁯﻿￹-￻]+u   ​u   [   -  -   　]NFKCzc
                    X.509 Name objects may not contain unassigned code points
                    z
                    X.509 Name objects may not contain change display or
                    zzzzdeprecated characters
                    zc
                    X.509 Name objects may not contain private use characters
                    zf
                    X.509 Name objects may not contain non-character code points
                    zb
                    X.509 Name objects may not contain surrogate code points
                    u   �zf
                    X.509 Name objects may not contain the replacement character
                    FTr   rg   z{
                    X.509 Name object contains a malformed bidirectional
                    sequence
                    z +z  )resubsys
maxunicodereplacejoinr   
stringprepmap_table_b2unicodedata	normalizein_table_a1ru   r	   in_table_c8in_table_c3in_table_c4in_table_c5in_table_d1in_table_d2strip)r=   stringcharhas_r_and_al_cat	has_l_catfirst_is_r_and_allast_is_r_and_alr;   r;   r?   r    sr   





	

z"NameTypeAndValue._ldap_string_prep)rV   rW   rX   r   r   r   	_oid_pairr   r%   r"   rc   r5   r-   
_oid_specsr  rr   r  r@   rE   r  r;   r;   r;   r?   r    s    	
 !"#$'
r  c                   @   s<   e Zd ZeZedd Zdd Zdd Zdd Z	d	d
 Z
dS )RelativeDistinguishedNamec                 C   s@   g }|  | }t| D ]}|d||| f  qd|S )b
        :return:
            A unicode string that can be used as a dict key or in a set
        %s: %s)_get_valuessortedkeysappendr  )r=   outputr   keyr;   r;   r?   hashableP  s
   

z"RelativeDistinguishedName.hashablec                 C   r9   r:   r;   r<   r;   r;   r?   r@   `  rA   z RelativeDistinguishedName.__ne__c                 C   sz   t |tsdS t| t|krdS | | }| |}||kr!dS | | }| |}|D ]}|| || kr: dS q-dS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RelativeDistinguishedName object

        :return:
            A boolean
        FT)rB   r"  r   
_get_typesr&  )r=   r>   
self_typesother_typesself_valuesother_values
type_name_r;   r;   r?   rE   c  s   




z RelativeDistinguishedName.__eq__c                 C   s   t dd |D S )z
        Returns a set of types contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A set object with unicode strings of NameTypeAndValue type field
            values
        c                 S   s   g | ]}|d  j qS r   r]   .0ntvr;   r;   r?   
<listcomp>      z8RelativeDistinguishedName._get_types.<locals>.<listcomp>)rU   r=   rdnr;   r;   r?   r-    s   z$RelativeDistinguishedName._get_typesc                    s   i   fdd|D   S )a$  
        Returns a dict of prepped values contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A dict object with unicode strings of NameTypeAndValue value field
            values that have been prepped for comparison
        c                    s$   g | ]}  |d  j|jfgqS r3  )updater]   r  r5  r*  r;   r?   r8    s   $ z9RelativeDistinguishedName._get_values.<locals>.<listcomp>r;   r:  r;   r=  r?   r&    s   z%RelativeDistinguishedName._get_valuesN)rV   rW   rX   r  r   rr   r,  r@   rE   r-  r&  r;   r;   r;   r?   r"  M  s    
 r"  c                   @   s,   e Zd ZeZedd Zdd Zdd ZdS )RDNSequencec                 C   s   d dd | D S )r#  c                 s   s    | ]}|j V  qd S r:   )r,  )r6  r;  r;   r;   r?   	<genexpr>  s    z'RDNSequence.hashable.<locals>.<genexpr>)r  rb   r;   r;   r?   r,    s   
zRDNSequence.hashablec                 C   r9   r:   r;   r<   r;   r;   r?   r@     rA   zRDNSequence.__ne__c                 C   sJ   t |tsdS t| t|krdS t| D ]\}}|| |kr" dS qdS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RDNSequence object

        :return:
            A boolean
        FT)rB   r>  r   	enumerate)r=   r>   r   self_rdnr;   r;   r?   rE     s   
zRDNSequence.__eq__N)	rV   rW   rX   r"  r   rr   r,  r@   rE   r;   r;   r;   r?   r>    s    
r>  c                   @   s   e Zd ZdefgZdZdZdZedddZ	e
dd Zdd	 Zd
d Zdd Ze
dd Ze
dd Zdd Ze
dd Ze
dd ZdS )r   r`   NFc           	      C   s   g }|s	d}t }nd}t}tt| dd d}| D ]A\}}t|}|dkr/t|}n"|dkr8t|}n|t	g dv rIt
dt|d	}nt
|||d	}|tt||d
g q| dt|d	S )aY  
        Creates a Name object from a dict of unicode string keys and values.
        The keys should be from NameType._map, or a dotted-integer OID unicode
        string.

        :param name_dict:
            A dict of name information, e.g. {"common_name": "Will Bond",
            "country_name": "US", "organization_name": "Codex Non Sufficit LC"}

        :param use_printable:
            A bool - if PrintableString should be used for encoding instead of
            UTF8String. This is for backwards compatibility with old software.

        :return:
            An x509.Name object
        r   r   c                 S   s   t | d S )Nr   )r   r   )itemr;   r;   r?   <lambda>  s    zName.build.<locals>.<lambda>)r+  r   r   )r   r   r   )r   rS   r  r`   )r-   r%   r   r'  itemsr   r   rc   r5   rU   r   r)  r"  r  r>  )	r   	name_dictuse_printablerdnsencoding_nameencoding_classattribute_nameattribute_valuerS   r;   r;   r?   build  sD   



z
Name.buildc                 C   s   | j jS )r#  )chosenr,  rb   r;   r;   r?   r,    s   zName.hashablec                 C   s
   t | jS r:   )r   rN  rb   r;   r;   r?   __len__  rA   zName.__len__c                 C   r9   r:   r;   r<   r;   r;   r?   r@     rA   zName.__ne__c                 C   s   t |tsdS | j|jkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another Name object

        :return:
            A boolean
        F)rB   r   rN  r<   r;   r;   r?   rE   !  s   
zName.__eq__c                 C   s   | j d u r?t | _ | jjD ]1}|D ],}|d }|| j v r6| j | }t|ts.|g }| j |< ||d  q|d | j |< qq| j S )Nr   rS   )r   r   rN  r]   rB   listr)  )r=   r;  type_val
field_nameexistingr;   r;   r?   r]   0  s   



	zName.nativec                 C   s  | j du rt }d}| jD ])}|D ]$}|d j}|}||v r/|| g||< || |d  q|d ||< qqg }| }|dkrGtt|}|D ]}|| }	| |	}
|d||
f  qId}|D ]}|	ddkrod	} nqb|std
nd}|
|ddd | _ | j S )zg
        :return:
            A human-friendly unicode string containing the parts of the name
        Nr   rS   r   r$  F,rg   T, z; )_human_friendlyr   rN  r   r)  r(  reversedrP  _recursive_humanizerj   r  )r=   data
last_fieldr;  rQ  rR  to_joinr(  r+  rS   native_value	has_commaelement	separatorr;   r;   r?   r   @  s:   



zName.human_friendlyc                    s,   t |trdt fdd|D S |jS )z
        Recursively serializes data compiled from the RDNSequence

