o
    q¨Êh‘h ã                   @   st  d Z ddlmZmZmZmZ ddlmZ ddlm	Z	 ddl
Z
ddlZddlZddlZddlZddlZddlmZ ddlmZmZ dd	lmZ dd
lmZmZmZ ddlmZmZmZmZ ddl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z< ddl=m>Z> ddl?m@Z@mAZAmBZBmCZC G dd„ de*ƒZDG dd„ de*ƒZEG dd„ de*ƒZFG dd„ de0ƒZGG dd„ de3ƒZHG dd„ de4ƒZIG dd„ de"ƒZJG dd„ de3ƒZKG dd „ d e7ƒZLed!d"„ ƒZMG d#d$„ d$e%ƒZNG d%d&„ d&e.ƒZOG d'd(„ d(e3ƒZPG d)d*„ d*e6ƒZQG d+d,„ d,e4ƒZRG d-d.„ d.e%ƒZSG d/d0„ d0e3ƒZTG d1d2„ d2e%ƒZUG d3d4„ d4e%ƒZVG d5d6„ d6e%ƒZWG d7d8„ d8e5ƒZXG d9d:„ d:e5ƒZYG d;d<„ d<e4ƒZZG d=d>„ d>e4ƒZ[G d?d@„ d@e3ƒZ\G dAdB„ dBe3ƒZ]G dCdD„ dDe4ƒZ^G dEdF„ dFe3ƒZ_G dGdH„ dHe4ƒZ`G dIdJ„ dJe%ƒZaG dKdL„ dLe%ƒZbG dMdN„ dNe5ƒZcG dOdP„ dPe4ƒZdG dQdR„ dRe5ƒZeG dSdT„ dTe3ƒZfG dUdV„ dVe6ƒZgG dWdX„ dXe3ƒZhG dYdZ„ dZe%ƒZiG d[d\„ d\e+ƒZjG d]d^„ d^e+ƒZkG d_d`„ d`e3ƒZlG dadb„ dbe4ƒZmG dcdd„ dde3ƒZnG dedf„ dfe3ƒZoG dgdh„ dhe%ƒZpG didj„ dje4ƒZqG dkdl„ dle%ƒZrG dmdn„ dne3ƒZsG dodp„ dpe3ƒZtG dqdr„ dre3ƒZuG dsdt„ dte%ƒZvG dudv„ dve"ƒZwG dwdx„ dxe3ƒZxG dydz„ dze4ƒZyG d{d|„ d|e3ƒZzG d}d~„ d~e3ƒZ{G dd€„ d€e4ƒZ|G d�d‚„ d‚e%ƒZ}G dƒd„„ d„e4ƒZ~G d…d†„ d†e3ƒZG d‡dˆ„ dˆe3ƒZ€G d‰dŠ„ dŠe.ƒZ�G d‹dŒ„ dŒe3ƒZ‚G d�dŽ„ dŽe4ƒZƒG d�d�„ d�e.ƒZ„G d‘d’„ d’e3ƒZ…G d“d”„ d”e4ƒZ†G d•d–„ d–e3ƒZ‡G d—d˜„ d˜e4ƒZˆG d™dš„ dše3ƒZ‰G d›dœ„ dœe.ƒZŠG d�dž„ dže4ƒZ‹G dŸd „ d e.ƒZŒG d¡d¢„ d¢e3ƒZ�G d£d¤„ d¤e4ƒZŽG d¥d¦„ d¦e4ƒZ�G d§d¨„ d¨e4ƒZ�G d©dª„ dªe3ƒZ‘G d«d¬„ d¬e"ƒZ’G d­d®„ d®e+ƒZ“G d¯d°„ d°e3ƒZ”G d±d²„ d²e6ƒZ•G d³d´„ d´e3ƒZ–G dµd¶„ d¶e3ƒZ—G d·d¸„ d¸e6ƒZ˜G d¹dº„ dºe'ƒZ™G d»d¼„ d¼e'ƒZšG d½d¾„ d¾e'ƒZ›G d¿dÀ„ dÀe'ƒZœG dÁdÂ„ dÂe'ƒZ�G dÃdÄ„ dÄe'ƒZžG dÅdÆ„ dÆe3ƒZŸG dÇdÈ„ dÈe3ƒZ G dÉdÊ„ dÊe'ƒZ¡G dËdÌ„ dÌe3ƒZ¢G dÍdÎ„ dÎe3ƒZ£G dÏdÐ„ dÐe6ƒZ¤G dÑdÒ„ dÒe.ƒZ¥G dÓdÔ„ dÔe6ƒZ¦G dÕdÖ„ dÖe6ƒZ§G d×dØ„ dØe6ƒZ¨G dÙdÚ„ dÚe3ƒZ©G dÛdÜ„ dÜe6ƒZªG dÝdÞ„ dÞe3ƒZ«G dßdà„ dàe4ƒZ¬G dádâ„ dâe.ƒZ­G dãdä„ däe3ƒZ®G dådæ„ dæe4ƒZ¯G dçdè„ dèe3ƒZ°G dédê„ dêe3ƒZ±G dëdì„ dìe4ƒZ²G dídî„ dîe4ƒZ³G dïdð„ dðe3ƒZ´G dñdò„ dòe&ƒZµdS )ózò
ASN.1 type classes for X.509 certificates. Exports the following items:

 - Attributes()
 - Certificate()
 - Extensions()
 - GeneralName()
 - GeneralNames()
 - Name()

Other type classes are defined that help compose the types listed above.
é    )Úunicode_literalsÚdivisionÚabsolute_importÚprint_function)Úcontextmanager)ÚidnaNé   )Úunwrap)Ú
iri_to_uriÚ
uri_to_iri)ÚOrderedDict)Ú	type_nameÚstr_clsÚbytes_to_list)ÚAlgorithmIdentifierÚAnyAlgorithmIdentifierÚDigestAlgorithmÚSignedDigestAlgorithm)ÚAnyÚ	BitStringÚ	BMPStringÚBooleanÚChoiceÚConcatÚ
EnumeratedÚGeneralizedTimeÚGeneralStringÚ	IA5StringÚIntegerÚNullÚNumericStringÚObjectIdentifierÚOctetBitStringÚOctetStringÚParsableOctetStringÚPrintableStringÚSequenceÚ
SequenceOfÚSetÚSetOfÚTeletexStringÚUniversalStringÚUTCTimeÚ
UTF8StringÚVisibleStringÚVOID)ÚPublicKeyInfo)Úint_to_bytesÚint_from_bytesÚ	inet_ntopÚ	inet_ptonc                   @   s,   e Zd ZdZdZdd„ Zdd„ Zdd„ Zd	S )
ÚDNSNamer   é   c                 C   ó
   | |k S ©N© ©ÚselfÚotherr9   r9   úA/var/www/html/env/lib/python3.10/site-packages/asn1crypto/x509.pyÚ__ne__L   ó   
zDNSName.__ne__c                 C   s&   t |tƒsdS |  ¡  ¡ | ¡  ¡ kS )zº
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2

        :param other:
            Another DNSName object

        :return:
            A boolean
        F)Ú
isinstancer5   Ú__unicode__Úlowerr:   r9   r9   r=   Ú__eq__O   s   
zDNSName.__eq__c                 C   s|   t |tƒsttdt| ƒt|ƒƒƒ‚| d¡r#d|dd…  | j¡ }n| | j¡}|| _|| _	d| _
| jdkr<d| _dS dS )zd
        Sets the value of the DNS name

        :param value:
            A unicode string
        úK
                %s value must be a unicode string, not %s
                Ú.ó   .r   Nó    )r@   r   Ú	TypeErrorr	   r   Ú
startswithÚencodeÚ	_encodingÚ_unicodeÚcontentsÚ_headerÚ_trailer)r;   ÚvalueÚencoded_valuer9   r9   r=   Úset_   s   
û


ÿzDNSName.setN)Ú__name__Ú
__module__Ú__qualname__rK   Ú_bad_tagr>   rC   rR   r9   r9   r9   r=   r5   G   s    r5   c                   @   s,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
ÚURIc                 C   sP   t |tƒsttdt| ƒt|ƒƒƒ‚|| _t|ƒ| _d| _| j	dkr&d| _	dS dS )úb
        Sets the value of the string

        :param value:
            A unicode string
        rD   NrG   )
r@   r   rH   r	   r   rL   r
   rM   rN   rO   ©r;   rP   r9   r9   r=   rR   ~   s   
û


ÿzURI.setc                 C   r7   r8   r9   r:   r9   r9   r=   r>   •   r?   z
URI.__ne__c                 C   s"   t |tƒsdS t| jƒt|jƒkS )z¶
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4

        :param other:
            Another URI object

        :return:
            A boolean
        F)r@   rW   r
   Únativer:   r9   r9   r=   rC   ˜   s   
z
URI.__eq__c                 C   s,   | j du rdS | jdu rt|  ¡ ƒ| _| jS ©ú7
        :return:
            A unicode string
        NÚ )rM   rL   r   Ú_merge_chunks©r;   r9   r9   r=   rA   ¨   s
   

zURI.__unicode__N)rS   rT   rU   rR   r>   rC   rA   r9   r9   r9   r=   rW   |   s
    rW   c                   @   sN   e Zd ZdZdZedd„ ƒZejdd„ ƒZdd„ Zdd	„ Z	d
d„ Z
dd„ ZdS )ÚEmailAddressNFc                 C   s   | j S )z`
        :return:
            A byte string of the DER-encoded contents of the sequence
        )Ú	_contentsr_   r9   r9   r=   rM   ¼   s   zEmailAddress.contentsc                 C   s   d| _ || _dS )ze
        :param value:
            A byte string of the DER-encoded contents of the sequence
        FN)Ú_normalizedra   rY   r9   r9   r=   rM   Å   s   
c                 C   s”   t |tƒsttdt| ƒt|ƒƒƒ‚| d¡dkr-| dd¡\}}| d¡d | d¡ }n| d¡}d| _|| _	|| _
d	| _| jd
krHd
| _d	S d	S )rX   rD   ú@éÿÿÿÿr   Úasciió   @r   TNrG   )r@   r   rH   r	   r   ÚfindÚrsplitrJ   rb   rL   rM   rN   rO   )r;   rP   ÚmailboxÚhostnamerQ   r9   r9   r=   rR   Ï   s"   
û


ÿzEmailAddress.setc                 C   sb   | j du r.|  ¡ }| d¡dkr| d¡| _ | j S | dd¡\}}| d¡d | d¡ | _ | j S )r\   Nrf   rd   re   r   rc   r   )rL   r^   rg   Údecoderh   )r;   rM   ri   rj   r9   r9   r=   rA   í   s   
þzEmailAddress.__unicode__c                 C   r7   r8   r9   r:   r9   r9   r=   r>   ü   r?   zEmailAddress.__ne__c                 C   s¦   t |tƒsdS | js|  | j¡ |js| |j¡ | j d¡dks)|j d¡dkr/| j|jkS |j dd¡\}}| j dd¡\}}||krGdS | ¡ | ¡ krQdS dS )z¿
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5

