
UXDE                @   sD	  d  Z  d d l m Z m Z m Z m Z d d l m Z d d l Z d d l	 Z	 d d l
 Z
 d d l Z d d l Z d d l Z d d l m Z d d l m Z m Z d d l m Z d d	 l m Z m Z m Z d d
 l m Z m Z d d l m Z m Z m Z m  Z  m! Z! m" Z" m# Z# m$ Z$ m% Z% m& Z& m' Z' m( Z( m) Z) m* Z* m+ Z+ m, Z, m- Z- m. Z. m/ Z/ m0 Z0 m1 Z1 m2 Z2 m3 Z3 m4 Z4 m5 Z5 m6 Z6 m7 Z7 d d l8 m9 Z9 d d l: m; Z; m< Z< m= Z= m> Z> Gd d   d e%  Z? Gd d   d e%  Z@ Gd d   d e%  ZA Gd d   d e+  ZB Gd d   d e.  ZC Gd d   d e/  ZD Gd d   d e  ZE Gd d   d e.  ZF Gd d   d e!  ZG Gd  d!   d! e)  ZH Gd" d#   d# e.  ZI Gd$ d%   d% e1  ZJ Gd& d'   d' e/  ZK Gd( d)   d) e!  ZL Gd* d+   d+ e.  ZM Gd, d-   d- e!  ZN Gd. d/   d/ e!  ZO Gd0 d1   d1 e!  ZP Gd2 d3   d3 e0  ZQ Gd4 d5   d5 e0  ZR Gd6 d7   d7 e/  ZS Gd8 d9   d9 e/  ZT Gd: d;   d; e.  ZU Gd< d=   d= e.  ZV Gd> d?   d? e/  ZW Gd@ dA   dA e.  ZX GdB dC   dC e/  ZY GdD dE   dE e!  ZZ GdF dG   dG e!  Z[ GdH dI   dI e0  Z\ GdJ dK   dK e/  Z] GdL dM   dM e0  Z^ GdN dO   dO e.  Z_ GdP dQ   dQ e1  Z` GdR dS   dS e.  Za GdT dU   dU e!  Zb GdV dW   dW e&  Zc GdX dY   dY e&  Zd GdZ d[   d[ e.  Ze Gd\ d]   d] e/  Zf Gd^ d_   d_ e.  Zg Gd` da   da e.  Zh Gdb dc   dc e!  Zi Gdd de   de e/  Zj Gdf dg   dg e!  Zk Gdh di   di e.  Zl Gdj dk   dk e.  Zm Gdl dm   dm e.  Zn Gdn do   do e!  Zo Gdp dq   dq e  Zp Gdr ds   ds e.  Zq Gdt du   du e/  Zr Gdv dw   dw e.  Zs Gdx dy   dy e.  Zt Gdz d{   d{ e/  Zu Gd| d}   d} e!  Zv Gd~ d   d e/  Zw Gd d   d e.  Zx Gd d   d e.  Zy Gd d   d e)  Zz Gd d   d e.  Z{ Gd d   d e/  Z| Gd d   d e)  Z} Gd d   d e.  Z~ Gd d   d e/  Z Gd d   d e.  Z Gd d   d e/  Z Gd d   d e.  Z Gd d   d e)  Z Gd d   d e/  Z Gd d   d e)  Z Gd d   d e.  Z Gd d   d e/  Z Gd d   d e/  Z Gd d   d e/  Z Gd d   d e.  Z Gd d   d e  Z Gd d   d e)  Z Gd d   d e.  Z Gd d   d e/  Z Gd d   d e&  Z Gd d   d e.  Z Gd d   d e.  Z Gd d   d e/  Z Gd d   d e/  Z Gd d   d e.  Z Gd d   d e"  Z d S)z
ASN.1 type classes for X.509 certificates. Exports the following items:

 - Attributes()
 - Certificate()
 - Extensions()
 - GeneralName()
 - GeneralNames()
 - Name()