        :param value:
            An Asn1Value object, or a list of Asn1Value objects

        :return:
            A unicode string
        rU  c                    s   g | ]}  |qS r;   )rX  )r6  	sub_valuerb   r;   r?   r8  t  r9  z,Name._recursive_humanize.<locals>.<listcomp>)rB   rP  r  rW  r]   r\   r;   rb   r?   rX  g  s
   
zName._recursive_humanizec                 C   $   | j du rt|   | _ | j S )zZ
        :return:
            The SHA1 hash of the DER-encoded bytes of this name
        N_sha1hashlibsha1dumpdigestrb   r;   r;   r?   re  x     
z	Name.sha1c                 C   ra  )z]
        :return:
            The SHA-256 hash of the DER-encoded bytes of this name
        N_sha256rd  sha256rf  rg  rb   r;   r;   r?   rk    rh  zName.sha256)F)rV   rW   rX   r>  r   rV  rc  rj  r   rM  rr   r,  rO  r@   rE   r]   r   rX  re  rk  r;   r;   r;   r?   r     s,    <


&

r   c                   @   "   e Zd ZdefdeddifgZdS )AnotherNametype_idrS   explicitr   N)rV   rW   rX   r!   r   r   r;   r;   r;   r?   rm    r   rm  c                   @   s$   e Zd ZdZdZdefdefgZdS )CountryNamer   x121_dcc_codeiso_3166_alpha2_codeNrV   rW   rX   class_tagr    r%   r   r;   r;   r;   r?   rp        rp  c                   @   s$   e Zd ZdZdZdefdefgZdS )AdministrationDomainNamer   r   numeric	printableNrs  r;   r;   r;   r?   rw    rv  rw  c                   @      e Zd ZdefdefgZdS )PrivateDomainNamerx  ry  NrV   rW   rX   r    r%   r   r;   r;   r;   r?   r{        r{  c                   @   F   e Zd Zdeddifdedddfded	ddfd
edddfgZdS )PersonalNamer   r   r   r   r   Tr   r   r   r   r   NrV   rW   rX   r%   r   r;   r;   r;   r?   r        r  c                   @   r~  )TeletexPersonalNamer   r   r   r   r   Tr   r   r   r   r   NrV   rW   rX   r*   r   r;   r;   r;   r?   r    r  r  c                   @   r   )OrganizationalUnitNamesNrV   rW   rX   r%   r   r;   r;   r;   r?   r    r   r  c                   @   r   )TeletexOrganizationalUnitNamesN)rV   rW   rX   r*   r   r;   r;   r;   r?   r    r   r  c                   @   s   e Zd Zdeddifdeddifdedddfded	ddfd
edddfdedddfdedddfdedddfde	dddfg	Z
dS )BuiltInStandardAttributesr   r   Tadministration_domain_namenetwork_addressr   r   terminal_identifierr   private_domain_namer   ro  r   r   r   numeric_user_identifierr   personal_namer   organizational_unit_namesr   N)rV   rW   rX   rp  rw  r    r%   r{  r  r  r   r;   r;   r;   r?   r    s    r  c                   @      e Zd ZdefdefgZdS )BuiltInDomainDefinedAttributer   rS   Nr  r;   r;   r;   r?   r    r}  r  c                   @   r   )BuiltInDomainDefinedAttributesN)rV   rW   rX   r  r   r;   r;   r;   r?   r    r   r  c                   @   r  )TeletexDomainDefinedAttributer   rS   Nr  r;   r;   r;   r?   r    r}  r  c                   @   r   )TeletexDomainDefinedAttributesN)rV   rW   rX   r  r   r;   r;   r;   r?   r    r   r  c                   @   rz  )PhysicalDeliveryCountryNamerq  rr  Nr|  r;   r;   r;   r?   r    r}  r  c                   @   rz  )
PostalCodenumeric_codeprintable_codeNr|  r;   r;   r;   r?   r    r}  r  c                   @   (   e Zd ZdeddifdeddifgZdS )PDSParameterr   r   Tr   N)rV   rW   rX   r%   r*   r   r;   r;   r;   r?   r        r  c                   @   r   )PrintableAddressNr  r;   r;   r;   r?   r    r   r  c                   @   r  )UnformattedPostalAddressprintable_addressr   Tr   N)rV   rW   rX   r  r*   r   r;   r;   r;   r?   r    r  r  c                   @   s*   e Zd ZdeddifdedddfgZdS )	E1634Addressnumberr   r   sub_addressr   Tr   N)rV   rW   rX   r    r   r;   r;   r;   r?   r    s    r  c                   @   r   )
NAddressesN)rV   rW   rX   r#   r   r;   r;   r;   r?   r    r   r  c                   @   sF   e Zd Zdedddfdedddfdedddfd	ed
difgZdS )PresentationAddress
p_selectorr   Tr  
s_selectorr   
t_selectorr   n_addressesro  r   N)rV   rW   rX   r#   r  r   r;   r;   r;   r?   r    s    r  c                   @   rl  )ExtendedNetworkAddresse163_4_addresspsap_addressr   r   N)rV   rW   rX   r  r  r   r;   r;   r;   r?   r  #  r   r  c                   @   s   e Zd ZdddddddZdS )	TerminalTypetelexr   g3_facsimileg4_facsimileia5_terminalvideotex)r   r   r   r   r   r   Nr   r;   r;   r;   r?   r  *  s    
r  c                   @   s   e Zd Zi ddddddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)Zd*S )+ExtensionAttributeTyper   r   r   teletex_common_namer   teletex_organization_namer   teletex_personal_namer   teletex_organization_unit_namesr   !teletex_domain_defined_attributesr   pds_namer   physical_delivery_country_name	   r   
   physical_delivery_office_name   physical_delivery_office_numberr7   extension_of_address_components   physical_delivery_personal_name   #physical_delivery_organization_name   .extension_physical_delivery_address_componentsr   unformatted_postal_address   r   post_office_box_addressposte_restante_addressunique_postal_namelocal_postal_attributesextended_network_addressterminal_type)   r8               Nr   r;   r;   r;   r?   r  5  sV    	
r  c                   @   s   e Zd ZdeddifdeddifgZdZi ded	ed
ede	de
dedededededededededededeeeeeeedZdS )ExtensionAttributeextension_attribute_typer   r   extension_attribute_valuero  r   )r  r  r   r  r  r  r  r  r  r  r   r  r  r  r  r  r  r  r   )r  r  r  r  r  r  N)rV   rW   rX   r  r   r   r   r%   r*   r  r  r  r  r  r  r  r  r  r!  r;   r;   r;   r?   r  Q  s^    	
r  c                   @   r   )ExtensionAttributesN)rV   rW   rX   r  r   r;   r;   r;   r?   r  s  r   r  c                   @   .   e Zd ZdefdeddifdeddifgZdS )	ORAddressbuilt_in_standard_attributes"built_in_domain_defined_attributesr   Textension_attributesN)rV   rW   rX   r  r  r  r   r;   r;   r;   r?   r  w  
    r  c                   @   s*   e Zd ZdedddfdeddifgZdS )	EDIPartyNamename_assignerr   Tr   
party_namer   r   N)rV   rW   rX   r   r   r;   r;   r;   r?   r    s    r  c                   @   s   e Zd Zdeddifdeddifdeddifdedd	ifd
eddifdeddifde	ddifde
ddifdeddifg	Zdd Zdd ZdS )GeneralName
other_namer   r   rfc822_namer   dns_namer   x400_addressr   directory_namero  r   edi_party_namer   uniform_resource_identifierr   
ip_addressr   registered_idr   c                 C   r9   r:   r;   r<   r;   r;   r?   r@     rA   zGeneralName.__ne__c                 C   sP   | j dv rttd| j |j dv rttd|j | j |j kr"dS | j|jkS )z
        Does not support other_name, x400_address or edi_party_name