        :param other:
            Another EmailAddress object

        :return:
            A boolean
        Frf   rd   r   T)	r@   r`   rb   rR   rZ   ra   rg   rh   rB   )r;   r<   Úother_mailboxÚother_hostnameri   rj   r9   r9   r=   rC   ÿ   s   
 zEmailAddress.__eq__)rS   rT   rU   ra   rb   ÚpropertyrM   ÚsetterrR   rA   r>   rC   r9   r9   r9   r=   r`   µ   s    

	r`   c                   @   s:   e Zd Zddd„Zdd„ Zedd„ ƒZdd	„ Zd
d„ ZdS )Ú	IPAddressNc                 C   s   t tdƒƒ‚)z?
        This method is not applicable to IP addresses
        z=
            IP address values can not be parsed
            )Ú
ValueErrorr	   )r;   ÚspecÚspec_paramsr9   r9   r=   Úparse"  s   ÿzIPAddress.parsec           
      C   sT  t |tƒsttdt| ƒt|ƒƒƒ‚|}| d¡dk}d}|r;| dd¡}|d }t|d ƒ}|dk r;ttdt| ƒƒƒ‚| d¡dkrUt	j
}|dkrRttd	t| ƒƒƒ‚d}nt	j}|d
krettdt| ƒƒƒ‚d
}d}|rŒd| }	|	d|t|	ƒ  7 }	tt|	dƒƒ}d|d t|ƒ  | }|| _t||ƒ| | _| j| _d| _| jdkr¨d| _dS dS )zÌ
        Sets the value of the object

        :param value:
            A unicode string containing an IPv4 address, IPv4 address with CIDR,
            an IPv6 address or IPv6 address with CIDR
        rD   ú/rd   r   r   zT
                    %s value contains a CIDR range less than 0
                    ú:é€   z“
                    %s value contains a CIDR range bigger than 128, the maximum
                    value for an IPv6 address
                    é    z’
                    %s value contains a CIDR range bigger than 32, the maximum
                    value for an IPv4 address
                    rG   Ú1Ú0é   ó    é   N)r@   r   rH   r	   r   rg   ÚsplitÚintrq   ÚsocketÚAF_INET6ÚAF_INETÚlenr1   Ú_nativer4   rM   Ú_bytesrN   rO   )
r;   rP   Úoriginal_valueÚhas_cidrÚcidrÚpartsÚfamilyÚ	cidr_sizeÚ
cidr_bytesÚ	cidr_maskr9   r9   r=   rR   -  s\   
	ûüûû

ÿzIPAddress.setc                 C   sâ   | j du rdS | jdu rn|  ¡ }t|ƒ}d}|tddgƒv r5ttj|dd… ƒ}|dkr4t|dd… ƒ}n|tddgƒv rSttj	|dd… ƒ}|dkrSt|dd… ƒ}|durkd 
|¡}t| d¡ƒ}|d	 t|ƒ }|| _| jS )
z‚
        The a native Python datatype representation of this value

        :return:
            A unicode string or None
        Nrx   é   r   r}   é   z{0:b}rz   ru   )rM   r„   Ú	__bytes__rƒ   rR   r3   r€   r�   r2   r‚   ÚformatÚrstripr   )r;   Úbyte_stringÚbyte_lenÚcidr_intrP   Ú	cidr_bitsrˆ   r9   r9   r=   rZ   t  s*   
	
€
zIPAddress.nativec                 C   r7   r8   r9   r:   r9   r9   r=   r>   “  r?   zIPAddress.__ne__c                 C   s   t |tƒsdS |  ¡ | ¡ kS )zl
        :param other:
            Another IPAddress object

        :return:
            A boolean
        F)r@   rp   r�   r:   r9   r9   r=   rC   –  s   
	zIPAddress.__eq__)NN)	rS   rT   rU   rt   rR   rn   rZ   r>   rC   r9   r9   r9   r=   rp   !  s    
G
rp   c                   @   s"   e Zd ZdefdedeifgZdS )Ú	AttributeÚtypeÚvaluesrr   N)rS   rT   rU   r!   r)   r   Ú_fieldsr9   r9   r9   r=   r—   ¥  ó    þr—   c                   @   ó   e Zd ZeZdS )Ú
AttributesN)rS   rT   rU   r—   Ú_child_specr9   r9   r9   r=   r�   ¬  ó    r�   c                
   @   ó$   e Zd Zddddddddd	d
œ	ZdS )ÚKeyUsageÚdigital_signatureÚnon_repudiationÚkey_enciphermentÚdata_enciphermentÚkey_agreementÚkey_cert_signÚcrl_signÚencipher_onlyÚdecipher_only©	r   r   r{   é   r�   é   é   é   r}   N©rS   rT   rU   Ú_mapr9   r9   r9   r=   r¡   °  ó    
÷r¡   c                   @   ó,   e Zd ZdedddœfdedddœfgZdS )ÚPrivateKeyUsagePeriodÚ
not_beforer   T©ÚimplicitÚoptionalÚ	not_afterr   N)rS   rT   rU   r   rš   r9   r9   r9   r=   r´   ¾  ó    þr´   c                   @   s   e Zd ZdZdZdd„ ZdS )ÚNotReallyTeletexStringa6  
    OpenSSL (and probably some other libraries) puts ISO-8859-1
    into TeletexString instead of ITU T.61. We use Windows-1252 when
    decoding since it is a superset of ISO-8859-1, and less likely to
    cause encoding issues, but we stay strict with encoding to prevent
    us from creating bad data.
    Úcp1252c                 C   s0   | j du rdS | jdu r|  ¡  | j¡| _| jS r[   )rM   rL   r^   rk   Ú_decoding_encodingr_   r9   r9   r=   rA   Ð  s
   

z"NotReallyTeletexString.__unicode__N)rS   rT   rU   Ú__doc__r½   rA   r9   r9   r9   r=   r»   Å  s    r»   c                   c   s$   � zdt _d V  W dt _d S dt _w )NÚteletexr¼   )r»   r½   r9   r9   r9   r=   Ústrict_teletexÝ  s
   €rÀ   c                   @   s4   e Zd ZdefdefdefdefdefdefgZ	dS )ÚDirectoryStringÚteletex_stringÚprintable_stringÚuniversal_stringÚutf8_stringÚ
bmp_stringÚ
ia5_stringN)
rS   rT   rU   r»   r%   r+   r-   r   r   Ú_alternativesr9   r9   r9   r=   rÁ   æ  s    ùrÁ   c                   @   sú   e Zd Zi dd“dd“dd“dd“d	d
“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd “d!d"“i d#d$“d%d&“d'd(“d)d*“d+d,“d-d.“d/d0“d1d2“d3d4“d5d6“d7d8“d9d:“d;d<“d=d>“d?d@“dAdB“¥Zg dC¢ZedDdE„ ƒZedFdG„ ƒZdHS )IÚNameTypez2.5.4.3Úcommon_namez2.5.4.4Úsurnamez2.5.4.5Úserial_numberz2.5.4.6Úcountry_namez2.5.4.7Úlocality_namez2.5.4.8Ústate_or_province_namez2.5.4.9Ústreet_addressz2.5.4.10Úorganization_namez2.5.4.11Úorganizational_unit_namez2.5.4.12Útitlez2.5.4.15Úbusiness_categoryz2.5.4.17Úpostal_codez2.5.4.20Útelephone_numberz2.5.4.41Únamez2.5.4.42Ú
given_namez2.5.4.43Úinitialsz2.5.4.44Úgeneration_qualifierz2.5.4.45Úunique_identifierz2.5.4.46Údn_qualifierz2.5.4.65Ú	pseudonymz2.5.4.97Úorganization_identifierz2.23.133.2.1Útpm_manufacturerz2.23.133.2.2Ú	tpm_modelz2.23.133.2.3Útpm_versionz2.23.133.2.4Úplatform_manufacturerz2.23.133.2.5Úplatform_modelz2.23.133.2.6Úplatform_versionz1.2.840.113549.1.9.1Úemail_addressz1.3.6.1.4.1.311.60.2.1.1Úincorporation_localityz1.3.6.1.4.1.311.60.2.1.2Úincorporation_state_or_provincez1.3.6.1.4.1.311.60.2.1.3Úincorporation_countryz0.9.2342.19200300.100.1.25Údomain_componentz0.2.262.1.10.7.20Úname_distinguisher) rè   rç   ræ   rÔ   rÌ   rÍ   rÕ   rÏ   rÎ   rÐ   rÑ   rÒ   rÓ   rÊ   rÙ   rÚ   rË   rØ   r×   rÝ   rÜ   rÖ   rå   ré   rê   rÞ   rß   rà   rá   râ   rã   rä   c                 C   s:   |   |¡}|| jv r| j |¡}||fS t| jƒ}||fS )zÍ
        Returns an ordering value for a particular attribute key.

        Unrecognized attributes and OIDs will be sorted lexically at the end.

        :return:
            An orderable value.

        )ÚmapÚpreferred_orderÚindexrƒ   )ÚclsÚ	attr_nameÚordinalr9   r9   r=   Úpreferred_ordinalB  s   


þzNameType.preferred_ordinalc                 C   sÚ   i dd“dd“dd“dd“d	d
“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd “d!d"“i d#d$“d%d&“d'd(“d)d*“d+d,“d-d.“d/d0“d1d2“d3d4“d5d6“d7d8“d9d:“d;d<“d=d>“d?d@“dAdB“¥  | j| j¡S )CzZ
        :return:
            A human-friendly unicode string to display to users
        rÊ   zCommon NamerË   ÚSurnamerÌ   zSerial NumberrÍ   ÚCountryrÎ   ÚLocalityrÏ   zState/ProvincerÐ   zStreet AddressrÑ   ÚOrganizationrÒ   zOrganizational UnitrÓ   ÚTitlerÔ   zBusiness CategoryrÕ   zPostal CoderÖ   zTelephone Numberr×   ÚNamerØ   z
Given NamerÙ   ÚInitialsrÚ   zGeneration QualifierrÛ   zUnique IdentifierrÜ   zDN QualifierrÝ   Ú	Pseudonymrå   zEmail Addressræ   zIncorporation Localityrç   zIncorporation State/Provincerè   zIncorporation Countryré   zDomain Componentrê   zName DistinguisherrÞ   zOrganization Identifierrß   zTPM Manufacturerrà   z	TPM Modelrá   zTPM Versionrâ   zPlatform Manufacturerrã   zPlatform Modelrä   zPlatform Version)ÚgetrZ   r_   r9   r9   r=   Úhuman_friendlyV  sŠ   ÿþýüûúùø	÷
öõôóòñðïîíìëêéèçæåäãâá à!ß"ÞzNameType.human_friendlyN)	rS   rT   rU   r±   rì   Úclassmethodrñ   rn   rû   r9   r9   r9   r=   rÉ   ò  s’    ÿþýüûúùø	÷
öõôóòñðïîíìëéèçæåäâ à!ß"Þ$Ü&Ú,#
rÉ   c                   @   s  e Zd ZdefdefgZdZi de“de“de“de“de“d	e“d
e“de“de“de“de“de“de“de“de“de“de“i de	“de“de“de
“de“de“de“de“de“de“de“d e“d!e“d"e“d#e“d$e“¥Zd%Zed&d'„ ƒZd(d)„ Zd*d+„ Zd,d-„ Zd%S ).ÚNameTypeAndValuer˜   rP   ©r˜   rP   rÊ   rË   rÌ   rÍ   rÎ   rÏ   rÐ   rÑ   rÒ   rÓ   rÔ   rÕ   rÖ   r×   rØ   rÙ   rÚ   rÛ   rÜ   rÝ   rå   ræ   rç   rè   ré   rê   rÞ   rß   rà   rá   râ   rã   rä   Nc                 C   s"   | j du r|  | d j¡| _ | j S )zµ
        Returns the value after being processed by the internationalized string
        preparation as specified by RFC 5280

        :return:
            A unicode string
        NrP   )Ú_preppedÚ_ldap_string_preprZ   r_   r9   r9   r=   Úprepped_value±  s   

zNameTypeAndValue.prepped_valuec                 C   r7   r8   r9   r:   r9   r9   r=   r>   ¿  r?   zNameTypeAndValue.__ne__c                 C   s2   t |tƒsdS |d j| d jkrdS |j| jkS )zÃ
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another NameTypeAndValue object

