o
    b:{                     @   s  d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZmZ d dlmZmZmZmZmZ d dlmZmZ d d	lmZmZmZ d d
lmZ d dlm Z  edddZ!G dd de"Z#dee dej$ee  ddfddZ%de dej$ej&e e'f  ddfddZ(dejdejfddZ)G dd dej*Z+G dd de"Z,G d d! d!e j-d"Z.e./ej. G d#d$ d$e j-d"Z0e0/ej0 G d%d& d&e j-d"Z1e1/ej1 G d'd( d(e j-d"Z2e2/ej2 	dAd)e'd*ej3de.fd+d,Z4	dAd)e'd*ej3de.fd-d.Z5	dAd)e'd*ej6e	 de2fd/d0Z7	dAd)e'd*ej6e	 de2fd1d2Z8	dAd)e'd*ej6e	 de1fd3d4Z9	dAd)e'd*ej6e	 de1fd5d6Z:G d7d8 d8e;Z<G d9d: d:e;Z=G d;d< d<e;Z>G d=d> d>e;Z?de@fd?d@ZAdS )B    N)utils)_get_backend)Backend)x509)hashesserialization)dsaeced25519ed448rsa)PRIVATE_KEY_TYPESPUBLIC_KEY_TYPES)	ExtensionExtensionType
Extensions)Name)ObjectIdentifieri     c                       *   e Zd Zdededdf fddZ  ZS )AttributeNotFoundmsgoidreturnNc                       t t| | || _d S N)superr   __init__r   )selfr   r   	__class__ U/var/www/secure340b-portal/env/lib/python3.10/site-packages/cryptography/x509/base.pyr   $      
zAttributeNotFound.__init__)__name__
__module____qualname__strr   r   __classcell__r!   r!   r   r"   r   #       "r   	extension
extensionsr   c                 C   s"   |D ]}|j | j krtdqd S )Nz$This extension has already been set.)r   
ValueError)r*   r+   er!   r!   r"   _reject_duplicate_extension)   s
   r.   r   
attributesc                 C   s"   |D ]\}}|| krt dqd S )Nz$This attribute has already been set.)r,   )r   r/   Zattr_oid_r!   r!   r"   _reject_duplicate_attribute3   s
   r1   timec                 C   s6   | j dur|  }|r|nt }| jdd| S | S )zNormalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    N)tzinfo)r3   	utcoffsetdatetime	timedeltareplace)r2   offsetr!   r!   r"   _convert_to_naive_utc_time=   s
   