        :param other:
            The other GeneralName to compare to

        :return:
            A boolean
        )r  r  r  zr
                Comparison is not supported for GeneralName objects of
                choice %s
                za
                Comparison is not supported for GeneralName objects of choice
                %sF)r   ru   r	   rN  r<   r;   r;   r?   rE     s   

zGeneralName.__eq__N)rV   rW   rX   rm  rc   r5   r  r   r  rZ   rt   r!   r   r@   rE   r;   r;   r;   r?   r    s    r  c                   @   r   )GeneralNamesN)rV   rW   rX   r  r   r;   r;   r;   r?   r    r   r  c                   @   rz  )Timeutc_timegeneral_timeN)rV   rW   rX   r,   r   r   r;   r;   r;   r?   r    r}  r  c                   @   r  )Validityr   r   N)rV   rW   rX   r  r   r;   r;   r;   r?   r    r}  r  c                   @   s(   e Zd ZdeddifdeddifgZdS )BasicConstraintscadefaultFpath_len_constraintr   TN)rV   rW   rX   r   r   r   r;   r;   r;   r?   r    r  r  c                   @   s:   e Zd ZdedddfdedddfdedddfgZd	S )
AuthorityKeyIdentifierkey_identifierr   Tr   authority_cert_issuerr   authority_cert_serial_numberr   N)rV   rW   rX   r#   r  r   r   r;   r;   r;   r?   r    s
    r  c                   @   s(   e Zd ZdeddifdeddifgZdS )DistributionPointName	full_namer   r   name_relative_to_crl_issuerr   N)rV   rW   rX   r  r"  r   r;   r;   r;   r?   r    r  r  c                
   @   r   )ReasonFlagsunusedkey_compromiseca_compromiseaffiliation_changed
supersededcessation_of_operationcertificate_holdprivilege_withdrawnaa_compromiser   Nr   r;   r;   r;   r?   r    r   r  c                   @   s2   e Zd ZdefdedddfdedddfgZd	S )
GeneralSubtreebaseminimumr   r   r  maximumr   Tr   N)rV   rW   rX   r  r   r   r;   r;   r;   r?   r    
    r  c                   @   r   )GeneralSubtreesN)rV   rW   rX   r  r   r;   r;   r;   r?   r	    r   r	  c                   @   r   )NameConstraintspermitted_subtreesr   Tr   excluded_subtreesr   N)rV   rW   rX   r	  r   r;   r;   r;   r?   r
    r   r
  c                   @   sJ   e Zd Zdedddfdedddfded	ddfgZd
Zedd Z	dS )DistributionPointdistribution_pointr   Tr  reasonsr   r   
crl_issuerr   Fc                 C   sl   | j du r3d| _ | d }|jdkrttd|jD ]}|jdkr2|j}| dr2|| _  | j S q| j S )z_
        :return:
            None or a unicode string of the distribution point's URL
        FNr  r  z
                    CRL distribution points that are relative to the issuer are
                    not supported
                    r  zhttp://zhttps://zldap://zldaps://)_urlr   ru   r	   rN  r]   rD   rL   )r=   r   general_nameurlr;   r;   r?   r  
  s    