        :return:
            A boolean
        Fr˜   )r@   rý   rZ   r  r:   r9   r9   r=   rC   Â  s
   
zNameTypeAndValue.__eq__c                 C   sœ  t  dd|¡}t  dd|¡}tjdkrt  dd|¡}nt  dd|¡}t  dd|¡}| d	d¡}t  d
d|¡}d ttj|ƒ¡}t	 
d|¡}|D ]C}t |¡rTttdƒƒ‚t |¡r_ttdƒƒ‚t |¡rjttdƒƒ‚t |¡ruttdƒƒ‚t |¡r€ttdƒƒ‚|dkrŠttdƒƒ‚qGd}d}|D ]}t |¡r›d}q‘t |¡r¢d}q‘|r¿t |d ¡}t |d ¡}|s¹|r¹|s¿ttdƒƒ‚dt  dd|¡ ¡  d }|S )a"  
        Implements the internationalized string preparation algorithm from
        RFC 4518. https://tools.ietf.org/html/rfc4518#section-2

        :param string:
            A unicode string to prepare

        :return:
            A prepared unicode string, ready for comparison
        u   [Â­á †Í�á ‹-á �ï¸�-ï¼€ï¿¼]+r]   u	   [	
Â…]ú iÿÿ  u   í ´[íµ³-íµº]|í­€[í° -í±¿]|ó €�u   [ð�…³-ð�…ºó € -ó �¿ó €�]u?   [ ---Â„Â†-ÂŸÛ�Ü�á Žâ€Œ-â€�â€ª-â€®â� -â�£â�ª-â�¯ï»¿ï¿¹-ï¿»]+u   â€‹u   [Â áš€â€€-â€Šâ€¨-â€©â€¯â�Ÿã€€]ÚNFKCzc
                    X.509 Name objects may not contain unassigned code points
                    zŒ
                    X.509 Name objects may not contain change display or
                    zzzzdeprecated characters
                    zc
                    X.509 Name objects may not contain private use characters
                    zf
                    X.509 Name objects may not contain non-character code points
                    zb
                    X.509 Name objects may not contain surrogate code points
                    u   ï¿½zf
                    X.509 Name objects may not contain the replacement character
                    FTr   rd   z{
                    X.509 Name object contains a malformed bidirectional
                    sequence
                    z +z  )ÚreÚsubÚsysÚ
maxunicodeÚreplaceÚjoinrë   Ú
stringprepÚmap_table_b2ÚunicodedataÚ	normalizeÚin_table_a1rq   r	   Úin_table_c8Úin_table_c3Úin_table_c4Úin_table_c5Úin_table_d1Úin_table_d2Ústrip)r;   ÚstringÚcharÚhas_r_and_al_catÚ	has_l_catÚfirst_is_r_and_alÚlast_is_r_and_alr9   r9   r=   r   Õ  sr   
ü
ÿ
ÿ
ÿ
ÿ
ÿÿÿ	

€ÿz"NameTypeAndValue._ldap_string_prep)rS   rT   rU   rÉ   r   rš   Ú	_oid_pairrÁ   r%   r"   r`   r5   r-   Ú
_oid_specsrÿ   rn   r  r>   rC   r   r9   r9   r9   r=   rý   ‚  sœ    þÿþýüûúùø	÷
öõôóòñðïîíìêèçæåäãâá à!ß"Þ#Ý&
rý   c                   @   s<   e Zd ZeZedd„ ƒZdd„ Zdd„ Zdd„ Z	d	d
„ Z
dS )ÚRelativeDistinguishedNamec                 C   s@   g }|   | ¡}t| ¡ ƒD ]}| d||| f ¡ qd |¡S )úb
        :return:
            A unicode string that can be used as a dict key or in a set
        ú%s: %sú)Ú_get_valuesÚsortedÚkeysÚappendr	  )r;   Úoutputr™   Úkeyr9   r9   r=   ÚhashableE  s
   

z"RelativeDistinguishedName.hashablec                 C   r7   r8   r9   r:   r9   r9   r=   r>   U  r?   z RelativeDistinguishedName.__ne__c                 C   sz   t |tƒsdS t| ƒt|ƒkrdS |  | ¡}|  |¡}||kr!dS |  | ¡}|  |¡}|D ]}|| || kr: dS q-dS )zÌ
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RelativeDistinguishedName object

        :return:
            A boolean
        FT)r@   r  rƒ   Ú
_get_typesr"  )r;   r<   Ú
self_typesÚother_typesÚself_valuesÚother_valuesÚ
type_name_r9   r9   r=   rC   X  s   




ÿz RelativeDistinguishedName.__eq__c                 C   s   t dd„ |D ƒƒS )zò
        Returns a set of types contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A set object with unicode strings of NameTypeAndValue type field
            values
        c                 S   s   g | ]}|d  j ‘qS ©r˜   ©rZ   ©Ú.0Úntvr9   r9   r=   Ú
<listcomp>„  ó    z8RelativeDistinguishedName._get_types.<locals>.<listcomp>)rR   ©r;   Úrdnr9   r9   r=   r)  x  s   z$RelativeDistinguishedName._get_typesc                    s   i ‰ ‡ fdd„|D ƒ ˆ S )a$  
        Returns a dict of prepped values contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A dict object with unicode strings of NameTypeAndValue value field
            values that have been prepped for comparison
        c                    s$   g | ]}ˆ   |d  j|jfg¡‘qS r/  )ÚupdaterZ   r  r1  ©r&  r9   r=   r4  “  s   $ z9RelativeDistinguishedName._get_values.<locals>.<listcomp>r9   r6  r9   r9  r=   r"  †  s   z%RelativeDistinguishedName._get_valuesN)rS   rT   rU   rý   rž   rn   r(  r>   rC   r)  r"  r9   r9   r9   r=   r  B  s    
 r  c                   @   s,   e Zd ZeZedd„ ƒZdd„ Zdd„ ZdS )ÚRDNSequencec                 C   s   d  dd„ | D ƒ¡S )r  úc                 s   s   � | ]}|j V  qd S r8   )r(  )r2  r7  r9   r9   r=   Ú	<genexpr>¤  s   € z'RDNSequence.hashable.<locals>.<genexpr>)r	  r_   r9   r9   r=   r(  š  s   
zRDNSequence.hashablec                 C   r7   r8   r9   r:   r9   r9   r=   r>   ¦  r?   zRDNSequence.__ne__c                 C   sJ   t |tƒsdS t| ƒt|ƒkrdS t| ƒD ]\}}|| |kr" dS qdS )z¾
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RDNSequence object

        :return:
            A boolean
        FT)r@   r:  rƒ   Ú	enumerate)r;   r<   rí   Úself_rdnr9   r9   r=   rC   ©  s   
ÿzRDNSequence.__eq__N)	rS   rT   rU   r  rž   rn   r(  r>   rC   r9   r9   r9   r=   r:  —  s    
r:  c                   @   sŒ   e Zd ZdefgZdZdZdZeddd„ƒZ	e
dd„ ƒZdd	„ Zd
d„ Zdd„ Ze
dd„ ƒZe
dd„ ƒZdd„ Ze
dd„ ƒZe
dd„ ƒZdS )r÷   r]   NFc           	      C   sÎ   g }|s	d}t }nd}t}tt| ¡ dd„ d�ƒ}| ¡ D ]A\}}t |¡}|dkr/t|ƒ}n"|dkr8t|ƒ}n|t	g d¢ƒv rIt
dt|ƒd	�}nt
|||ƒd	�}| tt||d
œƒgƒ¡ q| dt|ƒd	�S )aT  
        Creates a Name object from a dict of unicode string keys and values.
        The keys should be from NameType._map, or a dotted-integer OID unicode
        string.

        :param name_dict:
            A dict of name information, e.g. {"common_name": "Will Bond",
            "country_name": "US", "organization": "Codex Non Sufficit LC"}

        :param use_printable:
            A bool - if PrintableString should be used for encoding instead of
            UTF8String. This is for backwards compatibility with old software.

        :return:
            An x509.Name object
        rÅ   rÃ   c                 S   s   t  | d ¡S )Nr   )rÉ   rñ   )Úitemr9   r9   r=   Ú<lambda>é  s    zName.build.<locals>.<lambda>)r'  rå   ré   )rÜ   rÍ   rÌ   )r×   rP   rþ   r]   )r-   r%   r   r#  ÚitemsrÉ   rë   r`   r5   rR   rÁ   r%  r  rý   r:  )	rî   Ú	name_dictÚuse_printableÚrdnsÚencoding_nameÚencoding_classÚattribute_nameÚattribute_valuerP   r9   r9   r=   ÚbuildÊ  sD   þÿ


þþþ
ÿz
Name.buildc                 C   s   | j jS )r  )Úchosenr(  r_   r9   r9   r=   r(    s   zName.hashablec                 C   s
   t | jƒS r8   )rƒ   rJ  r_   r9   r9   r=   Ú__len__  r?   zName.__len__c                 C   r7   r8   r9   r:   r9   r9   r=   r>     r?   zName.__ne__c                 C   s   t |tƒsdS | j|jkS )z·
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another Name object

        :return:
            A boolean
        F)r@   r÷   rJ  r:   r9   r9   r=   rC     s   
zName.__eq__c                 C   s„   | j d u r?tƒ | _ | jjD ]1}|D ],}|d }|| j v r6| j | }t|tƒs.|g }| j |< | |d ¡ q|d | j |< qq| j S )Nr˜   rP   )r„   r   rJ  rZ   r@   Úlistr%  )r;   r7  Útype_valÚ
field_nameÚexistingr9   r9   r=   rZ   %  s   



ø	zName.nativec                 C   s  | j du r�tƒ }d}| jD ])}|D ]$}|d j}|}||v r/|| g||< ||  |d ¡ q|d ||< qqg }| ¡ }|dkrGtt|ƒƒ}|D ]}|| }	|  |	¡}
| d||
f ¡ qId}|D ]}| 	d¡dkrod	} nqb|std
nd}| 
|ddd… ¡| _ | j S )zg
        :return:
            A human-friendly unicode string containing the parts of the name
        Nr˜   rP   ró   r   Fú,rd   Tú, z; )Ú_human_friendlyr   rJ  rû   r%  r$  ÚreversedrL  Ú_recursive_humanizerg   r	  )r;   ÚdataÚ
last_fieldr7  rM  rN  Úto_joinr$  r'  rP   Únative_valueÚ	has_commaÚelementÚ	separatorr9   r9   r=   rû   5  s:   


ù
þzName.human_friendlyc                    s,   t |tƒrd t‡ fdd„|D ƒƒ¡S |jS )zÑ
        Recursively serializes data compiled from the RDNSequence

        :param value:
            An Asn1Value object, or a list of Asn1Value objects

        :return:
            A unicode string
        rQ  c                    s   g | ]}ˆ   |¡‘qS r9   )rT  )r2  Ú	sub_valuer_   r9   r=   r4  i  r5  z,Name._recursive_humanize.<locals>.<listcomp>)r@   rL  r	  rS  rZ   rY   r9   r_   r=   rT  \  s
   
ÿzName._recursive_humanizec                 C   ó$   | j du rt |  ¡ ¡ ¡ | _ | j S )zZ
        :return:
            The SHA1 hash of the DER-encoded bytes of this name
        N©Ú_sha1ÚhashlibÚsha1ÚdumpÚdigestr_   r9   r9   r=   ra  m  ó   
z	Name.sha1c                 C   r]  )z]
        :return:
            The SHA-256 hash of the DER-encoded bytes of this name
        N©Ú_sha256r`  Úsha256rb  rc  r_   r9   r9   r=   rg  x  rd  zName.sha256)F)rS   rT   rU   r:  rÈ   rR  r_  rf  rü   rI  rn   r(  rK  r>   rC   rZ   rû   rT  ra  rg  r9   r9   r9   r=   r÷   Á  s,    ÿ<