Other type classes are defined that help compose the types listed above.
    )unicode_literalsdivisionabsolute_importprint_function)idnaN   )unwrap)
iri_to_uri
uri_to_iri)OrderedDict)	type_namestr_clsbytes_to_list)AlgorithmIdentifierSignedDigestAlgorithm)Any	BitString	BMPStringBooleanChoiceConcatGeneralizedTimeGeneralString	IA5StringIntegerNullNumericStringObjectIdentifierOctetBitStringOctetStringParsableOctetStringPrintableStringSequence
SequenceOfSetSetOfTeletexStringUniversalStringUTCTime
UTF8StringVisibleStringVOID)PublicKeyInfo)int_to_bytesint_from_bytes	inet_ntop	inet_ptonc               @   s@   e  Z d  Z d Z d Z d d   Z d d   Z d d   Z d	 S)
DNSNamer      c             C   s   |  | k S)N )selfotherr3   r3   1/usr/lib/python3/dist-packages/asn1crypto/x509.py__ne__J   s    zDNSName.__ne__c             C   s5   t  | t  s d S|  j   j   | j   j   k S)z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2

        :param other:
            Another DNSName object

        :return:
            A boolean
        F)
isinstancer1   __unicode__lower)r4   r5   r3   r3   r6   __eq__M   s    zDNSName.__eq__c             C   s   t  | t  s3 t t d t |   t |     | j d  re d | d d  j |  j  } n | j |  j  } | |  _ | |  _	 d |  _
 |  j d k r d |  _ d S)zd
        Sets the value of the DNS name

        :param value:
            A unicode string
        zK
                %s value must be a unicode string, not %s
                .   .r   N    )r8   r   	TypeErrorr   r   
startswithencode	_encoding_unicodecontents_header_trailer)r4   valueencoded_valuer3   r3   r6   set]   s    	#			zDNSName.setN)__name__
__module____qualname__rB   Z_bad_tagr7   r;   rI   r3   r3   r3   r6   r1   E   s
   r1   c               @   s@   e  Z d  Z d d   Z d d   Z d d   Z d d   Z d	 S)
URIc             C   sp   t  | t  s3 t t d t |   t |     | |  _ t |  |  _ d |  _ |  j	 d k rl d |  _	 d S)zb
        Sets the value of the string

        :param value:
            A unicode string
        zK
                %s value must be a unicode string, not %s
                Nr>   )
r8   r   r?   r   r   rC   r	   rD   rE   rF   )r4   rG   r3   r3   r6   rI   |   s    			zURI.setc             C   s   |  | k S)Nr3   )r4   r5   r3   r3   r6   r7      s    z
URI.__ne__c             C   s/   t  | t  s d St |  j  t | j  k S)z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4

        :param other:
            Another URI object

        :return:
            A boolean
        F)r8   rM   r	   native)r4   r5   r3   r3   r6   r;      s    z
URI.__eq__c             C   s>   |  j  d k r d S|  j d k r7 t |  j    |  _ |  j S)z7
        :return:
            A unicode string
        N )rD   rC   r
   _merge_chunks)r4   r3   r3   r6   r9      s
    zURI.__unicode__N)rJ   rK   rL   rI   r7   r;   r9   r3   r3   r3   r6   rM   z   s   rM   c               @   ss   e  Z d  Z d Z d Z e d d    Z e j d d    Z d d   Z d d	   Z	 d
 d   Z
 d d   Z d S)EmailAddressNFc             C   s   |  j  S)z`
        :return:
            A byte string of the DER-encoded contents of the sequence
        )	_contents)r4   r3   r3   r6   rD      s    zEmailAddress.contentsc             C   s   d |  _  | |  _ d S)ze
        :param value:
            A byte string of the DER-encoded contents of the sequence
        FN)_normalizedrR   )r4   rG   r3   r3   r6   rD      s    	c             C   s   t  | t  s3 t t d t |   t |     | j d  d
 k r | j d d  \ } } | j d  d | j d  } n | j d  } d |  _ | |  _	 | |  _
 d |  _ |  j d	 k r d	 |  _ d S)zb
        Sets the value of the string

        :param value:
            A unicode string
        zK
                %s value must be a unicode string, not %s
                @r   ascii   @r   TNr>   )r8   r   r?   r   r   findrsplitrA   rS   rC   rD   rE   rF   )r4   rG   mailboxhostnamerH   r3   r3   r6   rI      s    	#				zEmailAddress.setc             C   s   |  j  d k r |  j   } | j d  d k rE | j d  |  _  n; | j d d  \ } } | j d  d | j d  |  _  |  j  S)z7
        :return:
            A unicode string
        NrV   r   rU   rT   r   rW   )rC   rP   rX   decoderY   )r4   rD   rZ   r[   r3   r3   r6   r9      s    #zEmailAddress.__unicode__c             C   s   |  | k S)Nr3   )r4   r5   r3   r3   r6   r7      s    zEmailAddress.__ne__c             C   s   t  | t  s d S|  j s, |  j |  j  | j sE | j | j  |  j j d  d k su | j j d  d k r |  j | j k S| j j d d  \ } } |  j j d d  \ } } | | k r d S| j   | j   k r d Sd S)z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5