r9   c                   @   s   e Zd ZdZdZdS )Versionr      N)r$   r%   r&   v1v3r!   r!   r!   r"   r:   K   s    r:   c                       r   )InvalidVersionr   parsed_versionr   Nc                    r   r   )r   r>   r   r?   )r   r   r?   r   r!   r"   r   Q   r#   zInvalidVersion.__init__)r$   r%   r&   r'   intr   r(   r!   r!   r   r"   r>   P   r)   r>   c                   @   s  e Zd ZejdejdefddZej	de
fddZej	defddZejdefd	d
Zej	dejfddZej	dejfddZej	defddZej	defddZej	dejej fddZej	defddZej	defddZej	defddZej	defddZejdede fddZ!ejdede fd d!Z"ejde
fd"d#Z#ejd$e$j%defd%d&Z&d'S )(Certificate	algorithmr   c                 C      dS z4
        Returns bytes using digest passed.
        Nr!   r   rB   r!   r!   r"   fingerprintW       zCertificate.fingerprintc                 C   rC   )z3
        Returns certificate serial number
        Nr!   r   r!   r!   r"   serial_number]   rG   zCertificate.serial_numberc                 C   rC   )z1
        Returns the certificate version
        Nr!   rH   r!   r!   r"   versionc   rG   zCertificate.versionc                 C   rC   z(
        Returns the public key
        Nr!   rH   r!   r!   r"   
public_keyi   rG   zCertificate.public_keyc                 C   rC   )z?
        Not before time (represented as UTC datetime)
        Nr!   rH   r!   r!   r"   not_valid_beforeo   rG   zCertificate.not_valid_beforec                 C   rC   )z>
        Not after time (represented as UTC datetime)
        Nr!   rH   r!   r!   r"   not_valid_afteru   rG   zCertificate.not_valid_afterc                 C   rC   )z1
        Returns the issuer name object.
        Nr!   rH   r!   r!   r"   issuer{   rG   zCertificate.issuerc                 C   rC   z2
        Returns the subject name object.
        Nr!   rH   r!   r!   r"   subject   rG   zCertificate.subjectc                 C   rC   zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nr!   rH   r!   r!   r"   signature_hash_algorithm   rG   z$Certificate.signature_hash_algorithmc                 C   rC   zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nr!   rH   r!   r!   r"   signature_algorithm_oid   rG   z#Certificate.signature_algorithm_oidc                 C   rC   )z/
        Returns an Extensions object.
        Nr!   rH   r!   r!   r"   r+      rG   zCertificate.extensionsc                 C   rC   z.
        Returns the signature bytes.
        Nr!   rH   r!   r!   r"   	signature   rG   zCertificate.signaturec                 C   rC   )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nr!   rH   r!   r!   r"   tbs_certificate_bytes   rG   z!Certificate.tbs_certificate_bytesotherc                 C   rC   z"
        Checks equality.
        Nr!   r   rY   r!   r!   r"   __eq__   rG   zCertificate.__eq__c                 C   rC   z#
        Checks not equal.
        Nr!   r[   r!   r!   r"   __ne__   rG   zCertificate.__ne__c                 C   rC   z"
        Computes a hash.
        Nr!   rH   r!   r!   r"   __hash__   rG   zCertificate.__hash__encodingc                 C   rC   )zB
        Serializes the certificate to PEM or DER format.
        Nr!   r   ra   r!   r!   r"   public_bytes   rG   zCertificate.public_bytesN)'r$   r%   r&   abcabstractmethodr   HashAlgorithmbytesrF   abstractpropertyr@   rI   r:   rJ   r   rL   r5   rM   rN   r   rO   rQ   typingOptionalrS   r   rU   r   r+   rW   rX   objectboolr\   r^   r`   r   Encodingrc   r!   r!   r!   r"   rA   V   sJ    
rA   )	metaclassc                   @   sJ   e Zd ZejdefddZejdejfddZejde	fddZ
dS )	RevokedCertificater   c                 C   rC   )zG
        Returns the serial number of the revoked certificate.
        Nr!   rH   r!   r!   r"   rI      rG   z RevokedCertificate.serial_numberc                 C   rC   )zH
        Returns the date of when this certificate was revoked.
        Nr!   rH   r!   r!   r"   revocation_date   rG   z"RevokedCertificate.revocation_datec                 C   rC   )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nr!   rH   r!   r!   r"   r+      rG   zRevokedCertificate.extensionsN)r$   r%   r&   rd   rh   r@   rI   r5   rp   r   r+   r!   r!   r!   r"   ro      s    ro   c                   @   s  e Zd ZejdejdefddZejde	j
defddZejdedeje fd	d
Zejdeje	j
 fddZejdefddZejdefddZejdejej fddZejdejfddZejdefddZejdefddZejdefddZejdedefddZ ejdedefddZ!ejdefd d!Z"ej#d"edefd#d$Z$ej#d"e%dej&e fd%d$Z$ejd"ej'ee%f dej'eej&e f fd&d$Z$ejdej(e fd'd(Z)ejd)e*defd*d+Z+d,S )-CertificateRevocationListra   r   c                 C   rC   )z:
        Serializes the CRL to PEM or DER format.
        Nr!   rb   r!   r!   r"   rc      rG   z&CertificateRevocationList.public_bytesrB   c                 C   rC   rD   r!   rE   r!   r!   r"   rF      rG   z%CertificateRevocationList.fingerprintrI   c                 C   rC   )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nr!   )r   rI   r!   r!   r"   (get_revoked_certificate_by_serial_number   rG   zBCertificateRevocationList.get_revoked_certificate_by_serial_numberc                 C   rC   rR   r!   rH   r!   r!   r"   rS      rG   z2CertificateRevocationList.signature_hash_algorithmc                 C   rC   rT   r!   rH   r!   r!   r"   rU      rG   z1CertificateRevocationList.signature_algorithm_oidc                 C   rC   )zC
        Returns the X509Name with the issuer of this CRL.
        Nr!   rH   r!   r!   r"   rO     rG   z CertificateRevocationList.issuerc                 C   rC   )z?
        Returns the date of next update for this CRL.