&

r÷   c                   @   ó"   e Zd ZdefdeddifgZdS )ÚAnotherNameÚtype_idrP   Úexplicitr   N)rS   rT   rU   r!   r   rš   r9   r9   r9   r=   ri  „  r›   ri  c                   @   s$   e Zd ZdZdZdefdefgZdS )ÚCountryNamer   Úx121_dcc_codeÚiso_3166_alpha2_codeN©rS   rT   rU   Úclass_Útagr    r%   rÈ   r9   r9   r9   r=   rl  ‹  ó    þrl  c                   @   s$   e Zd ZdZdZdefdefgZdS )ÚAdministrationDomainNamer   r{   ÚnumericÚ	printableNro  r9   r9   r9   r=   rs  •  rr  rs  c                   @   ó   e Zd ZdefdefgZdS )ÚPrivateDomainNamert  ru  N©rS   rT   rU   r    r%   rÈ   r9   r9   r9   r=   rw  Ÿ  ó    þrw  c                   @   óF   e Zd Zdeddifdedddœfded	ddœfd
edddœfgZdS )ÚPersonalNamerË   r·   r   rØ   r   Tr¶   rÙ   r{   rÚ   r¬   N©rS   rT   rU   r%   rš   r9   r9   r9   r=   r{  ¦  ó    ür{  c                   @   rz  )ÚTeletexPersonalNamerË   r·   r   rØ   r   Tr¶   rÙ   r{   rÚ   r¬   N©rS   rT   rU   r*   rš   r9   r9   r9   r=   r~  ¯  r}  r~  c                   @   rœ   )ÚOrganizationalUnitNamesN©rS   rT   rU   r%   rž   r9   r9   r9   r=   r€  ¸  rŸ   r€  c                   @   rœ   )ÚTeletexOrganizationalUnitNamesN)rS   rT   rU   r*   rž   r9   r9   r9   r=   r‚  ¼  rŸ   r‚  c                   @   sŠ   e Zd Zdeddifdeddifdedddœfded	ddœfd
edddœfdedddœfdedddœfdedddœfde	dddœfg	Z
dS )ÚBuiltInStandardAttributesrÍ   r¸   TÚadministration_domain_nameÚnetwork_addressr   r¶   Úterminal_identifierr   Úprivate_domain_namer{   ©rk  r¸   rÑ   r¬   Únumeric_user_identifierr�   Úpersonal_namer­   Úorganizational_unit_namesr®   N)rS   rT   rU   rl  rs  r    r%   rw  r{  r€  rš   r9   r9   r9   r=   rƒ  À  s    ÷rƒ  c                   @   ó   e Zd ZdefdefgZdS )ÚBuiltInDomainDefinedAttributer˜   rP   Nr|  r9   r9   r9   r=   r�  Î  ry  r�  c                   @   rœ   )ÚBuiltInDomainDefinedAttributesN)rS   rT   rU   r�  rž   r9   r9   r9   r=   rŽ  Õ  rŸ   rŽ  c                   @   rŒ  )ÚTeletexDomainDefinedAttributer˜   rP   Nr  r9   r9   r9   r=   r�  Ù  ry  r�  c                   @   rœ   )ÚTeletexDomainDefinedAttributesN)rS   rT   rU   r�  rž   r9   r9   r9   r=   r�  à  rŸ   r�  c                   @   rv  )ÚPhysicalDeliveryCountryNamerm  rn  Nrx  r9   r9   r9   r=   r‘  ä  ry  r‘  c                   @   rv  )Ú
PostalCodeÚnumeric_codeÚprintable_codeNrx  r9   r9   r9   r=   r’  ë  ry  r’  c                   @   ó(   e Zd ZdeddifdeddifgZdS )ÚPDSParameterrÃ   r¸   TrÂ   N)rS   rT   rU   r%   r*   rš   r9   r9   r9   r=   r–  ò  ó    þr–  c                   @   rœ   )ÚPrintableAddressNr�  r9   r9   r9   r=   r˜  ù  rŸ   r˜  c                   @   r•  )ÚUnformattedPostalAddressÚprintable_addressr¸   TrÂ   N)rS   rT   rU   r˜  r*   rš   r9   r9   r9   r=   r™  ý  r—  r™  c                   @   s*   e Zd ZdeddifdedddœfgZdS )	ÚE1634AddressÚnumberr·   r   Úsub_addressr   Tr¶   N)rS   rT   rU   r    rš   r9   r9   r9   r=   r›    s    þr›  c                   @   rœ   )Ú
NAddressesN)rS   rT   rU   r#   rž   r9   r9   r9   r=   rž    rŸ   rž  c                   @   sF   e Zd Zdedddœfdedddœfdedddœfd	ed
difgZdS )ÚPresentationAddressÚ
p_selectorr   Trˆ  Ú
s_selectorr   Ú
t_selectorr{   Ún_addressesrk  r¬   N)rS   rT   rU   r#   rž  rš   r9   r9   r9   r=   rŸ    s    ürŸ  c                   @   rh  )ÚExtendedNetworkAddressÚe163_4_addressÚpsap_addressr·   r   N)rS   rT   rU   r›  rŸ  rÈ   r9   r9   r9   r=   r¤    r›   r¤  c                   @   s   e Zd ZdddddddœZdS )	ÚTerminalTypeÚtelexr¿   Úg3_facsimileÚg4_facsimileÚia5_terminalÚvideotex)r¬   r�   r­   r®   r¯   r}   Nr°   r9   r9   r9   r=   r§    s    
úr§  c                   @   óˆ   e Zd Zi dd“dd“dd“dd“d	d
“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd “d!d"“d#d$d%d&d'd(d)œ¥Zd*S )+ÚExtensionAttributeTyper   rÊ   r{   Úteletex_common_namer¬   Úteletex_organization_namer�   Úteletex_personal_namer­   Úteletex_organization_unit_namesr®   Ú!teletex_domain_defined_attributesr¯   Úpds_namer}   Úphysical_delivery_country_nameé	   rÕ   é
   Úphysical_delivery_office_nameé   Úphysical_delivery_office_numberé   Úextension_of_address_componentsé   Úphysical_delivery_personal_nameé   Ú#physical_delivery_organization_nameé   Ú.extension_physical_delivery_address_componentsrŽ   Úunformatted_postal_addressé   rÐ   Úpost_office_box_addressÚposte_restante_addressÚunique_postal_nameÚlocal_postal_attributesÚextended_network_addressÚterminal_type)é   r6   é   é   é   é   Nr°   r9   r9   r9   r=   r®  *  sV    ÿþýüûúùø	÷
öõôóòñðïér®  c                   @   s¨   e Zd ZdeddifdeddifgZdZi de“d	e“d
e“de	“de
“de“de“de“de“de“de“de“de“de“de“de“de“eeeeeedœ¥ZdS )ÚExtensionAttributeÚextension_attribute_typer·   r   Úextension_attribute_valuerk  r   )rÑ  rÒ  rÊ   r¯  r°  r±  r²  r³  r´  rµ  rÕ   r¸  rº  r¼  r¾  rÀ  rÂ  rÃ  rÐ   )rÅ  rÆ  rÇ  rÈ  rÉ  rÊ  N)rS   rT   rU   r®  r   rš   r  r%   r*   r~  r‚  r�  r‘  r’  r–  r™  r¤  r§  r  r9   r9   r9   r=   rÐ  F  s^    þÿþýüûúùø	÷
öõôóòñðïérÐ  c                   @   rœ   )ÚExtensionAttributesN)rS   rT   rU   rÐ  rž   r9   r9   r9   r=   rÓ  h  rŸ   rÓ  c                   @   ó.   e Zd ZdefdeddifdeddifgZdS )Ú	ORAddressÚbuilt_in_standard_attributesÚ"built_in_domain_defined_attributesr¸   TÚextension_attributesN)rS   rT   rU   rƒ  rŽ  rÓ  rš   r9   r9   r9   r=   rÕ  l  ó
    ýrÕ  c                   @   s*   e Zd ZdedddœfdeddifgZdS )	ÚEDIPartyNameÚname_assignerr   Tr¶   Ú
party_namer·   r   N)rS   rT   rU   rÁ   rš   r9   r9   r9   r=   rÚ  t  s    þrÚ  c                   @   sŒ   e Zd Zdeddifdeddifdeddifdedd	ifd
eddifdeddifde	ddifde
ddifdeddifg	Zdd„ Zdd„ ZdS )ÚGeneralNameÚ
other_namer·   r   Úrfc822_namer   Údns_namer{   Úx400_addressr¬   Údirectory_namerk  r�   Úedi_party_namer­   Úuniform_resource_identifierr®   Ú
ip_addressr¯   Úregistered_idr}   c                 C   r7   r8   r9   r:   r9   r9   r=   r>   ˆ  r?   zGeneralName.__ne__c                 C   sP   | j dv rttd| j ƒƒ‚|j dv rttd|j ƒƒ‚| j |j kr"dS | j|jkS )z¼
        Does not support other_name, x400_address or edi_party_name

        :param other:
            The other GeneralName to compare to

        :return:
            A boolean
        )rÞ  rá  rã  zr
                Comparison is not supported for GeneralName objects of
                choice %s
                za
                Comparison is not supported for GeneralName objects of choice
                %sF)r×   rq   r	   rJ  r:   r9   r9   r=   rC   ‹  s   
û
üzGeneralName.__eq__N)rS   rT   rU   ri  r`   r5   rÕ  r÷   rÚ  rW   rp   r!   rÈ   r>   rC   r9   r9   r9   r=   rÝ  {  s    ÷rÝ  c                   @   rœ   )ÚGeneralNamesN)rS   rT   rU   rÝ  rž   r9   r9   r9   r=   rç  ­  rŸ   rç  c                   @   rv  )ÚTimeÚutc_timeÚgeneral_timeN)rS   rT   rU   r,   r   rÈ   r9   r9   r9   r=   rè  ±  ry  rè  c                   @   rŒ  )ÚValidityrµ   r¹   N)rS   rT   rU   rè  rš   r9   r9   r9   r=   rë  ¸  ry  rë  c                   @   s(   e Zd ZdeddifdeddifgZdS )ÚBasicConstraintsÚcaÚdefaultFÚpath_len_constraintr¸   TN)rS   rT   rU   r   r   rš   r9   r9   r9   r=   rì  ¿  r—  rì  c                   @   s:   e Zd ZdedddœfdedddœfdedddœfgZd	S )
ÚAuthorityKeyIdentifierÚkey_identifierr   Tr¶   Úauthority_cert_issuerr   Úauthority_cert_serial_numberr{   N)rS   rT   rU   r#   rç  r   rš   r9   r9   r9   r=   rð  Æ  s
    ýrð  c                   @   s(   e Zd ZdeddifdeddifgZdS )ÚDistributionPointNameÚ	full_namer·   r   Úname_relative_to_crl_issuerr   N)rS   rT   rU   rç  r  rÈ   r9   r9   r9   r=   rô  Î  r—  rô  c                
   @   r    )ÚReasonFlagsÚunusedÚkey_compromiseÚca_compromiseÚaffiliation_changedÚ
supersededÚcessation_of_operationÚcertificate_holdÚprivilege_withdrawnÚaa_compromiser«   Nr°   r9   r9   r9   r=   r÷  Õ  r²   r÷  c                   @   s2   e Zd ZdefdedddœfdedddœfgZd	S )
ÚGeneralSubtreeÚbaseÚminimumr   ©r·   rî  Úmaximumr   Tr¶   N)rS   rT   rU   rÝ  r   rš   r9   r9   r9   r=   r  ã  ó
    ýr  c                   @   rœ   )ÚGeneralSubtreesN)rS   rT   rU   r  rž   r9   r9   r9   r=   r  ë  rŸ   r  c                   @   r³   )ÚNameConstraintsÚpermitted_subtreesr   Tr¶   Úexcluded_subtreesr   N)rS   rT   rU   r  rš   r9   r9   r9   r=   r  ï  rº   r  c                   @   sJ   e Zd Zdedddœfdedddœfded	ddœfgZd
Zedd„ ƒZ	dS )ÚDistributionPointÚdistribution_pointr   Trˆ  Úreasonsr   r¶   Ú
crl_issuerr{   Fc                 C   sl   | j du r3d| _ | d }|jdkrttdƒƒ‚|jD ]}|jdkr2|j}| ¡  d¡r2|| _  | j S q| j S )z_
        :return:
            None or a unicode string of the distribution point's URL
        FNr  rõ  z‡
                    CRL distribution points that are relative to the issuer are
                    not supported
                    rä  ©zhttp://zhttps://zldap://zldaps://)Ú_urlr×   rq   r	   rJ  rZ   rB   rI   )r;   r×   Úgeneral_nameÚurlr9   r9   r=   r  ÿ  s    