 zDistributionPoint.urlN)
rV   rW   rX   r  r  r  r   r  rr   r  r;   r;   r;   r?   r    s    r  c                   @   r   )CRLDistributionPointsN)rV   rW   rX   r  r   r;   r;   r;   r?   r  &  r   r  c                   @   s(   e Zd ZdefdefdefdefgZdS )DisplayTextr   visible_stringr   r   N)rV   rW   rX   r   r.   r   r-   r   r;   r;   r;   r?   r  *  s    r  c                   @   r   )NoticeNumbersNrV   rW   rX   r   r   r;   r;   r;   r?   r  3  r   r  c                   @   rz  )NoticeReferenceorganizationnotice_numbersN)rV   rW   rX   r  r  r   r;   r;   r;   r?   r  7  r}  r  c                   @   r  )
UserNotice
notice_refr   Texplicit_textN)rV   rW   rX   r  r  r   r;   r;   r;   r?   r  >  r  r  c                   @   s   e Zd ZdddZdS )PolicyQualifierId certification_practice_statementuser_notice)z1.3.6.1.5.5.7.2.1z1.3.6.1.5.5.7.2.2Nr   r;   r;   r;   r?   r   E  s    
r   c                   @   s*   e Zd ZdefdefgZdZeedZ	dS )PolicyQualifierInfopolicy_qualifier_id	qualifier)r$  r%  )r!  r"  N)
rV   rW   rX   r   r   r   r   r   r  r!  r;   r;   r;   r?   r#  L  s    
r#  c                   @   r   )PolicyQualifierInfosN)rV   rW   rX   r#  r   r;   r;   r;   r?   r&  Y  r   r&  c                   @   s   e Zd ZddiZdS )PolicyIdentifierz2.5.29.32.0
any_policyNr   r;   r;   r;   r?   r'  ]  s    r'  c                   @   rl  )PolicyInformationpolicy_identifierpolicy_qualifiersr   TN)rV   rW   rX   r'  r&  r   r;   r;   r;   r?   r)  c  r   r)  c                   @   r   )CertificatePoliciesN)rV   rW   rX   r)  r   r;   r;   r;   r?   r,  j  r   r,  c                   @   r  )PolicyMappingissuer_domain_policysubject_domain_policyN)rV   rW   rX   r'  r   r;   r;   r;   r?   r-  n  r}  r-  c                   @   r   )PolicyMappingsN)rV   rW   rX   r-  r   r;   r;   r;   r?   r0  u  r   r0  c                   @   r   )PolicyConstraintsrequire_explicit_policyr   Tr   inhibit_policy_mappingr   NrV   rW   rX   r   r   r;   r;   r;   r?   r1  y  r   r1  c                   @   s  e Zd Zi ddddddddd	d
dddddddddddddddddddddd d!d"i d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDi dEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfi dgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~ddddddddddi ddddddddddddddddddddddddddddddddddZdS )KeyPurposeIdz2.5.29.37.0any_extended_key_usagez1.3.6.1.5.5.7.3.1server_authz1.3.6.1.5.5.7.3.2client_authz1.3.6.1.5.5.7.3.3code_signingz1.3.6.1.5.5.7.3.4email_protectionz1.3.6.1.5.5.7.3.5ipsec_end_systemz1.3.6.1.5.5.7.3.6ipsec_tunnelz1.3.6.1.5.5.7.3.7
ipsec_userz1.3.6.1.5.5.7.3.8time_stampingz1.3.6.1.5.5.7.3.9ocsp_signingz1.3.6.1.5.5.7.3.10dvcsz1.3.6.1.5.5.7.3.13eap_over_pppz1.3.6.1.5.5.7.3.14eap_over_lanz1.3.6.1.5.5.7.3.15scvp_serverz1.3.6.1.5.5.7.3.16scvp_clientz1.3.6.1.5.5.7.3.17	ipsec_ikez1.3.6.1.5.5.7.3.18	capwap_acz1.3.6.1.5.5.7.3.19
capwap_wtpz1.3.6.1.5.5.7.3.20
sip_domainz1.3.6.1.5.5.7.3.21secure_shell_clientz1.3.6.1.5.5.7.3.22secure_shell_serverz1.3.6.1.5.5.7.3.23send_routerz1.3.6.1.5.5.7.3.24send_proxied_routerz1.3.6.1.5.5.7.3.25
send_ownerz1.3.6.1.5.5.7.3.26send_proxied_ownerz1.3.6.1.5.5.7.3.27cmc_caz1.3.6.1.5.5.7.3.28cmc_raz1.3.6.1.5.5.7.3.29cmc_archivez1.3.6.1.5.5.7.3.30bgpspec_routerz1.3.6.1.5.5.8.2.2ike_intermediatez1.3.6.1.4.1.311.10.3.1microsoft_trust_list_signingz1.3.6.1.4.1.311.10.3.2microsoft_time_stamp_signingz1.3.6.1.4.1.311.10.3.3microsoft_server_gatedz1.3.6.1.4.1.311.10.3.3.1microsoft_serializedz1.3.6.1.4.1.311.10.3.4microsoft_efsz1.3.6.1.4.1.311.10.3.4.1microsoft_efs_recoveryz1.3.6.1.4.1.311.10.3.5microsoft_whqlz1.3.6.1.4.1.311.10.3.6microsoft_nt5z1.3.6.1.4.1.311.10.3.7microsoft_oem_whqlz1.3.6.1.4.1.311.10.3.8microsoft_embedded_ntz1.3.6.1.4.1.311.10.3.9microsoft_root_list_signerz1.3.6.1.4.1.311.10.3.10!microsoft_qualified_subordinationz1.3.6.1.4.1.311.10.3.11microsoft_key_recoveryz1.3.6.1.4.1.311.10.3.12microsoft_document_signingz1.3.6.1.4.1.311.10.3.13microsoft_lifetime_signingz1.3.6.1.4.1.311.10.3.14 microsoft_mobile_device_softwarez1.3.6.1.4.1.311.20.2.2microsoft_smart_card_logonz1.2.840.113635.100.1.2apple_x509_basicz1.2.840.113635.100.1.3	apple_sslz1.2.840.113635.100.1.4apple_local_cert_genz1.2.840.113635.100.1.5apple_csr_genz1.2.840.113635.100.1.6apple_revocation_crlz1.2.840.113635.100.1.7apple_revocation_ocspz1.2.840.113635.100.1.8apple_smimez1.2.840.113635.100.1.9	apple_eapz1.2.840.113635.100.1.10apple_software_update_signingz1.2.840.113635.100.1.11apple_ipsecz1.2.840.113635.100.1.12apple_ichatz1.2.840.113635.100.1.13apple_resource_signingz1.2.840.113635.100.1.14apple_pkinit_clientz1.2.840.113635.100.1.15apple_pkinit_serverz1.2.840.113635.100.1.16apple_code_signingz1.2.840.113635.100.1.17apple_package_signingz1.2.840.113635.100.1.18apple_id_validationz1.2.840.113635.100.1.20apple_time_stampingz1.2.840.113635.100.1.21apple_revocationz1.2.840.113635.100.1.22apple_passbook_signingz1.2.840.113635.100.1.23apple_mobile_storez1.2.840.113635.100.1.24apple_escrow_servicez1.2.840.113635.100.1.25apple_profile_signerz1.2.840.113635.100.1.26apple_qa_profile_signerz1.2.840.113635.100.1.27apple_test_mobile_storez1.2.840.113635.100.1.28apple_otapki_signerz1.2.840.113635.100.1.29apple_test_otapki_signerz1.2.840.113625.100.1.30)apple_id_validation_record_signing_policyz1.2.840.113625.100.1.31apple_smp_encryptionz1.2.840.113625.100.1.32apple_test_smp_encryptionz1.2.840.113635.100.1.33apple_server_authenticationz1.2.840.113635.100.1.34apple_pcs_escrow_servicez2.16.840.1.101.3.6.8piv_card_authenticationz2.16.840.1.101.3.6.7piv_content_signingz1.3.6.1.5.2.3.4pkinit_kpclientauthz1.3.6.1.5.2.3.5pkinit_kpkdcz1.2.840.113583.1.1.5adobe_authentic_documents_trustz2.16.840.1.101.3.8.7fpki_pivi_content_signingNr   r;   r;   r;   r?   r5    sX   	
 !"$%&(*-./0123456789:;<>BCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`acdfgik
r5  c                   @   r   )ExtKeyUsageSyntaxNrV   rW   rX   r5  r   r;   r;   r;   r?   r    r   r  c                   @      e Zd ZdddddZdS )AccessMethodocsp
ca_issuersr>  ca_repository)z1.3.6.1.5.5.7.48.1z1.3.6.1.5.5.7.48.2z1.3.6.1.5.5.7.48.3z1.3.6.1.5.5.7.48.5Nr   r;   r;   r;   r?   r        
r  c                   @   rz  )AccessDescriptionaccess_methodaccess_locationN)rV   rW   rX   r  r  r   r;   r;   r;   r?   r    r}  r  c                   @   r   )AuthorityInfoAccessSyntaxNrV   rW   rX   r  r   r;   r;   r;   r?   r    r   r  c                   @   r   )SubjectInfoAccessSyntaxNr  r;   r;   r;   r?   r    r   r  c                   @   r   )FeaturesNr  r;   r;   r;   r?   r    r   r  c                   @   rz  )EntrustVersionInfoentrust_versentrust_info_flagsN)rV   rW   rX   r   r   r   r;   r;   r;   r?   r    r}  r  c                	   @   s"   e Zd Zddddddddd	Zd
S )NetscapeCertificateType
ssl_client
ssl_serveremailobject_signingreservedssl_caemail_caobject_signing_ca)r   r   r   r   r   r   r   r   Nr   r;   r;   r;   r?   r    s    
r  c                   @      e Zd ZddddZdS )Versionv1v2v3r   r   r   Nr   r;   r;   r;   r?   r  %  
    