        :param other:
            Another EmailAddress object

        :return:
            A boolean
        FrV   r   TrW   rW   )	r8   rQ   rS   rI   rN   rR   rX   rY   r:   )r4   r5   Zother_mailboxZother_hostnamerZ   r[   r3   r3   r6   r;      s    		0zEmailAddress.__eq__)rJ   rK   rL   rR   rS   propertyrD   setterrI   r9   r7   r;   r3   r3   r3   r6   rQ      s   	
rQ   c               @   sX   e  Z d  Z d d d d  Z d d   Z e d d    Z d d	   Z d
 d   Z d S)	IPAddressNc             C   s   t  t d    d S)z?
        This method is not applicable to IP addresses
        z=
            IP address values can not be parsed
            N)
ValueErrorr   )r4   specZspec_paramsr3   r3   r6   parse   s    zIPAddress.parsec       
      C   s  t  | t  s3 t t d t |   t |     | } | j d  d k } d } | r | j d d  } | d } t | d  } | d k  r t t d t |      | j d  d k r t	 j
 } | d k r t t d t |      d } n6 t	 j } | d	 k r+t t d
 t |      d	 } d } | rd | }	 |	 d | t |	  7}	 t t |	 d   } d | d t |  | } | |  _ t | |  | |  _ |  j |  _ d |  _ |  j d k rd |  _ d S)z
        Sets the value of the object

        :param value:
            A unicode string containing an IPv4 address, IPv4 address with CIDR,
            an IPv6 address or IPv6 address with CIDR
        zK
                %s value must be a unicode string, not %s
                /r   r   zT
                    %s value contains a CIDR range less than 0
                    :   z
                    %s value contains a CIDR range bigger than 128, the maximum
                    value for an IPv6 address
                        z
                    %s value contains a CIDR range bigger than 32, the maximum
                    value for an IPv4 address
                    r>   10   s       NrW   rW   )r8   r   r?   r   r   rX   splitintr`   socketAF_INET6AF_INETlenr-   _nativer0   rD   Z_bytesrE   rF   )
r4   rG   Zoriginal_valueZhas_cidrcidrpartsfamilyZ	cidr_sizeZ
cidr_bytesZ	cidr_maskr3   r3   r6   rI   +  sR    		
			
		zIPAddress.setc             C   sC  |  j  d k r d S|  j d k r<|  j   } t |  } d } | t d d g  k r t t j | d d   } | d k r t | d d   } nV | t d d g  k r t t j	 | d d   } | d k r t | d d   } | d k	 r3d j
 |  } t | j d   } | d	 t |  } | |  _ |  j S)
z
        The a native Python datatype representation of this value

        :return:
            A unicode string or None
        Nrf      r   rj      z{0:b}rh   rc   )rD   rq   	__bytes__rp   rI   r/   rm   rn   r.   ro   formatrstripr   )r4   Zbyte_stringZbyte_lenZcidr_intrG   Z	cidr_bitsrr   r3   r3   r6   rN   r  s(    		zIPAddress.nativec             C   s   |  | k S)Nr3   )r4   r5   r3   r3   r6   r7     s    zIPAddress.__ne__c             C   s)   t  | t  s d S|  j   | j   k S)zl
        :param other:
            Another IPAddress object

