a oe] @sddlmZddlZddlZddlZddlZddlmZddlm Z ddl m Z m Z ddlmZmZmZmZmZmZmZmZddlmZmZmZddlmZmZmZmZdd l m!Z!m"Z"dd l#m$Z$ed d d Z%ej&e j'e j(e j)e j*e j+e j,e j-e j.fZ/Gd dde0Z1ddddddZ2ddddddZ3dddddZ4GdddZ5Gd d!d!Z6Gd"d#d#ej7Z8Gd$d%d%e0Z9Gd&d'd'ej:d(Z;e;Gd-d.d.ej:d(Z?e?d?ZEdTd1d2d.d3d@dAZFdUd1d2d.d3dBdCZGGdDdEdEZHGdFdGdGZIGdHdIdIZJGdJdKdKZKdLdMdNdOZLdS)V) annotationsN)utils)x509)hashes serialization)dsaeced448ed25519paddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificateIssuerPublicKeyTypesCertificatePublicKeyTypes) Extension Extensions ExtensionType_make_sequence_methods)Name _ASN1Type)ObjectIdentifierics&eZdZddddfdd ZZS)AttributeNotFoundstrrNone)msgoidreturncst|||_dSN)super__init__r)selfrr __class__7C:\Program Files\Certbot\pkgs\cryptography\x509\base.pyr"8s zAttributeNotFound.__init____name__ __module__ __qualname__r" __classcell__r&r&r$r'r7srzExtension[ExtensionType]%typing.List[Extension[ExtensionType]]r) extension extensionsrcCs"|D]}|j|jkrtdqdS)Nz$This extension has already been set.)r ValueError)r.r/er&r&r'_reject_duplicate_extension=s r2rHtyping.List[typing.Tuple[ObjectIdentifier, bytes, typing.Optional[int]]])r attributesrcCs$|D]\}}}||krtdqdS)Nz$This attribute has already been set.)r0)rr4Zattr_oid_r&r&r'_reject_duplicate_attributeGsr6datetime.datetimetimercCs:|jdur2|}|r|nt}|jdd|S|SdS)zNormalizes a datetime to a naive datetime in UTC. time -- datetime to normalize. Assumed to be in UTC if not timezone aware. N)tzinfo)r:Z utcoffsetdatetimeZ timedeltareplace)r9offsetr&r&r'_convert_to_naive_utc_timeSs  r>c@sxeZdZejjfdddddddZeddd d Zeddd d Zd dddZ dddddZ ddddZ dS) Attributerbytesintr)rvalue_typercCs||_||_||_dSr )_oid_valuerC)r#rrBrCr&r&r'r"bszAttribute.__init__rcCs|jSr )rDr#r&r&r'rlsz Attribute.oidcCs|jSr )rErGr&r&r'rBpszAttribute.valuercCsd|jd|jdS)Nz)rrBrGr&r&r'__repr__tszAttribute.__repr__objectboolotherrcCs2t|tstS|j|jko0|j|jko0|j|jkSr ) isinstancer?NotImplementedrrBrCr#rMr&r&r'__eq__ws    zAttribute.__eq__cCst|j|j|jfSr )hashrrBrCrGr&r&r'__hash__szAttribute.__hash__N) r)r*r+rZ UTF8StringrBr"propertyrrIrQrSr&r&r&r'r?as  r?c@sHeZdZdddddZed\ZZZddd d Zd d d ddZ dS) Attributesztyping.Iterable[Attribute]r)r4rcCst||_dSr )list _attributes)r#r4r&r&r'r"szAttributes.__init__rWrrFcCsd|jdS)Nz Not after time (represented as UTC datetime) Nr&rGr&r&r'not_valid_afterszCertificate.not_valid_afterrcCsdS)z1 Returns the issuer name object. Nr&rGr&r&r'issuerszCertificate.issuercCsdSz2 Returns the subject name object. Nr&rGr&r&r'subjectszCertificate.subject%typing.Optional[hashes.HashAlgorithm]cCsdSzt Returns a HashAlgorithm corresponding to the type of the digest signed in the certificate. Nr&rGr&r&r'signature_hash_algorithmsz$Certificate.signature_hash_algorithmrcCsdSzJ Returns the ObjectIdentifier of the signature algorithm. Nr&rGr&r&r'signature_algorithm_oidsz#Certificate.signature_algorithm_oidz;typing.Union[None, padding.PSS, padding.PKCS1v15, ec.ECDSA]cCsdS)z= Returns the signature algorithm