r  c                   @   s"   e Zd ZdefdefdefgZdS )TPMSpecificationr   levelrevisionN)rV   rW   rX   r-   r   r   r;   r;   r;   r?   r  -  
    r  c                   @   r   )SetOfTPMSpecificationN)rV   rW   rX   r  r   r;   r;   r;   r?   r  5  r   r  c                   @   s"   e Zd ZdefdefdefgZdS )TCGSpecificationVersionmajor_versionminor_versionr  Nr4  r;   r;   r;   r?   r  9  r  r  c                   @   rz  )TCGPlatformSpecificationversionplatform_classN)rV   rW   rX   r  r#   r   r;   r;   r;   r?   r  A  r}  r  c                   @   r   )SetOfTCGPlatformSpecificationN)rV   rW   rX   r  r   r;   r;   r;   r?   r  H  r   r  c                   @   r  )EKGenerationTypeinternalinjectedinternal_revocableinjected_revocable)r   r   r   r   Nr   r;   r;   r;   r?   r  L  r  r  c                   @   r  )EKGenerationLocationr   r   ek_cert_signerr  Nr   r;   r;   r;   r?   r  U  r  r  c                   @   r  )EKCertificateGenerationLocationr   r   r  r  Nr   r;   r;   r;   r?   r  ]  r  r  c                   @   s    e Zd ZddddddddZd	S )
EvaluationAssuranceLevellevel1level2level3level4level5level6level7)r   r   r   r   r   r   r   Nr   r;   r;   r;   r?   r  e  s    
r  c                   @   r  )EvaluationStatusdesigned_to_meetevaluation_in_progressevaluation_completedr  Nr   r;   r;   r;   r?   r  q  r  r  c                   @   r  )StrengthOfFunctionbasicmediumhighr  Nr   r;   r;   r;   r?   r  y  r  r  c                   @   r  )URIReferencer  hash_algorithmr   T
hash_valueN)rV   rW   rX   r   r   r   r   r;   r;   r;   r?   r    r  r  c                   @   st   e Zd Zdefdefdefdeddifdedd	d
fdedd	d
fde	dd	d
fdedd	d
fde	dd	d
fg	Z
dS )CommonCriteriaMeasuresr  assurance_levelevaluation_statusplusr  Fstrengh_of_functionr   Tr   profile_oidr   profile_urlr   
target_oidr   
target_urir   N)rV   rW   rX   r   r  r  r   r  r!   r  r   r;   r;   r;   r?   r    s    r  c                   @   r  )SecurityLevelr  r  r  r  )r   r   r   r   Nr   r;   r;   r;   r?   r    r  r  c                   @   s(   e Zd ZdefdefdeddifgZdS )	FIPSLevelr  r  r  r  FN)rV   rW   rX   r   r  r   r   r;   r;   r;   r?   r    s
    r  c                   @   s   e Zd Zdeddifdeddifdeddd	fd
eddd	fdeddd	fdeddd	fde	ddd	fdedddfde
ddifg	ZdS )TPMSecurityAssertionsr  r  r  field_upgradableFek_generation_typer   Tr   ek_generation_locationr   "ek_certificate_generation_locationr   cc_infor   
fips_levelr   iso_9000_certifiedr   r  iso_9000_urir   N)rV   rW   rX   r  r   r  r  r  r  r  r   r   r;   r;   r;   r?   r    s    r  c                   @   r   )SetOfTPMSecurityAssertionsN)rV   rW   rX   r  r   r;   r;   r;   r?   r    r   r  c                   @   s&   e Zd Zddddddddd	d
d
ZdS )SubjectDirectoryAttributeIdsupported_algorithmstpm_specificationtcg_platform_specificationtpm_security_assertionspda_date_of_birthpda_place_of_birth
pda_genderpda_country_of_citizenshippda_country_of_residenceentrust_user_role)
z2.5.4.52z2.23.133.2.16z2.23.133.2.17z2.23.133.2.18z1.3.6.1.5.5.7.9.1z1.3.6.1.5.5.7.9.2z1.3.6.1.5.5.7.9.3z1.3.6.1.5.5.7.9.4z1.3.6.1.5.5.7.9.5z1.2.840.113533.7.68.29Nr   r;   r;   r;   r?   r    s    
r  c                   @   r   )SetOfGeneralizedTimeN)rV   rW   rX   r   r   r;   r;   r;   r?   r    r   r  c                   @   r   )SetOfDirectoryStringN)rV   rW   rX   r   r   r;   r;   r;   r?   r    r   r  c                   @   r   )SetOfPrintableStringNr  r;   r;   r;   r?   r    r   r  c                   @   s2   e Zd ZdefdedddfdedddfgZdS )	SupportedAlgorithmalgorithm_identifierintended_usager   Tr  intended_certificate_policiesr   N)rV   rW   rX   r   r   r,  r   r;   r;   r;   r?   r    r  r  c                   @   r   )SetOfSupportedAlgorithmN)rV   rW   rX   r  r   r;   r;   r;   r?   r    r   r  c                
   @   sH   e Zd ZdefdefgZdZeee	e
eeeeed	Zdd ZdeiZdS )SubjectDirectoryAttributer   r   )r   r   )	r  r  r  r  r  r  r  r  r  c                 C   s"   | d j }|| jv r| j| S tS )Nr   )r]   r!  r)   )r=   type_r;   r;   r?   _values_spec  s   