        :return:
            A boolean
        F)r8   r_   rw   )r4   r5   r3   r3   r6   r;     s    	zIPAddress.__eq__)	rJ   rK   rL   rb   rI   r]   rN   r7   r;   r3   r3   r3   r6   r_     s
   Gr_   c               @   s1   e  Z d  Z d e f d e d e i f g Z d S)	Attributetypevaluesra   N)rJ   rK   rL   r   r%   r   _fieldsr3   r3   r3   r6   rz     s   	rz   c               @   s   e  Z d  Z e Z d S)
AttributesN)rJ   rK   rL   rz   _child_specr3   r3   r3   r6   r~     s   r~   c               @   sL   e  Z d  Z d d d d d d d d d	 d
 d d d d d d d d i	 Z d S)KeyUsager   Zdigital_signaturer   Znon_repudiationri   Zkey_encipherment   Zdata_enciphermentrv   Zkey_agreement   Zkey_cert_sign   Zcrl_sign   Zencipher_onlyrj   Zdecipher_onlyN)rJ   rK   rL   _mapr3   r3   r3   r6   r     s   r   c            	   @   sR   e  Z d  Z d e d d d d d d i f d e d d d d	 d d i f g Z d
 S)PrivateKeyUsagePeriod
not_beforetag_typeimplicittagr   optionalT	not_afterr   N)rJ   rK   rL   r   r}   r3   r3   r3   r6   r     s   r   c               @   sL   e  Z d  Z d e f d e f d e f d e f d e f d e f g Z	 d S)DirectoryStringteletex_stringprintable_stringZuniversal_stringutf8_string
bmp_string
ia5_stringN)
rJ   rK   rL   r&   r!   r'   r)   r   r   _alternativesr3   r3   r3   r6   r     s   					r   c            6   @   s0  e  Z d  Z d d d d d d d d d	 d
 d d d d d d d d d d d d d d d d d d d d d d  d! d" d# d$ d% d& d' d( d) d* d+ d, d- d. d/ d0 d1 d2 d3 d4 d5 d6 i Z d2 d0 d. d d d d d d
 d d d d d d  d" d d d d( d& d d, d4 d6 d* g Z e d7 d8    Z e d9 d:    Z d; S)<NameTypez2.5.4.3common_namez2.5.4.4surnamez2.5.4.5serial_numberz2.5.4.6country_namez2.5.4.7locality_namez2.5.4.8state_or_province_namez2.5.4.9street_addressz2.5.4.10organization_namez2.5.4.11organizational_unit_namez2.5.4.12titlez2.5.4.15business_categoryz2.5.4.17postal_codez2.5.4.20telephone_numberz2.5.4.41namez2.5.4.42
given_namez2.5.4.43initialsz2.5.4.44generation_qualifierz2.5.4.45unique_identifierz2.5.4.46dn_qualifierz2.5.4.65	pseudonymz2.5.4.97organization_identifierz1.2.840.113549.1.9.1email_addressz1.3.6.1.4.1.311.60.2.1.1incorporation_localityz1.3.6.1.4.1.311.60.2.1.2incorporation_state_or_provincez1.3.6.1.4.1.311.60.2.1.3incorporation_countryz0.9.2342.19200300.100.1.25domain_componentz0.2.262.1.10.7.20name_distinguisherc             C   sL   |  j  |  } | |  j k r3 |  j j |  } n t |  j  } | | f S)z
        Returns an ordering value for a particular attribute key.

        Unrecognized attributes and OIDs will be sorted lexically at the end.

        :return:
            An orderable value.

        )mappreferred_orderindexrp   )clsZ	attr_nameZordinalr3   r3   r6   preferred_ordinal  s
    zNameType.preferred_ordinalc          6   C   s   d d d d d d d d d	 d
 d d d d d d d d d d d d d d d d d d d d d d  d! d" d# d$ d% d& d' d( d) d* d+ d, d- d. d/ d0 d1 d2 d3 d4 d5 d6 i j  |  j |  j  S)7zZ
        :return:
            A human-friendly unicode string to display to users
        r   zCommon Namer   ZSurnamer   zSerial Numberr   Countryr   ZLocalityr   zState/Provincer   zStreet Addressr   ZOrganizationr   zOrganizational Unitr   ZTitler   zBusiness Categoryr   zPostal Coder   zTelephone Numberr   Namer   z
Given Namer   ZInitialsr   zGeneration Qualifierr   zUnique Identifierr   zDN Qualifierr   Z	Pseudonymr   zEmail Addressr   zIncorporation Localityr   zIncorporation State/Provincer   zIncorporation Countryr   zDomain Componentr   zName Distinguisherr   zOrganization Identifier)getrN   )r4   r3   r3   r6   human_friendly&  s8    zNameType.human_friendlyN)	rJ   rK   rL   r   r   classmethodr   r]   r   r3   r3   r3   r6   r     sn   	r   c            6   @   s  e  Z d  Z d e f d e f g Z d' Z d e d e d e d e d e d e d	 e d
 e d e d e d e d e d e d e d e d e d e d e	 d e d e d e
 d e d e d e d e d e d e i Z d Z e d d     Z d! d"   Z d# d$   Z d% d&   Z d S)(NameTypeAndValuer{   rG   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   Nc             C   s/   |  j  d k r( |  j |  d j  |  _  |  j  S)z
        Returns the value after being processed by the internationalized string
        preparation as specified by RFC 5280