        Nr!   rH   r!   r!   r"   next_update  rG   z%CertificateRevocationList.next_updatec                 C   rC   )z?
        Returns the date of last update for this CRL.
        Nr!   rH   r!   r!   r"   last_update  rG   z%CertificateRevocationList.last_updatec                 C   rC   )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nr!   rH   r!   r!   r"   r+     rG   z$CertificateRevocationList.extensionsc                 C   rC   rV   r!   rH   r!   r!   r"   rW     rG   z#CertificateRevocationList.signaturec                 C   rC   )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nr!   rH   r!   r!   r"   tbs_certlist_bytes   rG   z,CertificateRevocationList.tbs_certlist_bytesrY   c                 C   rC   rZ   r!   r[   r!   r!   r"   r\   &  rG   z CertificateRevocationList.__eq__c                 C   rC   r]   r!   r[   r!   r!   r"   r^   ,  rG   z CertificateRevocationList.__ne__c                 C   rC   )z<
        Number of revoked certificates in the CRL.
        Nr!   rH   r!   r!   r"   __len__2  rG   z!CertificateRevocationList.__len__idxc                 C      d S r   r!   r   rw   r!   r!   r"   __getitem__8     z%CertificateRevocationList.__getitem__c                 C   rx   r   r!   ry   r!   r!   r"   rz   <  r{   c                 C   rC   )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nr!   ry   r!   r!   r"   rz   @  rG   c                 C   rC   )z8
        Iterator over the revoked certificates
        Nr!   rH   r!   r!   r"   __iter__H  rG   z"CertificateRevocationList.__iter__rL   c                 C   rC   )zQ
        Verifies signature of revocation list against given public key.
        Nr!   )r   rL   r!   r!   r"   is_signature_validN  rG   z,CertificateRevocationList.is_signature_validN),r$   r%   r&   rd   re   r   rm   rg   rc   r   rf   rF   r@   ri   rj   ro   rr   rh   rS   r   rU   r   rO   r5   rs   rt   r   r+   rW   ru   rk   rl   r\   r^   rv   overloadrz   sliceListUnionIteratorr|   r   r}   r!   r!   r!   r"   rq      sb    
rq   c                   @   s*  e Zd ZejdedefddZejdedefddZejde	fddZ
ejdefd	d
ZejdefddZejdejej fddZejdefddZejdefddZejdejdefddZejdefddZejdefddZejdefddZejdedefddZ dS ) CertificateSigningRequestrY   r   c                 C   rC   rZ   r!   r[   r!   r!   r"   r\   Y  rG   z CertificateSigningRequest.__eq__c                 C   rC   r]   r!   r[   r!   r!   r"   r^   _  rG   z CertificateSigningRequest.__ne__c                 C   rC   r_   r!   rH   r!   r!   r"   r`   e  rG   z"CertificateSigningRequest.__hash__c                 C   rC   rK   r!   rH   r!   r!   r"   rL   k  rG   z$CertificateSigningRequest.public_keyc                 C   rC   rP   r!   rH   r!   r!   r"   rQ   q  rG   z!CertificateSigningRequest.subjectc                 C   rC   rR   r!   rH   r!   r!   r"   rS   w  rG   z2CertificateSigningRequest.signature_hash_algorithmc                 C   rC   rT   r!   rH   r!   r!   r"   rU     rG   z1CertificateSigningRequest.signature_algorithm_oidc                 C   rC   )z@
        Returns the extensions in the signing request.
        Nr!   rH   r!   r!   r"   r+     rG   z$CertificateSigningRequest.extensionsra   c                 C   rC   )z;
        Encodes the request to PEM or DER format.
        Nr!   rb   r!   r!   r"   rc     rG   z&CertificateSigningRequest.public_bytesc                 C   rC   rV   r!   rH   r!   r!   r"   rW     rG   z#CertificateSigningRequest.signaturec                 C   rC   )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nr!   rH   r!   r!   r"   tbs_certrequest_bytes  rG   z/CertificateSigningRequest.tbs_certrequest_bytesc                 C   rC   )z8
        Verifies signature of signing request.
        Nr!   rH   r!   r!   r"   r}     rG   z,CertificateSigningRequest.is_signature_validr   c                 C   rC   )z:
        Get the attribute value for a given OID.
        Nr!   )r   r   r!   r!   r"   get_attribute_for_oid  rG   z/CertificateSigningRequest.get_attribute_for_oidN)!r$   r%   r&   rd   re   rk   rl   r\   r^   r@   r`   r   rL   rh   r   rQ   ri   rj   r   rf   rS   r   rU   r   r+   r   rm   rg   rc   rW   r   r}   r   r!   r!   r!   r"   r   X  s:    
r   databackendc                 C   
   t | S r   )	rust_x509load_pem_x509_certificater   r   r!   r!   r"   r        
r   c                 C   r   r   )r   load_der_x509_certificater   r!   r!   r"   r     r   r   c                 C   r   r   )r   load_pem_x509_csrr   r!   r!   r"   r     r   r   c                 C   r   r   )r   load_der_x509_csrr   r!   r!   r"   r     r   r   c                 C   r   r   )r   load_pem_x509_crlr   r!   r!   r"   r     r   r   c                 C   r   r   )r   load_der_x509_crlr   r!   r!   r"   r     r   r   c                
   @   s   e Zd Zdg g fdeje dejee  dejej	e
ef  fddZdedd fd	d
Zdededd fddZde
dedd fddZ	ddedejej deje defddZdS ) CertificateSigningRequestBuilderNsubject_namer+   r/   c                 C   s   || _ || _|| _dS )zB
        Creates an empty X.509 certificate request (v1).
        N)_subject_name_extensions_attributes)r   r   r+   r/   r!   r!   r"   r     s   	
z)CertificateSigningRequestBuilder.__init__namer   c                 C   s4   t |ts	td| jdurtdt|| j| jS )zF
        Sets the certificate requestor's distinguished name.
        Expecting x509.Name object.N&The subject name may only be set once.)
isinstancer   	TypeErrorr   r,   r   r   r   r   r   r!   r!   r"   r     s   