z&SubjectDirectoryAttribute._values_specN)rV   rW   rX   r  r   r   r   r  r  r  r  r  r  r  r!  r  _spec_callbacksr;   r;   r;   r?   r    s$    r  c                   @   r   )SubjectDirectoryAttributesN)rV   rW   rX   r  r   r;   r;   r;   r?   r     r   r   c                	   @   s   e Zd Zi ddddddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*Zd+S ),ExtensionIdz2.5.29.9subject_directory_attributesz	2.5.29.14r  z	2.5.29.15	key_usagez	2.5.29.16private_key_usage_periodz	2.5.29.17subject_alt_namez	2.5.29.18issuer_alt_namez	2.5.29.19basic_constraintsz	2.5.29.30name_constraintsz	2.5.29.31crl_distribution_pointsz	2.5.29.32certificate_policiesz	2.5.29.33policy_mappingsz	2.5.29.35authority_key_identifierz	2.5.29.36policy_constraintsz	2.5.29.37extended_key_usagez	2.5.29.46freshest_crlz	2.5.29.54inhibit_any_policyz1.3.6.1.5.5.7.1.1authority_information_accesssubject_information_accesstls_featureocsp_no_checkentrust_version_extensionnetscape_certificate_type!signed_certificate_timestamp_listmicrosoft_enroll_certtype)z1.3.6.1.5.5.7.1.11z1.3.6.1.5.5.7.1.24z1.3.6.1.5.5.7.48.1.5z1.2.840.113533.7.65.0z2.16.840.1.113730.1.1z1.3.6.1.4.1.11129.2.4.2z1.3.6.1.4.1.311.20.2Nr   r;   r;   r;   r?   r    sX    	
r  c                	   @   s   e Zd ZdefdeddifdefgZdZi dede	d	e
d
edededededededededededededeeeeeee	edZdS )	Extensionextn_idcriticalr  F
extn_value)r  r  r  r  r  r  r  r  r  r  r	  r
  r  r  r  r  r  r  r  )r  r  r  r  r  r  r  N)rV   rW   rX   r  r   r$   r   r   r   r#   r   r   r  r  r
  r  r,  r0  r  r1  r  r   r  r  r  r   r  r  r   r!  r;   r;   r;   r?   r  '  sb    	
r  c                   @   r   )
ExtensionsN)rV   rW   rX   r  r   r;   r;   r;   r?   r  M  r   r  c                   @   sl   e Zd Zdedddfdefdefdefdefd	efd
efde	dddfde	dddfde
dddfg
ZdS )TbsCertificater  r   r  )ro  r  r   	signatureissuervaliditysubjectsubject_public_key_infoissuer_unique_idr   Tr   subject_unique_idr   
extensionsr   r  N)rV   rW   rX   r  r   r   r   r  r0   r"   r  r   r;   r;   r;   r?   r  Q  s    r  c                   @   s  e Zd ZdefdefdefgZdZdZdZ	dZ
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dd Z'e(dd	 Z)e(d
d Z*e(dd Z+e(dd Z,e(dd Z-e(dd Z.e(dd Z/e(dd Z0e(dd Z1e(dd Z2e(dd Z3e(dd Z4e(d d! Z5e(d"d# Z6e(d$d% Z7e(d&d' Z8e(d(d) Z9e(d*d+ Z:e(d,d- Z;e(d.d/ Z<e(d0d1 Z=e(d2d3 Z>e(d4d5 Z?e(d6d7 Z@e(d8d9 ZAe(d:d; ZBe(d<d= ZCe(d>d? ZDe(d@dA ZEe(dBdC ZFe(dDdE ZGe(dFdG ZHe(dHdI ZIe(dJdK ZJe(dLdM ZKe(dNdO ZLdPdQ ZMe(dRdS ZNe(dTdU ZOe(dVdW ZPe(dXdY ZQe(dZd[ ZRe(d\d] ZSe(d^d_ ZTe(d`da ZUe(dbdc ZVe(ddde ZWe(dfdg ZXdhdi ZYdjdk ZZdldm Z[dS )nCertificatetbs_certificatesignature_algorithmsignature_valueFNc                 C   sh   t  | _| d d D ]$}|d j}d| }t| |r#t| ||d j |d jr.| j| q
d| _dS )	zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r(  r&  r  z	_%s_valuer  r  TN)rU   _critical_extensionsr]   hasattrsetattrparsedadd_processed_extensions)r=   	extensionr   rK  r;   r;   r?   _set_extensions  s   



zCertificate._set_extensionsc                 C      | j s|   | jS )z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r0  r2  r+  rb   r;   r;   r?   critical_extensions     
zCertificate.critical_extensionsc                 C   r3  )z
        This extension is used to constrain the period over which the subject
        private key may be used

        :return:
            None or a PrivateKeyUsagePeriod object
        )r0  r2  _private_key_usage_period_valuerb   r;   r;   r?   private_key_usage_period_value  r5  z*Certificate.private_key_usage_period_valuec                 C   r3  )z
        This extension is used to contain additional identification attributes
        about the subject.

        :return:
            None or a SubjectDirectoryAttributes object
        )r0  r2  #_subject_directory_attributes_valuerb   r;   r;   r?   "subject_directory_attributes_value  r5  z.Certificate.subject_directory_attributes_valuec                 C   r3  )z
        This extension is used to help in creating certificate validation paths.
        It contains an identifier that should generally, but is not guaranteed
        to, be unique.

        :return:
            None or an OctetString object
        )r0  r2  _key_identifier_valuerb   r;   r;   r?   key_identifier_value     z Certificate.key_identifier_valuec                 C   r3  )z
        This extension is used to define the purpose of the public key
        contained within the certificate.

        :return:
            None or a KeyUsage
        )r0  r2  _key_usage_valuerb   r;   r;   r?   key_usage_value  r5  zCertificate.key_usage_valuec                 C   r3  )aT  
        This extension allows for additional names to be associate with the
        subject of the certificate. While it may contain a whole host of
        possible names, it is usually used to allow certificates to be used
        with multiple different domain names.

        :return:
            None or a GeneralNames object
        )r0  r2  _subject_alt_name_valuerb   r;   r;   r?   subject_alt_name_value     z"Certificate.subject_alt_name_valuec                 C   r3  )z
        This extension allows associating one or more alternative names with
        the issuer of the certificate.

        :return:
            None or an x509.GeneralNames object
        )r0  r2  _issuer_alt_name_valuerb   r;   r;   r?   issuer_alt_name_value  r5  z!Certificate.issuer_alt_name_valuec                 C   r3  )a'  
        This extension is used to determine if the subject of the certificate
        is a CA, and if so, what the maximum number of intermediate CA certs
        after this are, before an end-entity certificate is found.

        :return:
            None or a BasicConstraints object
        )r0  r2  _basic_constraints_valuerb   r;   r;   r?   basic_constraints_value  r<  z#Certificate.basic_constraints_valuec                 C   r3  )z
        This extension is used in CA certificates, and is used to limit the
        possible names of certificates issued.

        :return:
            None or a NameConstraints object
        )r0  r2  _name_constraints_valuerb   r;   r;   r?   name_constraints_value	  r5  z"Certificate.name_constraints_valuec                 C   r3  )z
        This extension is used to help in locating the CRL for this certificate.

        :return:
            None or a CRLDistributionPoints object
            extension
        )r0  r2  _crl_distribution_points_valuerb   r;   r;   r?   crl_distribution_points_value	  r5  z)Certificate.crl_distribution_points_valuec                 C   r3  )a;  
        This extension defines policies in CA certificates under which
        certificates may be issued. In end-entity certificates, the inclusion
        of a policy indicates the issuance of the certificate follows the
        policy.

        :return:
            None or a CertificatePolicies object
        )r0  r2  _certificate_policies_valuerb   r;   r;   r?   certificate_policies_value*	  rA  z&Certificate.certificate_policies_valuec                 C   r3  )z
        This extension allows mapping policy OIDs to other OIDs. This is used
        to allow different policies to be treated as equivalent in the process
        of validation.

        :return:
            None or a PolicyMappings object
        )r0  r2  _policy_mappings_valuerb   r;   r;   r?   policy_mappings_value:	  r<  z!Certificate.policy_mappings_valuec                 C   r3  )z
        This extension helps in identifying the public key with which to
        validate the authenticity of the certificate.

        :return:
            None or an AuthorityKeyIdentifier object
        )r0  r2  _authority_key_identifier_valuerb   r;   r;   r?   authority_key_identifier_valueI	  r5  z*Certificate.authority_key_identifier_valuec                 C   r3  )z
        This extension is used to control if policy mapping is allowed and
        when policies are required.

        :return:
            None or a PolicyConstraints object
        )r0  r2  _policy_constraints_valuerb   r;   r;   r?   policy_constraints_valueW	  r5  z$Certificate.policy_constraints_valuec                 C   r3  )z
        This extension is used to help locate any available delta CRLs

        :return:
            None or an CRLDistributionPoints object
        )r0  r2  _freshest_crl_valuerb   r;   r;   r?   freshest_crl_valuee	  s   	zCertificate.freshest_crl_valuec                 C   r3  )z
        This extension is used to prevent mapping of the any policy to
        specific requirements

        :return:
            None or a Integer object
        )r0  r2  _inhibit_any_policy_valuerb   r;   r;   r?   inhibit_any_policy_valuer	  r5  z$Certificate.inhibit_any_policy_valuec                 C   r3  )z
        This extension is used to define additional purposes for the public key
        beyond what is contained in the basic constraints.