        :return:
            A unicode string
        NrG   )_prepped_ldap_string_preprN   )r4   r3   r3   r6   prepped_valueu  s    
zNameTypeAndValue.prepped_valuec             C   s   |  | k S)Nr3   )r4   r5   r3   r3   r6   r7     s    zNameTypeAndValue.__ne__c             C   sA   t  | t  s d S| d j |  d j k r1 d S| j |  j k S)z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another NameTypeAndValue object

        :return:
            A boolean
        Fr{   )r8   r   rN   r   )r4   r5   r3   r3   r6   r;     s
    zNameTypeAndValue.__eq__c             C   sf  t  j d d |  } t  j d d |  } t j d k rQ t  j d d |  } n t  j d d |  } t  j d d |  } | j d	 d  } t  j d
 d |  } d j t t j |   } t	 j
 d |  } x | D] } t j |  r t t d    t j |  rt t d    t j |  r?t t d    t j |  r`t t d    t j |  rt t d    | d k r t t d    q Wd } d } x; | D]3 } t j |  rd } qt j |  rd } qW| r?t j | d  } t j | d  } | s-| s-| r?t t d    d t  j d d |  j   d } | S)a"  
        Implements the internationalized string preparation algorithm from
        RFC 4518. https://tools.ietf.org/html/rfc4518#section-2

        :param string:
            A unicode string to prepare

        :return:
            A prepared unicode string, ready for comparison
        u   [­᠆͏᠋-᠍️-＀￼]+rO   u	   [	
] i  u   [-]|[-]|󠀁u   [𝅳-𝅺󠀠-󠁿󠀁]u?   [ ----۝܏᠎‌-‏‪-‮⁠-⁣⁪-⁯﻿￹-￻]+u   ​u   [   -  -   　]ZNFKCzc
                    X.509 Name objects may not contain unassigned code points
                    z
                    X.509 Name objects may not contain change display or
                    zzzzdeprecated characters
                    zc
                    X.509 Name objects may not contain private use characters
                    zf
                    X.509 Name objects may not contain non-character code points
                    zb
                    X.509 Name objects may not contain surrogate code points
                    u   �zf
                    X.509 Name objects may not contain the replacement character
                    FTr   r   z{
                    X.509 Name object contains a malformed bidirectional
                    sequence
                    z +z  rW   )resubsys
maxunicodereplacejoinr   
stringprepZmap_table_b2unicodedataZ	normalizeZin_table_a1r`   r   Zin_table_c8Zin_table_c3Zin_table_c4Zin_table_c5Zin_table_d1Zin_table_d2strip)r4   stringcharZhas_r_and_al_catZ	has_l_catZfirst_is_r_and_alZlast_is_r_and_alr3   r3   r6   r     s^    		
#z"NameTypeAndValue._ldap_string_prep)ztypezvalue)rJ   rK   rL   r   r   r}   	_oid_pairr   r!   r   rQ   r1   
_oid_specsr   r]   r   r7   r;   r   r3   r3   r3   r6   r   L  sF   	r   c               @   sX   e  Z d  Z e Z e d d    Z d d   Z d d   Z d d   Z	 d	 d
   Z
 d S)RelativeDistinguishedNamec             C   sZ   g  } |  j  |   } x5 t | j    D]! } | j d | | | f  q( Wd j |  S)zb
        :return:
            A unicode string that can be used as a dict key or in a set
        z%s: %s)_get_valuessortedkeysappendr   )r4   outputr|   keyr3   r3   r6   hashable	  s
    z"RelativeDistinguishedName.hashablec             C   s   |  | k S)Nr3   )r4   r5   r3   r3   r6   r7     s    z RelativeDistinguishedName.__ne__c             C   s   t  | t  s d St |   t |  k r/ d S|  j |   } |  j |  } | | k r] d S|  j |   } |  j |  } x& | D] } | | | | k r d Sq Wd S)z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RelativeDistinguishedName object