parameters. Nr&rGr&r&r'signature_algorithm_parameterssz*Certificate.signature_algorithm_parametersrcCsdS)z/ Returns an Extensions object. Nr&rGr&r&r'r/szCertificate.extensionscCsdSz. Returns the signature bytes. Nr&rGr&r&r' signatureszCertificate.signaturecCsdS)zR Returns the tbsCertificate payload bytes as defined in RFC 5280. Nr&rGr&r&r'tbs_certificate_bytessz!Certificate.tbs_certificate_bytescCsdS)zh Returns the tbsCertificate payload bytes with the SCT list extension stripped. Nr&rGr&r&r'tbs_precertificate_bytes sz$Certificate.tbs_precertificate_bytesrJrKrLcCsdSz" Checks equality. Nr&rPr&r&r'rQszCertificate.__eq__cCsdSz" Computes a hash. Nr&rGr&r&r'rSszCertificate.__hash__serialization.EncodingencodingrcCsdS)zB Serializes the certificate to PEM or DER format. Nr&r#rr&r&r' public_bytesszCertificate.public_bytesr)rprcCsdS)z This method verifies that certificate issuer name matches the issuer subject name and that the certificate is signed by the issuer's private key. No other validation is performed. Nr&)r#rpr&r&r'verify_directly_issued_by$sz%Certificate.verify_directly_issued_byN)r)r*r+abcabstractmethodrirTrjrkrmrnrorprrrurwrxr/rzr{r|rQrSrrr&r&r&r'rcsfrc) metaclassc@sTeZdZeejddddZeejddddZeejddd d Zd S) RevokedCertificaterArFcCsdS)zG Returns the serial number of the revoked certificate. Nr&rGr&r&r'rj2sz RevokedCertificate.serial_numberr7cCsdS)zH Returns the date of when this certificate was revoked. Nr&rGr&r&r'revocation_date9sz"RevokedCertificate.revocation_datercCsdS)zW Returns an Extensions object containing a list of Revoked extensions. Nr&rGr&r&r'r/@szRevokedCertificate.extensionsN) r)r*r+rTrrrjrr/r&r&r&r'r1src@sTeZdZddddddZedddd Zeddd d Zeddd d ZdS)_RawRevokedCertificaterAr7rrjrr/cCs||_||_||_dSr _serial_number_revocation_date _extensionsr#rjrr/r&r&r'r"Msz_RawRevokedCertificate.__init__rFcCs|jSr )rrGr&r&r'rjWsz$_RawRevokedCertificate.serial_numbercCs|jSr )rrGr&r&r'r[sz&_RawRevokedCertificate.revocation_datecCs|jSr )rrGr&r&r'r/_sz!_RawRevokedCertificate.extensionsN)r)r*r+r"rTrjrr/r&r&r&r'rLs rc@seZdZejdddddZejddddd Zejd d d d dZeejddddZ eejddddZ eejddddZ eejddddZ eejddddZ eejddd d!Zeejddd"d#Zeejddd$d%Zejd&d'd(d)d*Zejd dd+d,Zejd d-d.d/d0Zejd1d2d.d3d0Zejd4d5d.d6d0Zejd7dd8d9Zejd:d'd;dS)?CertificateRevocationListrr@rcCsdS)z: Serializes the CRL to PEM or DER format. Nr&rr&r&r'resz&CertificateRevocationList.public_bytesrdrecCsdSrgr&rhr&r&r'riksz%CertificateRevocationList.fingerprintrAz#typing.Optional[RevokedCertificate])rjrcCsdS)zs Returns an instance of RevokedCertificate or None if the serial_number is not in the CRL. Nr&)r#rjr&r&r'(get_revoked_certificate_by_serial_numberqszBCertificateRevocationList.get_revoked_certificate_by_serial_numberrsrFcCsdSrtr&rGr&r&r'ruzsz2CertificateRevocationList.signature_hash_algorithmrcCsdSrvr&rGr&r&r'rwsz1CertificateRevocationList.signature_algorithm_oidrcCsdS)zC Returns the X509Name with the issuer of this CRL. Nr&rGr&r&r'rpsz CertificateRevocationList.issuer"typing.Optional[datetime.datetime]cCsdS)z? Returns