ÿ

€ zDistributionPoint.urlN)
rS   rT   rU   rô  r÷  rç  rš   r  rn   r  r9   r9   r9   r=   r  ö  s    ýr  c                   @   rœ   )ÚCRLDistributionPointsN)rS   rT   rU   r  rž   r9   r9   r9   r=   r    rŸ   r  c                   @   s(   e Zd ZdefdefdefdefgZdS )ÚDisplayTextrÇ   Úvisible_stringrÆ   rÅ   N)rS   rT   rU   r   r.   r   r-   rÈ   r9   r9   r9   r=   r    s    ür  c                   @   rœ   )ÚNoticeNumbersN©rS   rT   rU   r   rž   r9   r9   r9   r=   r  (  rŸ   r  c                   @   rv  )ÚNoticeReferenceÚorganizationÚnotice_numbersN)rS   rT   rU   r  r  rš   r9   r9   r9   r=   r  ,  ry  r  c                   @   r•  )Ú
UserNoticeÚ
notice_refr¸   TÚexplicit_textN)rS   rT   rU   r  r  rš   r9   r9   r9   r=   r  3  r—  r  c                   @   s   e Zd ZdddœZdS )ÚPolicyQualifierIdÚ certification_practice_statementÚuser_notice)z1.3.6.1.5.5.7.2.1z1.3.6.1.5.5.7.2.2Nr°   r9   r9   r9   r=   r  :  s    
þr  c                   @   s*   e Zd ZdefdefgZdZeedœZ	dS )ÚPolicyQualifierInfoÚpolicy_qualifier_idÚ	qualifier)r"  r#  )r  r   N)
rS   rT   rU   r  r   rš   r  r   r  r  r9   r9   r9   r=   r!  A  s    þ
þr!  c                   @   rœ   )ÚPolicyQualifierInfosN)rS   rT   rU   r!  rž   r9   r9   r9   r=   r$  N  rŸ   r$  c                   @   s   e Zd ZddiZdS )ÚPolicyIdentifierz2.5.29.32.0Ú
any_policyNr°   r9   r9   r9   r=   r%  R  s    ÿr%  c                   @   rh  )ÚPolicyInformationÚpolicy_identifierÚpolicy_qualifiersr¸   TN)rS   rT   rU   r%  r$  rš   r9   r9   r9   r=   r'  X  r›   r'  c                   @   rœ   )ÚCertificatePoliciesN)rS   rT   rU   r'  rž   r9   r9   r9   r=   r*  _  rŸ   r*  c                   @   rŒ  )ÚPolicyMappingÚissuer_domain_policyÚsubject_domain_policyN)rS   rT   rU   r%  rš   r9   r9   r9   r=   r+  c  ry  r+  c                   @   rœ   )ÚPolicyMappingsN)rS   rT   rU   r+  rž   r9   r9   r9   r=   r.  j  rŸ   r.  c                   @   r³   )ÚPolicyConstraintsÚrequire_explicit_policyr   Tr¶   Úinhibit_policy_mappingr   N©rS   rT   rU   r   rš   r9   r9   r9   r=   r/  n  rº   r/  c                   @   s  e Zd Zi dd“dd“dd“dd“d	d
“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd “d!d"“i d#d$“d%d&“d'd(“d)d*“d+d,“d-d.“d/d0“d1d2“d3d4“d5d6“d7d8“d9d:“d;d<“d=d>“d?d@“dAdB“dCdD“¥i dEdF“dGdH“dIdJ“dKdL“dMdN“dOdP“dQdR“dSdT“dUdV“dWdX“dYdZ“d[d\“d]d^“d_d`“dadb“dcdd“dedf“¥i dgdh“didj“dkdl“dmdn“dodp“dqdr“dsdt“dudv“dwdx“dydz“d{d|“d}d~“dd€“d�d‚“dƒd„“d…d†“d‡dˆ“¥i d‰dŠ“d‹dŒ“d�dŽ“d�d�“d‘d’“d“d”“d•d–“d—d˜“d™dš“d›dœ“d�dž“dŸd “d¡d¢“d£d¤“d¥d¦“d§d¨“¥Zd©S )ªÚKeyPurposeIdz2.5.29.37.0Úany_extended_key_usagez1.3.6.1.5.5.7.3.1Úserver_authz1.3.6.1.5.5.7.3.2Úclient_authz1.3.6.1.5.5.7.3.3Úcode_signingz1.3.6.1.5.5.7.3.4Úemail_protectionz1.3.6.1.5.5.7.3.5Úipsec_end_systemz1.3.6.1.5.5.7.3.6Úipsec_tunnelz1.3.6.1.5.5.7.3.7Ú
ipsec_userz1.3.6.1.5.5.7.3.8Útime_stampingz1.3.6.1.5.5.7.3.9Úocsp_signingz1.3.6.1.5.5.7.3.10Údvcsz1.3.6.1.5.5.7.3.13Úeap_over_pppz1.3.6.1.5.5.7.3.14Úeap_over_lanz1.3.6.1.5.5.7.3.15Úscvp_serverz1.3.6.1.5.5.7.3.16Úscvp_clientz1.3.6.1.5.5.7.3.17Ú	ipsec_ikez1.3.6.1.5.5.7.3.18Ú	capwap_acz1.3.6.1.5.5.7.3.19Ú
capwap_wtpz1.3.6.1.5.5.7.3.20Ú
sip_domainz1.3.6.1.5.5.7.3.21Úsecure_shell_clientz1.3.6.1.5.5.7.3.22Úsecure_shell_serverz1.3.6.1.5.5.7.3.23Úsend_routerz1.3.6.1.5.5.7.3.24Úsend_proxied_routerz1.3.6.1.5.5.7.3.25Ú
send_ownerz1.3.6.1.5.5.7.3.26Úsend_proxied_ownerz1.3.6.1.5.5.7.3.27Úcmc_caz1.3.6.1.5.5.7.3.28Úcmc_raz1.3.6.1.5.5.7.3.29Úcmc_archivez1.3.6.1.5.5.7.3.30Úbgpspec_routerz1.3.6.1.4.1.311.10.3.1Úmicrosoft_trust_list_signingz1.3.6.1.4.1.311.10.3.2Úmicrosoft_time_stamp_signingz1.3.6.1.4.1.311.10.3.3Úmicrosoft_server_gatedz1.3.6.1.4.1.311.10.3.3.1Úmicrosoft_serializedz1.3.6.1.4.1.311.10.3.4Úmicrosoft_efsz1.3.6.1.4.1.311.10.3.4.1Úmicrosoft_efs_recoveryz1.3.6.1.4.1.311.10.3.5Úmicrosoft_whqlz1.3.6.1.4.1.311.10.3.6Úmicrosoft_nt5z1.3.6.1.4.1.311.10.3.7Úmicrosoft_oem_whqlz1.3.6.1.4.1.311.10.3.8Úmicrosoft_embedded_ntz1.3.6.1.4.1.311.10.3.9Úmicrosoft_root_list_signerz1.3.6.1.4.1.311.10.3.10Ú!microsoft_qualified_subordinationz1.3.6.1.4.1.311.10.3.11Úmicrosoft_key_recoveryz1.3.6.1.4.1.311.10.3.12Úmicrosoft_document_signingz1.3.6.1.4.1.311.10.3.13Úmicrosoft_lifetime_signingz1.3.6.1.4.1.311.10.3.14Ú microsoft_mobile_device_softwarez1.3.6.1.4.1.311.20.2.2Úmicrosoft_smart_card_logonz1.2.840.113635.100.1.2Úapple_x509_basicz1.2.840.113635.100.1.3Ú	apple_sslz1.2.840.113635.100.1.4Úapple_local_cert_genz1.2.840.113635.100.1.5Úapple_csr_genz1.2.840.113635.100.1.6Úapple_revocation_crlz1.2.840.113635.100.1.7Úapple_revocation_ocspz1.2.840.113635.100.1.8Úapple_smimez1.2.840.113635.100.1.9Ú	apple_eapz1.2.840.113635.100.1.10Úapple_software_update_signingz1.2.840.113635.100.1.11Úapple_ipsecz1.2.840.113635.100.1.12Úapple_ichatz1.2.840.113635.100.1.13Úapple_resource_signingz1.2.840.113635.100.1.14Úapple_pkinit_clientz1.2.840.113635.100.1.15Úapple_pkinit_serverz1.2.840.113635.100.1.16Úapple_code_signingz1.2.840.113635.100.1.17Úapple_package_signingz1.2.840.113635.100.1.18Úapple_id_validationz1.2.840.113635.100.1.20Úapple_time_stampingz1.2.840.113635.100.1.21Úapple_revocationz1.2.840.113635.100.1.22Úapple_passbook_signingz1.2.840.113635.100.1.23Úapple_mobile_storez1.2.840.113635.100.1.24Úapple_escrow_servicez1.2.840.113635.100.1.25Úapple_profile_signerz1.2.840.113635.100.1.26Úapple_qa_profile_signerz1.2.840.113635.100.1.27Úapple_test_mobile_storez1.2.840.113635.100.1.28Úapple_otapki_signerz1.2.840.113635.100.1.29Úapple_test_otapki_signerz1.2.840.113625.100.1.30Ú)apple_id_validation_record_signing_policyz1.2.840.113625.100.1.31Úapple_smp_encryptionz1.2.840.113625.100.1.32Úapple_test_smp_encryptionz1.2.840.113635.100.1.33Úapple_server_authenticationz1.2.840.113635.100.1.34Úapple_pcs_escrow_servicez2.16.840.1.101.3.6.8Úpiv_card_authenticationz2.16.840.1.101.3.6.7Úpiv_content_signingz1.3.6.1.5.2.3.4Úpkinit_kpclientauthz1.3.6.1.5.2.3.5Úpkinit_kpkdcz1.2.840.113583.1.1.5Úadobe_authentic_documents_trustz2.16.840.1.101.3.8.7Úfpki_pivi_content_signingNr°   r9   r9   r9   r=   r3  u  sT   þýüûúùø	÷
öõóñðîíëéèæäãá à!ß"Þ$Ü%Û&Ú(Ø+Õ,Ô-Ó.Ò/Ñ0Ð1Ï2Î3Í4Ì5Ë6Ê7É8È9Ç:Æ<Ä@ÀA¿B¾C½D¼E»FºG¹H¸I·J¶KµL´M³N²O±P°Q¯R®S­T¬U«VªW©X¨Y§Z¦[¥\¤]£^¢_¡aŸbždœe›g™i
—r3  c                   @   rœ   )ÚExtKeyUsageSyntaxN©rS   rT   rU   r3  rž   r9   r9   r9   r=   rˆ  ã  rŸ   rˆ  c                   @   ó   e Zd ZdddddœZdS )ÚAccessMethodÚocspÚ
ca_issuersr<  Úca_repository)z1.3.6.1.5.5.7.48.1z1.3.6.1.5.5.7.48.2z1.3.6.1.5.5.7.48.3z1.3.6.1.5.5.7.48.5Nr°   r9   r9   r9   r=   r‹  ç  ó    
ür‹  c                   @   rv  )ÚAccessDescriptionÚaccess_methodÚaccess_locationN)rS   rT   rU   r‹  rÝ  rš   r9   r9   r9   r=   r�  ð  ry  r�  c                   @   rœ   )ÚAuthorityInfoAccessSyntaxN©rS   rT   rU   r�  rž   r9   r9   r9   r=   r“  ÷  rŸ   r“  c                   @   rœ   )ÚSubjectInfoAccessSyntaxNr”  r9   r9   r9   r=   r•  û  rŸ   r•  c                   @   rœ   )ÚFeaturesNr  r9   r9   r9   r=   r–     rŸ   r–  c                   @   rv  )ÚEntrustVersionInfoÚentrust_versÚentrust_info_flagsN)rS   rT   rU   r   r   rš   r9   r9   r9   r=   r—    ry  r—  c                	   @   s"   e Zd Zddddddddd	œZd
S )ÚNetscapeCertificateTypeÚ
ssl_clientÚ
ssl_serverÚemailÚobject_signingÚreservedÚssl_caÚemail_caÚobject_signing_ca)r   r   r{   r¬   r�   r­   r®   r¯   Nr°   r9   r9   r9   r=   rš    s    
ørš  c                   @   ó   e Zd ZddddœZdS )ÚVersionÚv1Úv2Úv3©r   r   r{   Nr°   r9   r9   r9   r=   r¤    ó
    