z-CertificateSigningRequestBuilder.subject_nameextvalcriticalc                 C   sD   t |ts	tdt|j||}t|| j t| j| j|g | j	S )zE
        Adds an X.509 extension to the certificate request.
        "extension must be an ExtensionType)
r   r   r   r   r   r.   r   r   r   r   r   r   r   r*   r!   r!   r"   add_extension  s   

z.CertificateSigningRequestBuilder.add_extensionr   valuec                 C   sL   t |ts	tdt |tstdt|| j t| j| j| j||fg S )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytes)	r   r   r   rg   r1   r   r   r   r   )r   r   r   r!   r!   r"   add_attribute  s   

z.CertificateSigningRequestBuilder.add_attributeprivate_keyrB   r   c                 C   s(   t |}| jdu rtd|| ||S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subject)r   r   r,   Zcreate_x509_csrr   r   rB   r   r!   r!   r"   sign  s   	
z%CertificateSigningRequestBuilder.signr   )r$   r%   r&   ri   rj   r   r   r   r   Tupler   rg   r   r   rl   r   r   r   r   rf   r   r   r   r!   r!   r!   r"   r     sH    



r   c                   @   s>  e Zd ZU ejee  ed< ddddddg fdeje	 deje	 deje
 deje dejej dejej d	ejee  d
dfddZde	d
d fddZde	d
d fddZde
d
d fddZded
d fddZdejd
d fddZdejd
d fddZdeded
d fdd Z	d&d!ed"ejej d#eje d
efd$d%ZdS )'CertificateBuilderr   Nissuer_namer   rL   rI   rM   rN   r+   r   c                 C   s6   t j| _|| _|| _|| _|| _|| _|| _|| _	d S r   )
r:   r=   _version_issuer_namer   _public_key_serial_number_not_valid_before_not_valid_afterr   )r   r   r   rL   rI   rM   rN   r+   r!   r!   r"   r   ,  s   

zCertificateBuilder.__init__r   c                 C   sD   t |ts	td| jdurtdt|| j| j| j| j	| j
| jS )z3
        Sets the CA's distinguished name.
        r   N%The issuer name may only be set once.)r   r   r   r   r,   r   r   r   r   r   r   r   r   r!   r!   r"   r   ?  s   