        :return:
            A boolean
        FT)r8   r   rp   
_get_typesr   )r4   r5   Z
self_typesZother_typesZself_valuesZother_valuesZ
type_name_r3   r3   r6   r;     s    z RelativeDistinguishedName.__eq__c             C   s   t  d d   | D  S)z
        Returns a set of types contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A set object with unicode strings of NameTypeAndValue type field
            values
        c             S   s   g  |  ] } | d  j   q S)r{   )rN   ).0ntvr3   r3   r6   
<listcomp>H  s   	 z8RelativeDistinguishedName._get_types.<locals>.<listcomp>)rI   )r4   rdnr3   r3   r6   r   <  s    z$RelativeDistinguishedName._get_typesc                s!   i      f d d   | D   S)a$  
        Returns a dict of prepped values contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A dict object with unicode strings of NameTypeAndValue value field
            values that have been prepped for comparison
        c                s2   g  |  ]( }   j  | d  j | j f g   q S)r{   )updaterN   r   )r   r   )r   r3   r6   r   W  s   	 z9RelativeDistinguishedName._get_values.<locals>.<listcomp>r3   )r4   r   r3   )r   r6   r   J  s    z%RelativeDistinguishedName._get_valuesN)rJ   rK   rL   r   r   r]   r   r7   r;   r   r   r3   r3   r3   r6   r     s    r   c               @   s@   e  Z d  Z e Z e d d    Z d d   Z d d   Z d S)RDNSequencec             C   s   d j  d d   |  D  S)zb
        :return:
            A unicode string that can be used as a dict key or in a set
        c             s   s   |  ] } | j  Vq d  S)N)r   )r   r   r3   r3   r6   	<genexpr>h  s    z'RDNSequence.hashable.<locals>.<genexpr>)r   )r4   r3   r3   r6   r   ^  s    
zRDNSequence.hashablec             C   s   |  | k S)Nr3   )r4   r5   r3   r3   r6   r7   j  s    zRDNSequence.__ne__c             C   sd   t  | t  s d St |   t |  k r/ d Sx. t |   D]  \ } } | | | k r< d Sq< Wd S)z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RDNSequence object

        :return:
            A boolean
        FT)r8   r   rp   	enumerate)r4   r5   r   Zself_rdnr3   r3   r6   r;   m  s    zRDNSequence.__eq__N)	rJ   rK   rL   r   r   r]   r   r7   r;   r3   r3   r3   r6   r   [  s   r   c               @   s   e  Z d  Z d e f g Z d Z d Z d Z e d d d   Z	 e
 d d    Z d d	   Z d
 d   Z d d   Z e
 d d    Z e
 d d    Z d d   Z e
 d d    Z e
 d d    Z d S)r   rO   NFc       	      C   sB  g  } | s d } t  } n d } t } t t | j   d d d    } x | j   D] \ } } t j |  } | d k r t |  } no | d k r t |  } nT | t	 d d	 d
 g  k r t
 d d d t |   } n t
 d | d | |   } | j t t d | d | i  g   qX W|  d d d t |   S)aS  
        Creates a Name object from a dict of unicode string keys and values.
        The keys should be from NameType._map, or a dotted-integer OID unicode
        string.

        :param name_dict:
            A dict of name information, e.g. {"common_name": "Will Bond",
            "country_name": "US", "organization": "Codex Non Sufficit LC"}

        :param use_printable:
            A bool - if PrintableString should be used for encoding instead of
            UTF8String. This is for backwards compatiblity with old software.

        :return:
            An x509.Name object
        r   r   r   c             S   s   t  j |  d  S)Nr   )r   r   )itemr3   r3   r6   <lambda>  s    zName.build.<locals>.<lambda>r   r   r   r   r   r   rG   r{   rO   )r)   r!   r   r   itemsr   r   rQ   r1   rI   r   r   r   r   r   )	r   Z	name_dictZuse_printableZrdnsZencoding_nameZencoding_classattribute_nameZattribute_valuerG   r3   r3   r6   build  s8    		z
Name.buildc             C   s
   |  j  j S)zb
        :return:
            A unicode string that can be used as a dict key or in a set
        )chosenr   )r4   r3   r3   r6   r     s    zName.hashablec             C   s   t  |  j  S)N)rp   r   )r4   r3   r3   r6   __len__  s    zName.__len__c             C   s   |  | k S)Nr3   )r4   r5   r3   r3   r6   r7     s    zName.__ne__c             C   s#   t  | t  s d S|  j | j k S)z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another Name object