ýr¤  c                   @   s"   e Zd ZdefdefdefgZdS )ÚTPMSpecificationrŠ   ÚlevelÚrevisionN)rS   rT   rU   r-   r   rš   r9   r9   r9   r=   rª     ó
    ýrª  c                   @   rœ   )ÚSetOfTPMSpecificationN)rS   rT   rU   rª  rž   r9   r9   r9   r=   r®  (  rŸ   r®  c                   @   s"   e Zd ZdefdefdefgZdS )ÚTCGSpecificationVersionÚmajor_versionÚminor_versionr¬  Nr2  r9   r9   r9   r=   r¯  ,  r­  r¯  c                   @   rv  )ÚTCGPlatformSpecificationÚversionÚplatform_classN)rS   rT   rU   r¯  r#   rš   r9   r9   r9   r=   r²  4  ry  r²  c                   @   rœ   )ÚSetOfTCGPlatformSpecificationN)rS   rT   rU   r²  rž   r9   r9   r9   r=   rµ  ;  rŸ   rµ  c                   @   rŠ  )ÚEKGenerationTypeÚinternalÚinjectedÚinternal_revocableÚinjected_revocable)r   r   r{   r¬   Nr°   r9   r9   r9   r=   r¶  ?  r�  r¶  c                   @   r£  )ÚEKGenerationLocationrß   râ   Úek_cert_signerr¨  Nr°   r9   r9   r9   r=   r»  H  r©  r»  c                   @   r£  )ÚEKCertificateGenerationLocationrß   râ   r¼  r¨  Nr°   r9   r9   r9   r=   r½  P  r©  r½  c                   @   s    e Zd ZddddddddœZd	S )
ÚEvaluationAssuranceLevelÚlevel1Úlevel2Úlevel3Úlevel4Úlevel5Úlevel6Úlevel7)r   r{   r¬   r�   r­   r®   r¯   Nr°   r9   r9   r9   r=   r¾  X  s    
ùr¾  c                   @   r£  )ÚEvaluationStatusÚdesigned_to_meetÚevaluation_in_progressÚevaluation_completedr¨  Nr°   r9   r9   r9   r=   rÆ  d  r©  rÆ  c                   @   r£  )ÚStrengthOfFunctionÚbasicÚmediumÚhighr¨  Nr°   r9   r9   r9   r=   rÊ  l  r©  rÊ  c                   @   rÔ  )ÚURIReferencerä  Úhash_algorithmr¸   TÚ
hash_valueN)rS   rT   rU   r   r   r   rš   r9   r9   r9   r=   rÎ  t  rÙ  rÎ  c                   @   st   e Zd Zdefdefdefdeddifdedd	d
œfdedd	d
œfde	dd	d
œfdedd	d
œfde	dd	d
œfg	Z
dS )ÚCommonCriteriaMeasuresr³  Úassurance_levelÚevaluation_statusÚplusrî  FÚstrengh_of_functionr   Tr¶   Úprofile_oidr   Úprofile_urlr{   Ú
target_oidr¬   Ú
target_urir�   N)rS   rT   rU   r   r¾  rÆ  r   rÊ  r!   rÎ  rš   r9   r9   r9   r=   rÑ  |  s    ÷rÑ  c                   @   rŠ  )ÚSecurityLevelr¿  rÀ  rÁ  rÂ  )r   r{   r¬   r�   Nr°   r9   r9   r9   r=   rÚ  Š  r�  rÚ  c                   @   s(   e Zd ZdefdefdeddifgZdS )Ú	FIPSLevelr³  r«  rÔ  rî  FN)rS   rT   rU   r   rÚ  r   rš   r9   r9   r9   r=   rÛ  “  s
    ýrÛ  c                   @   sˆ   e Zd Zdeddifdeddifdeddd	œfd
eddd	œfdeddd	œfdeddd	œfde	ddd	œfdedddœfde
ddifg	ZdS )ÚTPMSecurityAssertionsr³  rî  r¥  Úfield_upgradableFÚek_generation_typer   Tr¶   Úek_generation_locationr   Ú"ek_certificate_generation_locationr{   Úcc_infor¬   Ú
fips_levelr�   Úiso_9000_certifiedr­   r  Úiso_9000_urir¸   N)rS   rT   rU   r¤  r   r¶  r»  r½  rÑ  rÛ  r   rš   r9   r9   r9   r=   rÜ  ›  s    ÷rÜ  c                   @   rœ   )ÚSetOfTPMSecurityAssertionsN)rS   rT   rU   rÜ  rž   r9   r9   r9   r=   rå  ©  rŸ   rå  c                   @   s&   e Zd Zddddddddd	d
dœ
ZdS )ÚSubjectDirectoryAttributeIdÚsupported_algorithmsÚtpm_specificationÚtcg_platform_specificationÚtpm_security_assertionsÚpda_date_of_birthÚpda_place_of_birthÚ
pda_genderÚpda_country_of_citizenshipÚpda_country_of_residenceÚentrust_user_role)
z2.5.4.52z2.23.133.2.16z2.23.133.2.17z2.23.133.2.18z1.3.6.1.5.5.7.9.1z1.3.6.1.5.5.7.9.2z1.3.6.1.5.5.7.9.3z1.3.6.1.5.5.7.9.4z1.3.6.1.5.5.7.9.5z1.2.840.113533.7.68.29Nr°   r9   r9   r9   r=   ræ  ­  s    
òræ  c                   @   rœ   )ÚSetOfGeneralizedTimeN)rS   rT   rU   r   rž   r9   r9   r9   r=   rñ  À  rŸ   rñ  c                   @   rœ   )ÚSetOfDirectoryStringN)rS   rT   rU   rÁ   rž   r9   r9   r9   r=   rò  Ä  rŸ   rò  c                   @   rœ   )ÚSetOfPrintableStringNr�  r9   r9   r9   r=   ró  È  rŸ   ró  c                   @   s2   e Zd ZdefdedddœfdedddœfgZdS )	ÚSupportedAlgorithmÚalgorithm_identifierÚintended_usager   Trˆ  Úintended_certificate_policiesr   N)rS   rT   rU   r   r¡   r*  rš   r9   r9   r9   r=   rô  Ì  r  rô  c                   @   rœ   )ÚSetOfSupportedAlgorithmN)rS   rT   rU   rô  rž   r9   r9   r9   r=   rø  Ô  rŸ   rø  c                
   @   sH   e Zd ZdefdefgZdZeee	e
eeeeedœ	Zdd„ ZdeiZdS )ÚSubjectDirectoryAttributer˜   r™   )r˜   r™   )	rç  rè  ré  rê  rë  rì  rí  rî  rï  c                 C   s"   | d j }|| jv r| j| S tS )Nr˜   )rZ   r  r)   )r;   Útype_r9   r9   r=   Ú_values_specë  s   


z&SubjectDirectoryAttribute._values_specN)rS   rT   rU   ræ  r   rš   r  rø  r®  rµ  rå  rñ  rò  ró  r  rû  Ú_spec_callbacksr9   r9   r9   r=   rù  Ø  s$    þ÷ÿrù  c                   @   rœ   )ÚSubjectDirectoryAttributesN)rS   rT   rU   rù  rž   r9   r9   r9   r=   rý  ö  rŸ   rý  c                   @   r­  )+ÚExtensionIdz2.5.29.9Úsubject_directory_attributesz	2.5.29.14rñ  z	2.5.29.15Ú	key_usagez	2.5.29.16Úprivate_key_usage_periodz	2.5.29.17Úsubject_alt_namez	2.5.29.18Úissuer_alt_namez	2.5.29.19Úbasic_constraintsz	2.5.29.30Úname_constraintsz	2.5.29.31Úcrl_distribution_pointsz	2.5.29.32Úcertificate_policiesz	2.5.29.33Úpolicy_mappingsz	2.5.29.35Úauthority_key_identifierz	2.5.29.36Úpolicy_constraintsz	2.5.29.37Úextended_key_usagez	2.5.29.46Úfreshest_crlz	2.5.29.54Úinhibit_any_policyz1.3.6.1.5.5.7.1.1Úauthority_information_accessÚsubject_information_accessÚtls_featureÚocsp_no_checkÚentrust_version_extensionÚnetscape_certificate_typeÚ!signed_certificate_timestamp_list)z1.3.6.1.5.5.7.1.11z1.3.6.1.5.5.7.1.24z1.3.6.1.5.5.7.48.1.5z1.2.840.113533.7.65.0z2.16.840.1.113730.1.1z1.3.6.1.4.1.11129.2.4.2Nr°   r9   r9   r9   r=   rþ  ú  sV    ÿþýüûúùø	÷
öõôóòñðïçrþ  c                   @   s¨   e Zd ZdefdeddifdefgZdZi de“de	“d	e
“d
e“de“de“de“de“de“de“de“de“de“de“de“de“de“eeeeee	dœ¥ZdS )Ú	ExtensionÚextn_idÚcriticalrî  FÚ
extn_value)r  r  rÿ  rñ  r   r  r  r  r  r  r  r  r  r	  r
  r  r  r  r  )r  r  r  r  r  r  N)rS   rT   rU   rþ  r   r$   rš   r  rý  r#   r¡   r´   rç  rì  r  r  r*  r.  rð  r/  rˆ  r   r“  r•  r–  r   r—  rš  r  r9   r9   r9   r=   r    s`    ýÿþýüûúùø	÷
öõôóòñðïér  c                   @   rœ   )Ú
ExtensionsN)rS   rT   rU   r  rž   r9   r9   r9   r=   r  ;  rŸ   r  c                   @   sl   e Zd Zdedddœfdefdefdefdefd	efd
efde	dddœfde	dddœfde
dddœfg
ZdS )ÚTbsCertificater³  r   r¥  )rk  rî  rÌ   Ú	signatureÚissuerÚvalidityÚsubjectÚsubject_public_key_infoÚissuer_unique_idr   Tr¶   Úsubject_unique_idr{   Ú
extensionsr¬   rˆ  N)rS   rT   rU   r¤  r   r   r÷   rë  r0   r"   r  rš   r9   r9   r9   r=   r  ?  s    ör  c                   @   sæ  e Zd ZdefdefdefgZdZdZdZ	dZ
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dd„ Z'e(dd	„ ƒZ)e(d
d„ ƒZ*e(dd„ ƒZ+e(dd„ ƒZ,e(dd„ ƒZ-e(dd„ ƒZ.e(dd„ ƒZ/e(dd„ ƒZ0e(dd„ ƒZ1e(dd„ ƒZ2e(dd„ ƒZ3e(dd„ ƒZ4e(d d!„ ƒZ5e(d"d#„ ƒZ6e(d$d%„ ƒZ7e(d&d'„ ƒZ8e(d(d)„ ƒZ9e(d*d+„ ƒZ:e(d,d-„ ƒZ;e(d.d/„ ƒZ<e(d0d1„ ƒZ=e(d2d3„ ƒZ>e(d4d5„ ƒZ?e(d6d7„ ƒZ@e(d8d9„ ƒZAe(d:d;„ ƒZBe(d<d=„ ƒZCe(d>d?„ ƒZDe(d@dA„ ƒZEe(dBdC„ ƒZFe(dDdE„ ƒZGe(dFdG„ ƒZHe(dHdI„ ƒZIe(dJdK„ ƒZJdLdM„ ZKe(dNdO„ ƒZLe(dPdQ„ ƒZMe(dRdS„ ƒZNe(dTdU„ ƒZOe(dVdW„ ƒZPe(dXdY„ ƒZQe(dZd[„ ƒZRe(d\d]„ ƒZSe(d^d_„ ƒZTe(d`da„ ƒZUe(dbdc„ ƒZVddde„ ZWdfdg„ ZXdhdi„ ZYdS )jÚCertificateÚtbs_certificateÚsignature_algorithmÚsignature_valueFNc                 C   sh   t ƒ | _| d d D ]$}|d j}d| }t| |ƒr#t| ||d jƒ |d jr.| j |¡ q
d| _dS )	zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r$  r"  r  z	_%s_valuer  r  TN)rR   Ú_critical_extensionsrZ   ÚhasattrÚsetattrÚparsedÚaddÚ_processed_extensions)r;   Ú	extensionr×   rG  r9   r9   r=   Ú_set_extensionsv  s   