zCertificateBuilder.issuer_namec                 C   sD   t |ts	td| jdurtdt| j|| j| j| j	| j
| jS )z:
        Sets the requestor's distinguished name.
        r   Nr   )r   r   r   r   r,   r   r   r   r   r   r   r   r   r!   r!   r"   r   Q  s   

zCertificateBuilder.subject_namekeyc                 C   sX   t |tjtjtjtjt	j
fstd| jdurtdt| j| j|| j| j| j| jS )zT
        Sets the requestor's public key (as found in the signing request).
        zhExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey or Ed448PublicKey.Nz$The public key may only be set once.)r   r   ZDSAPublicKeyr   ZRSAPublicKeyr	   ZEllipticCurvePublicKeyr
   ZEd25519PublicKeyr   ZEd448PublicKeyr   r   r,   r   r   r   r   r   r   r   )r   r   r!   r!   r"   rL   c  s.   

zCertificateBuilder.public_keynumberc                 C   sh   t |ts	td| jdurtd|dkrtd| dkr$tdt| j| j| j	|| j
| j| jS )z5
        Sets the certificate serial number.
        'Serial number must be of integral type.N'The serial number may only be set once.r   z%The serial number should be positive.   3The serial number should not be more than 159 bits.)r   r@   r   r   r,   
bit_lengthr   r   r   r   r   r   r   r   r   r!   r!   r"   rI     s&   

z CertificateBuilder.serial_numberr2   c                 C   sz   t |tjs
td| jdurtdt|}|tk rtd| jdur-|| jkr-tdt| j	| j
| j| j|| j| jS )z7
        Sets the certificate activation time.
        Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)r   r5   r   r   r,   r9   _EARLIEST_UTC_TIMEr   r   r   r   r   r   r   r   r2   r!   r!   r"   rM     s,   
z#CertificateBuilder.not_valid_beforec                 C   sz   t |tjs
td| jdurtdt|}|tk rtd| jdur-|| jk r-tdt| j	| j
| j| j| j|| jS )z7
        Sets the certificate expiration time.
        r   Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)r   r5   r   r   r,   r9   r   r   r   r   r   r   r   r   r   r!   r!   r"   rN     s2   
z"CertificateBuilder.not_valid_afterr   r   c              	   C   sT   t |ts	tdt|j||}t|| j t| j| j	| j
| j| j| j| j|g S )z=
        Adds an X.509 extension to the certificate.
        r   )r   r   r   r   r   r.   r   r   r   r   r   r   r   r   r   r!   r!   r"   r     s   

z CertificateBuilder.add_extensionr   rB   r   c                 C   s   t |}| jdu rtd| jdu rtd| jdu rtd| jdu r(td| jdu r1td| jdu r:td|| ||S )zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key)	r   r   r,   r   r   r   r   r   Zcreate_x509_certificater   r!   r!   r"   r     s   	





zCertificateBuilder.signr   )r$   r%   r&   ri   r   r   r   __annotations__rj   r   r   r@   r5   r   r   r   rL   rI   rM   rN   rl   r   r   r   rf   r   rA   r   r!   r!   r!   r"   r   )  sr   
 

	

"
 

r   c                   @   s  e Zd ZU ejee  ed< eje ed< dddg g fdej	e
 dej	ej dej	ej dejee  deje f
d	d
Zde
dd fddZdejdd fddZdejdd fddZdededd fddZdedd fddZ	ddedej	ej dej	e defddZdS ) CertificateRevocationListBuilderr   _revoked_certificatesNr   rt   rs   r+   revoked_certificatesc                 C   s"   || _ || _|| _|| _|| _d S r   )r   _last_update_next_updater   r   )r   r   rt   rs   r+   r   r!   r!   r"   r     s
   
z)CertificateRevocationListBuilder.__init__r   c                 C   s<   t |ts	td| jd urtdt|| j| j| j| j	S )Nr   r   )
r   r   r   r   r,   r   r   r   r   r   )r   r   r!   r!   r"   r   &  s   