        :return:
            None or an ExtKeyUsageSyntax object
        )r0  r2  _extended_key_usage_valuerb   r;   r;   r?   extended_key_usage_value	  r5  z$Certificate.extended_key_usage_valuec                 C   r3  )z
        This extension is used to locate the CA certificate used to sign this
        certificate, or the OCSP responder for this certificate.

        :return:
            None or an AuthorityInfoAccessSyntax object
        )r0  r2  #_authority_information_access_valuerb   r;   r;   r?   "authority_information_access_value	  r5  z.Certificate.authority_information_access_valuec                 C   r3  )z
        This extension is used to access information about the subject of this
        certificate.

        :return:
            None or a SubjectInfoAccessSyntax object
        )r0  r2  !_subject_information_access_valuerb   r;   r;   r?    subject_information_access_value	  r5  z,Certificate.subject_information_access_valuec                 C   r3  )z
        This extension is used to list the TLS features a server must respond
        with if a client initiates a request supporting them.

        :return:
            None or a Features object
        )r0  r2  _tls_feature_valuerb   r;   r;   r?   tls_feature_value	  r5  zCertificate.tls_feature_valuec                 C   r3  )a-  
        This extension is used on certificates of OCSP responders, indicating
        that revocation information for the certificate should never need to
        be verified, thus preventing possible loops in path validation.

        :return:
            None or a Null object (if present)
        )r0  r2  _ocsp_no_check_valuerb   r;   r;   r?   ocsp_no_check_value	  r<  zCertificate.ocsp_no_check_valuec                 C   
   | d j S )zE
        :return:
            A byte string of the signature
        r*  r4  rb   r;   r;   r?   r  	     
zCertificate.signaturec                 C   r`  )zj
        :return:
            A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
        r)  )signature_algorb   r;   r;   r?   rb  	  ra  zCertificate.signature_algoc                 C   r`  )z
        :return:
            A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
            "sha384", "sha512", "sha512_224", "sha512_256"
        r)  )	hash_algorb   r;   r;   r?   rc  	  s   
zCertificate.hash_algoc                 C      | d d S )zT
        :return:
            The PublicKeyInfo object for this certificate
        r(  r#  r;   rb   r;   r;   r?   
public_key	     zCertificate.public_keyc                 C   rd  )zZ
        :return:
            The Name object for the subject of this certificate
        r(  r"  r;   rb   r;   r;   r?   r"  	  rf  zCertificate.subjectc                 C   rd  )zY
        :return:
            The Name object for the issuer of this certificate
        r(  r   r;   rb   r;   r;   r?   r   	  rf  zCertificate.issuerc                 C   s   | d d j S )zT
        :return:
            An integer of the certificate's serial number
        r(  r   r4  rb   r;   r;   r?   r   	  s   zCertificate.serial_numberc                 C   s   | j sdS | j jS )z
        :return:
            None or a byte string of the certificate's key identifier from the
            key identifier extension
        N)r;  r]   rb   r;   r;   r?   r  
  s   zCertificate.key_identifierc                 C   s.   | j du r| jjd t| jd | _ | j S )z
        :return:
            A byte string of the SHA-256 hash of the issuer concatenated with
            the ascii character ":", concatenated with the serial number as
            an ascii string
        N   :rh   )_issuer_serialr   rk  r   r   rM   rb   r;   r;   r?   issuer_serial
  s   
	zCertificate.issuer_serialc                 C      | d d d j S )zd
        :return:
            A datetime of latest time when the certificate is still valid
        r(  r!  r   r4  rb   r;   r;   r?   not_valid_after!
     zCertificate.not_valid_afterc                 C   rj  )zd
        :return:
            A datetime of the earliest time when the certificate is valid
        r(  r!  r   r4  rb   r;   r;   r?   not_valid_before)
  rl  zCertificate.not_valid_beforec                 C   s   | j sdS | j d jS )z
        :return:
            None or a byte string of the key_identifier from the authority key
            identifier extension
        Nr  )rO  r]   rb   r;   r;   r?   r  1
  s   z$Certificate.authority_key_identifierc                 C   sn   | j du r4| j}|r1|d jr1| jd d j}| }| jd j}|jd t|d | _ | j S d| _ | j S )a;  
        :return:
            None or a byte string of the SHA-256 hash of the isser from the
            authority key identifier extension concatenated with the ascii
            character ":", concatenated with the serial number from the
            authority key identifier extension as an ascii string
        Fr  r   r  rg  rh   N)_authority_issuer_serialrO  r]   rN  untagrk  r   rM   )r=   akivr   authority_serialr;   r;   r?   authority_issuer_serial>
  s   

z#Certificate.authority_issuer_serialc                 C      | j du r| | j| _ | j S )z
        Returns complete CRL URLs - does not include delta CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)_crl_distribution_points!_get_http_crl_distribution_pointsrI  rb   r;   r;   r?   r	  T
     
	z#Certificate.crl_distribution_pointsc                 C   rs  )z
        Returns delta CRL URLs - does not include complete CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)_delta_crl_distribution_pointsru  rS  rb   r;   r;   r?   delta_crl_distribution_pointsa
  rv  z)Certificate.delta_crl_distribution_pointsc                 C   s\   g }|du rg S |D ]!}|d }|t u rq
|jdkrq
|jD ]}|jdkr*|| qq
|S )a?  
        Fetches the DistributionPoint object for non-relative, HTTP CRLs
        referenced by the certificate

        :param crl_distribution_points:
            A CRLDistributionPoints object to grab the DistributionPoints from

        :return:
            A list of zero or more DistributionPoint objects
        Nr  r  r  )r/   r   rN  r)  )r=   r	  r*  r  distribution_point_namer  r;   r;   r?   ru  n
  s   



z-Certificate._get_http_crl_distribution_pointsc                 C   s^   | j sg S g }| j D ]"}|d jdkr,|d }|jdkrq
|j}| dr,|| q
|S )zx
        :return:
            A list of zero or more unicode strings of the OCSP URLs for this
            cert
        r  r  r  r  r  )rY  r]   r   rD   rL   r)  )r=   r*  entrylocationr  r;   r;   r?   	ocsp_urls
  s   


zCertificate.ocsp_urlsc                 C   s   | j du rNg | _ | jr&| jD ]}|jdkr"|j| j vr"| j |j q| j S td}| jjD ]}|D ]}|d jdkrL|d j}|	|rL| j | q3q/| j S )z
        :return:
            A list of unicode strings of valid domain names for the certificate.
            Wildcard certificates will have a domain in the form: *.example.com
        Nr  zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r   r   rS   )
_valid_domainsr@  r   r]   r)  r  compiler"  rN  match)r=   r  patternr;  name_type_valuerS   r;   r;   r?   valid_domains
  s$   