€
zCertificate._set_extensionsc                 C   ó   | j s|  ¡  | jS )z²
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r,  r.  r'  r_   r9   r9   r=   Úcritical_extensionsˆ  ó   
zCertificate.critical_extensionsc                 C   r/  )z¼
        This extension is used to constrain the period over which the subject
        private key may be used

        :return:
            None or a PrivateKeyUsagePeriod object
        )r,  r.  Ú_private_key_usage_period_valuer_   r9   r9   r=   Úprivate_key_usage_period_value–  r1  z*Certificate.private_key_usage_period_valuec                 C   r/  )z½
        This extension is used to contain additional identification attributes
        about the subject.

        :return:
            None or a SubjectDirectoryAttributes object
        )r,  r.  Ú_subject_directory_attributesr_   r9   r9   r=   Ú"subject_directory_attributes_value¤  r1  z.Certificate.subject_directory_attributes_valuec                 C   r/  )zü
        This extension is used to help in creating certificate validation paths.
        It contains an identifier that should generally, but is not guaranteed
        to, be unique.

        :return:
            None or an OctetString object
        )r,  r.  Ú_key_identifier_valuer_   r9   r9   r=   Úkey_identifier_value²  ó   z Certificate.key_identifier_valuec                 C   r/  )z«
        This extension is used to define the purpose of the public key
        contained within the certificate.

        :return:
            None or a KeyUsage
        )r,  r.  Ú_key_usage_valuer_   r9   r9   r=   Úkey_usage_valueÁ  r1  zCertificate.key_usage_valuec                 C   r/  )aT  
        This extension allows for additional names to be associate with the
        subject of the certificate. While it may contain a whole host of
        possible names, it is usually used to allow certificates to be used
        with multiple different domain names.

        :return:
            None or a GeneralNames object
        )r,  r.  Ú_subject_alt_name_valuer_   r9   r9   r=   Úsubject_alt_name_valueÏ  ó   z"Certificate.subject_alt_name_valuec                 C   r/  )z¿
        This extension allows associating one or more alternative names with
        the issuer of the certificate.

        :return:
            None or an x509.GeneralNames object
        )r,  r.  Ú_issuer_alt_name_valuer_   r9   r9   r=   Úissuer_alt_name_valueß  r1  z!Certificate.issuer_alt_name_valuec                 C   r/  )a'  
        This extension is used to determine if the subject of the certificate
        is a CA, and if so, what the maximum number of intermediate CA certs
        after this are, before an end-entity certificate is found.

        :return:
            None or a BasicConstraints object
        )r,  r.  Ú_basic_constraints_valuer_   r9   r9   r=   Úbasic_constraints_valueí  r8  z#Certificate.basic_constraints_valuec                 C   r/  )zÃ
        This extension is used in CA certificates, and is used to limit the
        possible names of certificates issued.

        :return:
            None or a NameConstraints object
        )r,  r.  Ú_name_constraints_valuer_   r9   r9   r=   Úname_constraints_valueü  r1  z"Certificate.name_constraints_valuec                 C   r/  )zµ
        This extension is used to help in locating the CRL for this certificate.

        :return:
            None or a CRLDistributionPoints object
            extension
        )r,  r.  Ú_crl_distribution_points_valuer_   r9   r9   r=   Úcrl_distribution_points_value
	  r1  z)Certificate.crl_distribution_points_valuec                 C   r/  )a;  
        This extension defines policies in CA certificates under which
        certificates may be issued. In end-entity certificates, the inclusion
        of a policy indicates the issuance of the certificate follows the
        policy.

        :return:
            None or a CertificatePolicies object
        )r,  r.  Ú_certificate_policies_valuer_   r9   r9   r=   Úcertificate_policies_value	  r=  z&Certificate.certificate_policies_valuec                 C   r/  )zû
        This extension allows mapping policy OIDs to other OIDs. This is used
        to allow different policies to be treated as equivalent in the process
        of validation.

        :return:
            None or a PolicyMappings object
        )r,  r.  Ú_policy_mappings_valuer_   r9   r9   r=   Úpolicy_mappings_value(	  r8  z!Certificate.policy_mappings_valuec                 C   r/  )zÏ
        This extension helps in identifying the public key with which to
        validate the authenticity of the certificate.

        :return:
            None or an AuthorityKeyIdentifier object
        )r,  r.  Ú_authority_key_identifier_valuer_   r9   r9   r=   Úauthority_key_identifier_value7	  r1  z*Certificate.authority_key_identifier_valuec                 C   r/  )z¹
        This extension is used to control if policy mapping is allowed and
        when policies are required.

        :return:
            None or a PolicyConstraints object
        )r,  r.  Ú_policy_constraints_valuer_   r9   r9   r=   Úpolicy_constraints_valueE	  r1  z$Certificate.policy_constraints_valuec                 C   r/  )z–
        This extension is used to help locate any available delta CRLs

        :return:
            None or an CRLDistributionPoints object
        )r,  r.  Ú_freshest_crl_valuer_   r9   r9   r=   Úfreshest_crl_valueS	  s   	zCertificate.freshest_crl_valuec                 C   r/  )z¥
        This extension is used to prevent mapping of the any policy to
        specific requirements

        :return:
            None or a Integer object
        )r,  r.  Ú_inhibit_any_policy_valuer_   r9   r9   r=   Úinhibit_any_policy_value`	  r1  z$Certificate.inhibit_any_policy_valuec                 C   r/  )zÖ
        This extension is used to define additional purposes for the public key
        beyond what is contained in the basic constraints.

        :return:
            None or an ExtKeyUsageSyntax object
        )r,  r.  Ú_extended_key_usage_valuer_   r9   r9   r=   Úextended_key_usage_valuen	  r1  z$Certificate.extended_key_usage_valuec                 C   r/  )zâ
        This extension is used to locate the CA certificate used to sign this
        certificate, or the OCSP responder for this certificate.

        :return:
            None or an AuthorityInfoAccessSyntax object
        )r,  r.  Ú#_authority_information_access_valuer_   r9   r9   r=   Ú"authority_information_access_value|	  r1  z.Certificate.authority_information_access_valuec                 C   r/  )z´
        This extension is used to access information about the subject of this
        certificate.

        :return:
            None or a SubjectInfoAccessSyntax object
        )r,  r.  Ú!_subject_information_access_valuer_   r9   r9   r=   Ú subject_information_access_valueŠ	  r1  z,Certificate.subject_information_access_valuec                 C   r/  )zÍ
        This extension is used to list the TLS features a server must respond
        with if a client initiates a request supporting them.

        :return:
            None or a Features object
        )r,  r.  Ú_tls_feature_valuer_   r9   r9   r=   Útls_feature_value˜	  r1  zCertificate.tls_feature_valuec                 C   r/  )a-  
        This extension is used on certificates of OCSP responders, indicating
        that revocation information for the certificate should never need to
        be verified, thus preventing possible loops in path validation.

        :return:
            None or a Null object (if present)
        )r,  r.  Ú_ocsp_no_check_valuer_   r9   r9   r=   Úocsp_no_check_value¦	  r8  zCertificate.ocsp_no_check_valuec                 C   ó
   | d j S )zE
        :return:
            A byte string of the signature
        r&  r0  r_   r9   r9   r=   r  µ	  ó   
zCertificate.signaturec                 C   r\  )zj
        :return:
            A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
        r%  )Úsignature_algor_   r9   r9   r=   r^  ¾	  r]  zCertificate.signature_algoc                 C   r\  )zŸ
        :return:
            A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
            "sha384", "sha512", "sha512_224", "sha512_256"
        r%  )Ú	hash_algor_   r9   r9   r=   r_  Ç	  s   
zCertificate.hash_algoc                 C   ó   | d d S )zT
        :return:
            The PublicKeyInfo object for this certificate
        r$  r  r9   r_   r9   r9   r=   Ú
public_keyÑ	  ó   zCertificate.public_keyc                 C   r`  )zZ
        :return:
            The Name object for the subject of this certificate
        r$  r  r9   r_   r9   r9   r=   r  Ú	  rb  zCertificate.subjectc                 C   r`  )zY
        :return:
            The Name object for the issuer of this certificate
        r$  r  r9   r_   r9   r9   r=   r  ã	  rb  zCertificate.issuerc                 C   s   | d d j S )zT
        :return:
            An integer of the certificate's serial number
        r$  rÌ   r0  r_   r9   r9   r=   rÌ   ì	  s   zCertificate.serial_numberc                 C   s   | j sdS | j jS )zŽ
        :return:
            None or a byte string of the certificate's key identifier from the
            key identifier extension
        N)r7  rZ   r_   r9   r9   r=   rñ  õ	  s   zCertificate.key_identifierc                 C   s.   | j du r| jjd t| jƒ d¡ | _ | j S )zÐ
        :return:
            A byte string of the SHA-256 hash of the issuer concatenated with
            the ascii character ":", concatenated with the serial number as
            an ascii string
        Nó   :re   )Ú_issuer_serialr  rg  r   rÌ   rJ   r_   r9   r9   r=   Úissuer_serial
  s   
	zCertificate.issuer_serialc                 C   s   | j sdS | j d jS )zŠ
        :return:
            None or a byte string of the key_identifier from the authority key
            identifier extension
        Nrñ  )rK  rZ   r_   r9   r9   r=   r	  
  s   z$Certificate.authority_key_identifierc                 C   sn   | j du r4| j}|r1|d jr1| jd d j}| ¡ }| jd j}|jd t|ƒ d¡ | _ | j S d| _ | j S )a;  
        :return:
            None or a byte string of the SHA-256 hash of the isser from the
            authority key identifier extension concatenated with the ascii
            character ":", concatenated with the serial number from the
            authority key identifier extension as an ascii string
        Frò  r   ró  rc  re   N)Ú_authority_issuer_serialrK  rZ   rJ  Úuntagrg  r   rJ   )r;   Úakivr  Úauthority_serialr9   r9   r=   Úauthority_issuer_serial
  s   