the date of next update for this CRL. Nr&rGr&r&r' next_updatesz%CertificateRevocationList.next_updater7cCsdS)z? Returns the date of last update for this CRL. Nr&rGr&r&r' last_updatesz%CertificateRevocationList.last_updatercCsdS)zS Returns an Extensions object containing a list of CRL extensions. Nr&rGr&r&r'r/sz$CertificateRevocationList.extensionscCsdSryr&rGr&r&r'rzsz#CertificateRevocationList.signaturecCsdS)zO Returns the tbsCertList payload bytes as defined in RFC 5280. Nr&rGr&r&r'tbs_certlist_bytessz,CertificateRevocationList.tbs_certlist_bytesrJrKrLcCsdSr}r&rPr&r&r'rQsz CertificateRevocationList.__eq__cCsdS)z< Number of revoked certificates in the CRL. Nr&rGr&r&r'r[sz!CertificateRevocationList.__len__r)idxrcCsdSr r&r#rr&r&r'r]sz%CertificateRevocationList.__getitem__slicetyping.List[RevokedCertificate]cCsdSr r&rr&r&r'r]sztyping.Union[int, slice]zAtyping.Union[RevokedCertificate, typing.List[RevokedCertificate]]cCsdS)zS Returns a revoked certificate (or slice of revoked certificates). Nr&rr&r&r'r]sz#typing.Iterator[RevokedCertificate]cCsdS)z8 Iterator over the revoked certificates Nr&rGr&r&r'r\sz"CertificateRevocationList.__iter__r)rmrcCsdS)zQ Verifies signature of revocation list against given public key. Nr&)r#rmr&r&r'is_signature_validsz,CertificateRevocationList.is_signature_validN)r)r*r+rrrrirrTrurwrprrr/rzrrQr[typingoverloadr]r\rr&r&r&r'rdsXrc@s6eZdZejdddddZejdddd Zejd dd d Zeejd dddZ eejddddZ eejddddZ eejddddZ eejddddZ ejddddd Zeejddd!d"Zeejddd#d$Zeejddd%d&Zejddd'd(d)Zd*S)+CertificateSigningRequestrJrKrLcCsdSr}r&rPr&r&r'rQsz CertificateSigningRequest.__eq__rArFcCsdSr~r&rGr&r&r'rSsz"CertificateSigningRequest.__hash__rcCsdSrlr&rGr&r&r'rmsz$CertificateSigningRequest.public_keyrcCsdSrqr&rGr&r&r'rrsz!CertificateSigningRequest.subjectrscCsdSrtr&rGr&r&r'rusz2CertificateSigningRequest.signature_hash_algorithmrcCsdSrvr&rGr&r&r'rwsz1CertificateSigningRequest.signature_algorithm_oidrcCsdS)z@ Returns the extensions in the signing request. Nr&rGr&r&r'r/sz$CertificateSigningRequest.extensionsrUcCsdS)z/ Returns an Attributes object. Nr&rGr&r&r'r4sz$CertificateSigningRequest.attributesrr@rcCsdS)z; Encodes the request to PEM or DER format. Nr&rr&r&r'rsz&CertificateSigningRequest.public_bytescCsdSryr&rGr&r&r'rz"sz#CertificateSigningRequest.signaturecCsdS)zd Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC 2986. Nr&rGr&r&r'tbs_certrequest_bytes)sz/CertificateSigningRequest.tbs_certrequest_bytescCsdS)z8 Verifies signature of signing request. Nr&rGr&r&r'r1sz,CertificateSigningRequest.is_signature_validrXcCsdS)z: Get the attribute value for a given OID. Nr&)r#rr&r&r'rZ8sz/CertificateSigningRequest.get_attribute_for_oidN)r)r*r+rrrQrSrmrTrrrurwr/r4rrzrrrZr&r&r&r'rsDrr@ typing.Any)databackendrcCs t|Sr ) rust_x509load_pem_x509_certificaterrr&r&r'rDsrztyping.List[Certificate])rrcCs t|Sr )rload_pem_x509_certificates)rr&r&r'rJsrcCs t|Sr )rload_der_x509_certificaterr&r&r'rOsrcCs t|Sr )rload_pem_x509_csrrr&r&r'rVsrcCs t|Sr )rload_der_x509_csrrr&r&r'r]srcCs t|Sr )rload_pem_x509_crlrr&r&r'rdsrcCs t|Sr )rload_der_x509_crlrr&r&r'rksrc@sxeZdZdggfddddddZddd d d Zd d ddddZdddddddddZddddddddZdS) CertificateSigningRequestBuilderNtyping.Optional[Name]r-r3) subject_namer/r4cCs||_||_||_dS)zB Creates an empty X.509 certificate request (v1). N) _subject_namerrW)r#rr/r4r&r&r'r"rs z)CertificateSigningRequestBuilder.