zCertificate.valid_domainsc                 C   s@   | j du rg | _ | jr| jD ]}|jdkr| j |j q| j S )zj
        :return:
            A list of unicode strings of valid IP addresses for the certificate
        Nr  )
_valid_ipsr@  r   r)  r]   )r=   r  r;   r;   r?   	valid_ips
  s   


zCertificate.valid_ipsc                 C   s   | j o| j d jS )zW
        :return;
            A boolean - if the certificate is marked as a CA
        r  )rE  r]   rb   r;   r;   r?   r  
  s   zCertificate.cac                 C   s   | j sdS | jd jS )zT
        :return;
            None or an integer of the maximum path length
        Nr  )r  rE  r]   rb   r;   r;   r?   max_path_length
  s   zCertificate.max_path_lengthc                 C   s   | j du r| j| jk| _ | j S )zx
        :return:
            A boolean - if the certificate is self-issued, as defined by RFC
            5280
        N)_self_issuedr"  r   rb   r;   r;   r?   self_issued
  s   
zCertificate.self_issuedc                 C   sR   | j du r&d| _ | jr&| jr#| jsd| _ | j S | j| jkr d| _ | j S d| _ | j S )a  
        :return:
            A unicode string of "no" or "maybe". The "maybe" result will
            be returned if the certificate issuer and subject are the same.
            If a key identifier and authority key identifier are present,
            they will need to match otherwise "no" will be returned.

            To verify is a certificate is truly self-signed, the signature
            will need to be verified. See the certvalidator package for
            one possible solution.
        Nnomaybe)_self_signedr  r  r  rb   r;   r;   r?   self_signed
  s   
zCertificate.self_signedc                 C   ra  )zk
        :return:
            The SHA-1 hash of the DER-encoded bytes of this complete certificate
        Nrb  rb   r;   r;   r?   re    rh  zCertificate.sha1c                 C      d dd t| jD S )z
        :return:
            A unicode string of the SHA-1 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r  c                 s       | ]}d | V  qdS z%02XNr;   r6  cr;   r;   r?   r@  $      z/Certificate.sha1_fingerprint.<locals>.<genexpr>)r  r   re  rb   r;   r;   r?   sha1_fingerprint     zCertificate.sha1_fingerprintc                 C   ra  )zy
        :return:
            The SHA-256 hash of the DER-encoded bytes of this complete
            certificate
        Nri  rb   r;   r;   r?   rk  &  s   
zCertificate.sha256c                 C   r  )z
        :return:
            A unicode string of the SHA-256 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r  c                 s   r  r  r;   r  r;   r;   r?   r@  :  r  z1Certificate.sha256_fingerprint.<locals>.<genexpr>)r  r   rk  rb   r;   r;   r?   sha256_fingerprint2  r  zCertificate.sha256_fingerprintc                 C   sH  t |tsttdt||dd }|ddk}| o't	
d|}| o-| }|rq| js5dS |d}| jD ]1}|dd }|d}	t|	t|krWq=|	|kr^ d	S | |}
|
rn| ||	rn d	S q=dS | jsvdS |r{tjntj}t||}| jD ]}|ddkrtjntj}t||}||kr d	S qdS )
a  
        Check if a domain name or IP address is valid according to the
        certificate

        :param domain_ip:
            A unicode string of a domain name or IP address

        :return:
            A boolean - if the domain or IP is valid for the certificate
        zL
                domain_ip must be a unicode string, not %s
                r   rh   rz   rg   z^\d+\.\d+\.\d+\.\d+$FrH   T)rB   r   rK   r	   r   rM   ro   rD   rj   r  r  r  r   r   _is_wildcard_domain_is_wildcard_matchr  r   r   r   r4   )r=   	domain_ipencoded_domain_ipis_ipv6is_ipv4	is_domaindomain_labelsvalid_domainencoded_valid_domainvalid_domain_labelsis_wildcardr   normalized_ipvalid_ipvalid_familynormalized_valid_ipr;   r;   r?   is_valid_domain_ip<  sH   







zCertificate.is_valid_domain_ipc                 C   sZ   | ddkr	dS | d}|sdS |d ddkrdS |d dd dkr+dS d	S )
af  
        Checks if a domain is a valid wildcard according to
        https://tools.ietf.org/html/rfc6125#section-6.4.3

        :param domain:
            A unicode string of the domain name, where any U-labels from an IDN
            have been converted to A-labels

        :return:
            A boolean - if the domain is a valid wildcard domain
        *r   FrH   r   rg   r   zxn--T)countrD   r   rj   )r=   domainlabelsr;   r;   r?   r  ~  s   zCertificate._is_wildcard_domainc                 C   sl   |d }|dd }|d }|dd }||krdS |dkr dS t d|dd d	 }||r4dS dS )
a  
        Determines if the labels in a domain are a match for labels from a
        wildcard valid domain name

        :param domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in the domain name to check

        :param valid_domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in a wildcard domain pattern

        :return:
            A boolean - if the domain matches the valid domain
        r   r   NFr  T^z.*$)r  r~  r  r  )r=   r  r  first_domain_labelother_domain_labelswildcard_labelother_valid_domain_labelswildcard_regexr;   r;   r?   r    s   
zCertificate._is_wildcard_match)\rV   rW   rX   r  r   r"   r   r0  r+  r8  r:  r=  r?  rB  rD  rF  rH  rJ  rL  rN  rP  rR  rT  rV  rX  rZ  r6  r\  r^  rh  rn  rt  rw  r}  r  r  r  rc  rj  r2  rr   r4  r7  r9  r;  r>  r@  rC  rE  rG  rI  rK  rM  rO  rQ  rS  rU  rW  rY  r[  r]  r_  r  rb  rc  re  r"  r   r   r  ri  rk  rm  r  rr  r	  rx  ru  r|  r  r  r  r  r  r  re  r  rk  r  r  r  r  r;   r;   r;   r?   r'  `  s   























	













"








	

	B!r'  c                   @   r   )KeyPurposeIdentifiersNr  r;   r;   r;   r?   r    r   r  c                   @   r   )SequenceOfAlgorithmIdentifiersN)rV   rW   rX   r   r   r;   r;   r;   r?   r    r   r  c                	   @   sP   e Zd Zdeddifdedddfdeddifdeddifd	ed
ddfgZdS )CertificateAuxtrustr   Trejectr   r   aliaskeyidr>   r   N)rV   rW   rX   r  r-   r#   r  r   r;   r;   r;   r?   r    s    r  c                   @   s   e Zd ZeegZdS )TrustedCertificateN)rV   rW   rX   r'  r  _child_specsr;   r;   r;   r?   r    s    r  )r   
__future__r   r   r   r   
contextlibr   	encodingsr   rd  r  r   r  r
  r  _errorsr	   _irir
   r   _ordereddictr   _typesr   r   r   algosr   r   r   r   corer   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r(  r0   utilr1   r2   r3   r4   r5   rZ   rc   rt   r   r   r   r   r   r   r   r   r  r"  r>  r   rm  rp  rw  r{  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r	  r
  r  r  r  r  r  r  r   r#  r&  r'  r)  r,  r-  r0  r1  r5  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r  r  r  r  r'  r  r  r  r  r;   r;   r;   r?   <module>   s  x59q 
  BU* D

			"2%	p			 &      o