ÿz#Certificate.authority_issuer_serialc                 C   ó   | j du r|  | j¡| _ | j S )z˜
        Returns complete CRL URLs - does not include delta CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)Ú_crl_distribution_pointsÚ!_get_http_crl_distribution_pointsrE  r_   r9   r9   r=   r  2
  ó   
	z#Certificate.crl_distribution_pointsc                 C   rk  )z˜
        Returns delta CRL URLs - does not include complete CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)Ú_delta_crl_distribution_pointsrm  rO  r_   r9   r9   r=   Údelta_crl_distribution_points?
  rn  z)Certificate.delta_crl_distribution_pointsc                 C   s\   g }|du rg S |D ]!}|d }|t u rq
|jdkrq
|jD ]}|jdkr*| |¡ qq
|S )a?  
        Fetches the DistributionPoint object for non-relative, HTTP CRLs
        referenced by the certificate

        :param crl_distribution_points:
            A CRLDistributionPoints object to grab the DistributionPoints from

        :return:
            A list of zero or more DistributionPoint objects
        Nr  rö  rä  )r/   r×   rJ  r%  )r;   r  r&  r  Údistribution_point_namer  r9   r9   r=   rm  L
  s   



€þz-Certificate._get_http_crl_distribution_pointsc                 C   s^   | j sg S g }| j D ]"}|d jdkr,|d }|jdkrq
|j}| ¡  d¡r,| |¡ q
|S )zx
        :return:
            A list of zero or more unicode strings of the OCSP URLs for this
            cert
        r‘  rŒ  r’  rä  r  )rU  rZ   r×   rB   rI   r%  )r;   r&  ÚentryÚlocationr  r9   r9   r=   Ú	ocsp_urlsk
  s   


€zCertificate.ocsp_urlsc                 C   s¢   | j du rNg | _ | jr&| jD ]}|jdkr"|j| j vr"| j  |j¡ q| j S t d¡}| jjD ]}|D ]}|d jdkrL|d j}| 	|¡rL| j  |¡ q3q/| j S )z»
        :return:
            A list of unicode strings of valid domain names for the certificate.
            Wildcard certificates will have a domain in the form: *.example.com
        Nrà  zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r˜   rÊ   rP   )
Ú_valid_domainsr<  r×   rZ   r%  r  Úcompiler  rJ  Úmatch)r;   r  Úpatternr7  Úname_type_valuerP   r9   r9   r=   Úvalid_domains�
  s$   

€
ø

€üzCertificate.valid_domainsc                 C   s@   | j du rg | _ | jr| jD ]}|jdkr| j  |j¡ q| j S )zj
        :return:
            A list of unicode strings of valid IP addresses for the certificate
        Nrå  )Ú
_valid_ipsr<  r×   r%  rZ   )r;   r  r9   r9   r=   Ú	valid_ips¤
  s   


€zCertificate.valid_ipsc                 C   s   | j o| j d jS )zW
        :return;
            A boolean - if the certificate is marked as a CA
        rí  )rA  rZ   r_   r9   r9   r=   rí  µ
  s   zCertificate.cac                 C   s   | j sdS | jd jS )zT
        :return;
            None or an integer of the maximum path length
        Nrï  )rí  rA  rZ   r_   r9   r9   r=   Úmax_path_length¾
  s   zCertificate.max_path_lengthc                 C   s   | j du r| j| jk| _ | j S )zx
        :return:
            A boolean - if the certificate is self-issued, as defined by RFC
            5280
        N)Ú_self_issuedr  r  r_   r9   r9   r=   Úself_issuedÉ
  s   
zCertificate.self_issuedc                 C   sR   | j du r&d| _ | jr&| jr#| jsd| _ | j S | j| jkr d| _ | j S d| _ | j S )aõ  
        :return:
            A unicode string of "no" or "maybe". The "maybe" result will
            be returned if the certificate issuer and subject are the same.
            If a key identifier and authority key identifier are present,
            they will need to match otherwise "no" will be returned.

            To verify is a certificate is truly self-signed, the signature
            will need to be verified. See the certvalidator package for
            one possible solution.
        NÚnoÚmaybe)Ú_self_signedr  rñ  r	  r_   r9   r9   r=   Úself_signedÕ
  s   
üÿzCertificate.self_signedc                 C   r]  )zk
        :return:
            The SHA-1 hash of the DER-encoded bytes of this complete certificate
        Nr^  r_   r9   r9   r=   ra  ï
  rd  zCertificate.sha1c                 C   ó   d  dd„ t| jƒD ƒ¡S )z¯
        :return:
            A unicode string of the SHA-1 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r  c                 s   ó   � | ]}d | V  qdS ©z%02XNr9   ©r2  Úcr9   r9   r=   r<    ó   € z/Certificate.sha1_fingerprint.<locals>.<genexpr>)r	  r   ra  r_   r9   r9   r=   Úsha1_fingerprintú
  ó   zCertificate.sha1_fingerprintc                 C   r]  )zy
        :return:
            The SHA-256 hash of the DER-encoded bytes of this complete
            certificate
        Nre  r_   r9   r9   r=   rg    s   
zCertificate.sha256c                 C   r„  )z±
        :return:
            A unicode string of the SHA-256 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r  c                 s   r…  r†  r9   r‡  r9   r9   r=   r<    r‰  z1Certificate.sha256_fingerprint.<locals>.<genexpr>)r	  r   rg  r_   r9   r9   r=   Úsha256_fingerprint  r‹  zCertificate.sha256_fingerprintc                 C   sH  t |tƒsttdt|ƒƒƒ‚| d¡ d¡ ¡ }| d¡dk}| o't	 
d|¡}| o-| }|rq| js5dS | d¡}| jD ]1}| d¡ d¡ ¡ }| d¡}	t|	ƒt|ƒkrWq=|	|kr^ d	S |  |¡}
|
rn|  ||	¡rn d	S q=dS | jsvdS |r{tjntj}t||ƒ}| jD ]}| d¡dkr’tjntj}t||ƒ}||kr¡ d	S q†dS )
a  
        Check if a domain name or IP address is valid according to the
        certificate

        :param domain_ip:
            A unicode string of a domain name or IP address

        :return:
            A boolean - if the domain or IP is valid for the certificate
        zL
                domain_ip must be a unicode string, not %s
                r   re   rv   rd   z^\d+\.\d+\.\d+\.\d+$FrE   T)r@   r   rH   r	   r   rJ   rk   rB   rg   r  rw  rz  r~   rƒ   Ú_is_wildcard_domainÚ_is_wildcard_matchr|  r€   r‚   r�   r4   )r;   Ú	domain_ipÚencoded_domain_ipÚis_ipv6Úis_ipv4Ú	is_domainÚdomain_labelsÚvalid_domainÚencoded_valid_domainÚvalid_domain_labelsÚis_wildcardrŠ   Únormalized_ipÚvalid_ipÚvalid_familyÚnormalized_valid_ipr9   r9   r=   Úis_valid_domain_ip  sH   
ü



€


ÿzCertificate.is_valid_domain_ipc                 C   sZ   |  d¡dkr	dS | ¡  d¡}|sdS |d  d¡dkrdS |d dd… dkr+dS d	S )
af  
        Checks if a domain is a valid wildcard according to
        https://tools.ietf.org/html/rfc6125#section-6.4.3

        :param domain:
            A unicode string of the domain name, where any U-labels from an IDN
            have been converted to A-labels

        :return:
            A boolean - if the domain is a valid wildcard domain
        Ú*r   FrE   r   rd   r�   zxn--T)ÚcountrB   r~   rg   )r;   ÚdomainÚlabelsr9   r9   r=   r�  \  s   zCertificate._is_wildcard_domainc                 C   sl   |d }|dd… }|d }|dd… }||krdS |dkr dS t  d| dd¡ d	 ¡}| |¡r4dS dS )
aÿ  
        Determines if the labels in a domain are a match for labels from a
        wildcard valid domain name

        :param domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in the domain name to check

        :param valid_domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in a wildcard domain pattern

        :return:
            A boolean - if the domain matches the valid domain
        r   r   NFrž  Tú^z.*ú$)r  rv  r  rw  )r;   r”  r—  Úfirst_domain_labelÚother_domain_labelsÚwildcard_labelÚother_valid_domain_labelsÚwildcard_regexr9   r9   r=   rŽ  }  s   
zCertificate._is_wildcard_match)ZrS   rT   rU   r  r   r"   rš   r,  r'  r4  r6  r9  r;  r>  r@  rB  rD  rF  rH  rJ  rL  rN  rP  rR  rT  rV  r2  rX  rZ  rd  rf  rl  ro  ru  r{  r~  r‚  r_  rf  r.  rn   r0  r3  r5  r7  r:  r<  r?  rA  rC  rE  rG  rI  rK  rM  rO  rQ  rS  rU  rW  rY  r[  r  r^  r_  ra  r  r  rÌ   rñ  re  r	  rj  r  rp  rm  rt  rz  r|  rí  r}  r  rƒ  ra  rŠ  rg  rŒ  r�  r�  rŽ  r9   r9   r9   r=   r#  N  s   ý























	











"








	

	B!r#  c                   @   rœ   )ÚKeyPurposeIdentifiersNr‰  r9   r9   r9   r=   r©  §  rŸ   r©  c                   @   rœ   )ÚSequenceOfAlgorithmIdentifiersN)rS   rT   rU   r   rž   r9   r9   r9   r=   rª  «  rŸ   rª  c                	   @   sP   e Zd Zdeddifdedddœfdeddifdeddifd	ed
ddœfgZdS )ÚCertificateAuxÚtrustr¸   TÚrejectr   r¶   ÚaliasÚkeyidr<   r   N)rS   rT   rU   r©  r-   r#   rª  rš   r9   r9   r9   r=   r«  ¯  s    ûr«  c                   @   s   e Zd ZeegZdS )ÚTrustedCertificateN)rS   rT   rU   r#  r«  Ú_child_specsr9   r9   r9   r=   r°  ¹  s    r°  )¶r¾   Ú
__future__r   r   r   r   Ú
contextlibr   Ú	encodingsr   r`  r  r€   r
  r  r  Ú_errorsr	   Ú_irir
   r   Ú_ordereddictr   Ú_typesr   r   r   Úalgosr   r   r   r   Úcorer   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r$  r0   Úutilr1   r2   r3   r4   r5   rW   r`   rp   r—   r�   r¡   r´   r»   rÀ   rÁ   rÉ   rý   r  r:  r÷   ri  rl  rs  rw  r{  r~  r€  r‚  rƒ  r�  rŽ  r�  r�  r‘  r’  r–  r˜  r™  r›  rž  rŸ  r¤  r§  r®  rÐ  rÓ  rÕ  rÚ  rÝ  rç  rè  rë  rì  rð  rô  r÷  r  r  r  r  r  r  r  r  r  r  r!  r$  r%  r'  r*  r+  r.  r/  r3  rˆ  r‹  r�  r“  r•  r–  r—  rš  r¤  rª  r®  r¯  r²  rµ  r¶  r»  r½  r¾  rÆ  rÊ  rÎ  rÑ  rÚ  rÛ  rÜ  rå  ræ  rñ  rò  ró  rô  rø  rù  rý  rþ  r  r  r  r#  r©  rª  r«  r°  r9   r9   r9   r=   Ú<module>   s  x59l 
  AU* D

			"2%	n			#      _