z,CertificateRevocationListBuilder.issuer_namec                 C   sr   t |tjs
td| jd urtdt|}|tk rtd| jd ur-|| jkr-tdt| j	|| j| j
| jS )Nr   !Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)r   r5   r   r   r,   r9   r   r   r   r   r   r   )r   rt   r!   r!   r"   rt   5  s(   
z,CertificateRevocationListBuilder.last_updatec                 C   sr   t |tjs
td| jd urtdt|}|tk rtd| jd ur-|| jk r-tdt| j	| j|| j
| jS )Nr   r   r   z8The next update date must be after the last update date.)r   r5   r   r   r,   r9   r   r   r   r   r   r   )r   rs   r!   r!   r"   rs   M  s(   
z,CertificateRevocationListBuilder.next_updater   r   c                 C   sL   t |ts	tdt|j||}t|| j t| j| j	| j
| j|g | jS )zM
        Adds an X.509 extension to the certificate revocation list.
        r   )r   r   r   r   r   r.   r   r   r   r   r   r   r   r!   r!   r"   r   e  s   

z.CertificateRevocationListBuilder.add_extensionrevoked_certificatec                 C   s2   t |ts	tdt| j| j| j| j| j|g S )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	r   ro   r   r   r   r   r   r   r   )r   r   r!   r!   r"   add_revoked_certificatex  s   

z8CertificateRevocationListBuilder.add_revoked_certificater   rB   r   c                 C   sL   t |}| jd u rtd| jd u rtd| jd u rtd|| ||S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r   r   r,   r   r   Zcreate_x509_crlr   r!   r!   r"   r     s   


z%CertificateRevocationListBuilder.signr   )r$   r%   r&   ri   r   r   r   r   ro   rj   r   r5   r   r   rt   rs   rl   r   r   r   r   rf   r   rq   r   r!   r!   r!   r"   r     sp   
 








r   c                	   @   s   e Zd Zddg fdeje dejej dejee	  fddZ
dedd fd	d
Zdejdd fddZde	dedd fddZ	ddeje defddZdS )RevokedCertificateBuilderNrI   rp   r+   c                 C   s   || _ || _|| _d S r   )r   _revocation_dater   )r   rI   rp   r+   r!   r!   r"   r     s   
z"RevokedCertificateBuilder.__init__r   r   c                 C   sX   t |ts	td| jd urtd|dkrtd| dkr$tdt|| j| jS )Nr   r   r   z$The serial number should be positiver   r   )	r   r@   r   r   r,   r   r   r   r   r   r!   r!   r"   rI     s   


z'RevokedCertificateBuilder.serial_numberr2   c                 C   sN   t |tjs
td| jd urtdt|}|tk rtdt| j|| j	S )Nr   z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
r   r5   r   r   r,   r9   r   r   r   r   r   r!   r!   r"   rp     s   

z)RevokedCertificateBuilder.revocation_dater   r   c                 C   sD   t |ts	tdt|j||}t|| j t| j| j	| j|g S )Nr   )
r   r   r   r   r   r.   r   r   r   r   r   r!   r!   r"   r     s   

z'RevokedCertificateBuilder.add_extensionr   c                 C   s6   t |}| jd u rtd| jd u rtd|| S )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r   r   r,   r   Zcreate_x509_revoked_certificate)r   r   r!   r!   r"   build  s   


zRevokedCertificateBuilder.buildr   )r$   r%   r&   ri   rj   r@   r5   r   r   r   r   rI   rp   rl   r   r   ro   r   r!   r!   r!   r"   r     s<    




r   c                   C   s   t tddd? S )N   bigr   )r@   
from_bytesosurandomr!   r!   r!   r"   random_serial_number  s   r   r   )Brd   r5   r   ri   Zcryptographyr   Zcryptography.hazmat.backendsr   Z'cryptography.hazmat.backends.interfacesr   Z"cryptography.hazmat.bindings._rustr   r   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r	   r
   r   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   r   Zcryptography.x509.extensionsr   r   r   Zcryptography.x509.namer   Zcryptography.x509.oidr   r   	Exceptionr   r   r.   r   rg   r1   r9   Enumr:   r>   ABCMetarA   registerro   rq   r   Anyr   r   rj   r   r   r   r   rk   r   r   r   r   r@   r   r!   r!   r!   r"   <module>   s   



lxU





O l 	I