__init__rnamercCs4t|tstd|jdur$tdt||j|jS)zF Sets the certificate requestor's distinguished name. Expecting x509.Name object.N&The subject name may only be set once.)rNr TypeErrorrr0rrrWr#rr&r&r'rs   z-CertificateSigningRequestBuilder.subject_namerrKextvalcriticalrcCsDt|tstdt|j||}t||jt|j|j|g|j S)zE Adds an X.509 extension to the certificate request. "extension must be an ExtensionType) rNrrrrr2rrrrWr#rrr.r&r&r' add_extensions   z.CertificateSigningRequestBuilder.add_extension)_tagrr@ztyping.Optional[_ASN1Type])rrBrrcCs|t|tstdt|ts$td|dur>t|ts>tdt||j|durZ|j}nd}t|j |j |j|||fgS)zK Adds an X.509 attribute with an OID and associated value. zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type) rNrrr@rr6rWrBrrr)r#rrBrtagr&r&r' add_attributes   z.CertificateSigningRequestBuilder.add_attributer"typing.Optional[_AllowedHashTypes]rr private_keyrfrrcCs |jdurtdt|||S)zF Signs the request using the requestor's private key. Nz/A CertificateSigningRequest must have a subject)rr0rZcreate_x509_csrr#rrfrr&r&r'signs z%CertificateSigningRequestBuilder.sign)N)r)r*r+r"rrrrr&r&r&r'rqs $rc @seZdZUded<ddddddgfddddddddd d d Zd dd ddZd dd ddZdddddZdddddZdddddZ dddddZ d d!dd"d#d$Z d.dd%d&d'd(d)d*d+d,d-Z dS)/CertificateBuilderr-rNrz*typing.Optional[CertificatePublicKeyTypes]typing.Optional[int]rr) issuer_namerrmrjrnror/rcCs6tj|_||_||_||_||_||_||_||_ dSr ) r^r`Z_version _issuer_namer _public_keyr_not_valid_before_not_valid_afterr)r#rrrmrjrnror/r&r&r'r"s zCertificateBuilder.__init__rrcCsDt|tstd|jdur$tdt||j|j|j|j |j |j S)z3 Sets the CA's distinguished name. rN%The issuer name may only be set once.) rNrrrr0rrrrrrrrr&r&r'rs  zCertificateBuilder.issuer_namecCsDt|tstd|jdur$tdt|j||j|j|j |j |j S)z: Sets the requestor's distinguished name. rNr) rNrrrr0rrrrrrrrr&r&r'rs  zCertificateBuilder.subject_namer)keyrc Cs`t|tjtjtjtjt j t j t jfs.td|jdur@tdt|j|j||j|j|j|jS)zT Sets the requestor's public key (as found in the signing request). zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rNrZ DSAPublicKeyr Z RSAPublicKeyrZEllipticCurvePublicKeyr ZEd25519PublicKeyr ZEd448PublicKeyrZX25519PublicKeyr Z X448PublicKeyrrr0rrrrrrr)r#rr&r&r'rms2  zCertificateBuilder.public_keyrAnumberrcCsht|tstd|jdur$td|dkr4td|dkrHtdt|j|j|j ||j |j |j S)z5 Sets the certificate serial number. 'Serial number must be of integral type.N'The serial number may only be set once.rz%The serial number should be positive.3The serial number should not be more than 159 bits.) rNrArrr0 bit_lengthrrrrrrrr#rr&r&r'rj,s&   z CertificateBuilder.serial_numberr7r8cCszt|tjstd|jdur&tdt|}|tkr>td|jdurZ||jkrZtdt|j |j |j |j ||j|j S)z7 Sets the certificate activation time. Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rNr;rrr0r>_EARLIEST_UTC_TIMErrrrrrrr#r9r&r&r'rnGs,  z#CertificateBuilder.not_valid_beforecCszt|tjstd|jdur&tdt|}|tkr>td|jdurZ||jkrZtdt|j |j |j |j |j||j S)z7 Sets the certificate expiration time. rNz)The not valid after may only be set once.zrrrrrrrrrr&r&r'rods2  z"CertificateBuilder.not_valid_afterrrKrc CsTt|tstdt|j||}t||jt|j|j |j |j |j |j |j|gS)z= Adds an X.509 extension to the certificate. r)rNrrrrr2rrrrrrrrrr&r&r'rs   z CertificateBuilder.add_extension) rsa_paddingrrrztd|jdurZ||jkrZtdt|j ||j|j |j S)Nr!Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) rNr;rrr0r>rrrrrr)r#rr&r&r'rs(  z,CertificateRevocationListBuilder.last_update)rrcCsrt|tjstd|jdur&tdt|}|tkr>td|jdurZ||jkrZtdt|j |j||j |j S)Nrrrz8The next update date must be after the last update date.) rNr;rrr0r>rrrrrr)r#rr&r&r'rs(  z,CertificateRevocationListBuilder.next_updaterrKrcCsLt|tstdt|j||}t||jt|j|j |j |j|g|j S)zM Adds an X.509 extension to the certificate revocation list. r) rNrrrrr2rrrrrrrr&r&r'rs   z.CertificateRevocationListBuilder.add_extensionr)revoked_certificatercCs2t|tstdt|j|j|j|j|j|gS)z8 Adds a revoked certificate to the CRL. z)Must be an instance of RevokedCertificate) rNrrrrrrrr)r#rr&r&r'add_revoked_certificate(s  z8CertificateRevocationListBuilder.add_revoked_certificaterrrrrcCsD|jdurtd|jdur$td|jdur6tdt|||S)NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)rr0rrrZcreate_x509_crlrr&r&r'r9s   z%CertificateRevocationListBuilder.sign)N) r)r*r+rr"rrrrrrr&r&r&r'rs rc@sjeZdZddgfddddddZddd d d Zd dd ddZddddddZddddddZdS)RevokedCertificateBuilderNrrr-rcCs||_||_||_dSr rrr&r&r'r"Lsz"RevokedCertificateBuilder.__init__rArcCsXt|tstd|jdur$td|dkr4td|dkrHtdt||j|jS)Nrrrz$The serial number should be positiverr) rNrArrr0rrrrrr&r&r'rjVs    z'RevokedCertificateBuilder.serial_numberr7r8cCsNt|tjstd|jdur&tdt|}|tkr>tdt|j||j S)Nrz)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.) rNr;rrr0r>rrrrrr&r&r'rhs   z)RevokedCertificateBuilder.revocation_daterrKrcCsDt|tstdt|j||}t||jt|j|j |j|gS)Nr) rNrrrrr2rrrrrr&r&r'rxs   z'RevokedCertificateBuilder.add_extensionrr)rrcCs:|jdurtd|jdur$tdt|j|jt|jS)Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)rr0rrrr)r#rr&r&r'builds  zRevokedCertificateBuilder.build)N)r)r*r+r"rjrrrr&r&r&r'rKs rrArFcCsttddd?S)NZbigr)rA from_bytesosurandomr&r&r&r'random_serial_numbersr)N)N)N)N)N)N)MZ __future__rrr;rrZ cryptographyrZ"cryptography.hazmat.bindings._rustrrZcryptography.hazmat.primitivesrrZ)cryptography.hazmat.primitives.asymmetricrrr r r r r rZ/cryptography.hazmat.primitives.asymmetric.typesrrrZcryptography.x509.extensionsrrrrZcryptography.x509.namerrZcryptography.x509.oidrrUnionZSHA224ZSHA256ZSHA384ZSHA512ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512Z_AllowedHashTypes Exceptionrr2r6r>r?rUEnumr^raABCMetarcregisterrrrrrrrrrrrrrrrrr&r&r&r's|   (     $  | ] \xI