        :return:
            A boolean
        F)r8   r   r   )r4   r5   r3   r3   r6   r;     s    zName.__eq__c             C   s   |  j  d  k r t   |  _  x |  j j D] } x| | D]t } | d } | |  j  k r |  j  | } t | t  s | g } |  j  | <| j | d  q5 | d |  j  | <q5 Wq( W|  j  S)Nr{   rG   )rq   r   r   rN   r8   listr   )r4   r   type_val
field_nameZexistingr3   r3   r6   rN     s    
zName.nativec             C   su  |  j  d k rnt   } d } xx |  j D]m } xd | D]\ } | d j } | } | | k r | | g | | <| | j | d  q5 | d | | <q5 Wq( Wg  } | j   } | d k r t t |   } x> | D]6 } | | }	 |  j |	  }
 | j d | |
 f  q Wd } x* | D]" } | j	 d  d k rd	 } PqW| sId
 n d } | j
 | d d d   |  _  |  j  S)zg
        :return:
            A human-friendly unicode string containing the parts of the name
        Nr{   rG   r   z%s: %sF,r   Tz, z; rW   rW   )_human_friendlyr   r   r   r   r   reversedr   _recursive_humanizerX   r   )r4   dataZ
last_fieldr   r   r   Zto_joinr   r   rG   Znative_valueZ	has_commaelementZ	separatorr3   r3   r6   r     s6    	
zName.human_friendlyc                s<   t  | t  r5 d j t   f d d   | D   S| j S)z
        Recursively serializes data compiled from the RDNSequence

        :param value:
            An Asn1Value object, or a list of Asn1Value objects

        :return:
            A unicode string
        z, c                s   g  |  ] }   j  |   q Sr3   )r   )r   Z	sub_value)r4   r3   r6   r   -  s   	 z,Name._recursive_humanize.<locals>.<listcomp>)r8   r   r   r   rN   )r4   rG   r3   )r4   r6   r      s     zName._recursive_humanizec             C   s4   |  j  d k r- t j |  j    j   |  _  |  j  S)zZ
        :return:
            The SHA1 hash of the DER-encoded bytes of this name
        N)_sha1hashlibsha1dumpdigest)r4   r3   r3   r6   r   1  s    z	Name.sha1c             C   s4   |  j  d k r- t j |  j    j   |  _  |  j  S)z]
        :return:
            The SHA-256 hash of the DER-encoded bytes of this name
        N)_sha256r   sha256r   r   )r4   r3   r3   r6   r   <  s    zName.sha256)rJ   rK   rL   r   r   r   r   r   r   r   r]   r   r   r7   r;   rN   r   r   r   r   r3   r3   r3   r6   r     s   <	'r   c               @   s7   e  Z d  Z d e f d e d d d d i f g Z d S)AnotherNameZtype_idrG   r   explicitr   r   N)rJ   rK   rL   r   r   r}   r3   r3   r3   r6   r   H  s   	r   c               @   s4   e  Z d  Z d Z d Z d e f d e f g Z d S)CountryNamer   x121_dcc_codeiso_3166_alpha2_codeN)rJ   rK   rL   class_r   r   r!   r   r3   r3   r3   r6   r   O  s   	r   c               @   s4   e  Z d  Z d Z d Z d e f d e f g Z d S)AdministrationDomainNamer   ri   numeric	printableN)rJ   rK   rL   r   r   r   r!   r   r3   r3   r3   r6   r   Y  s   	r   c               @   s(   e  Z d  Z d e f d e f g Z d S)PrivateDomainNamer   r   N)rJ   rK   rL   r   r!   r   r3   r3   r3   r6   r   c  s   	r   c               @   s   e  Z d  Z d e d d d d i f d e d d d d d d	 i f d
 e d d d d d d	 i f d e d d d d d d	 i f g Z d S)PersonalNamer   r   r   r   r   r   r   r   Tr   ri   r   r   N)rJ   rK   rL   r!   r}   r3   r3   r3   r6   r   j  s   r   c               @   s   e  Z d  Z d e d d d d i f d e d d d d d d	 i f d
 e d d d d d d	 i f d e d d d d d d	 i f g Z d S)TeletexPersonalNamer   r   r   r   r   r   r   r   Tr   ri   r   r   N)rJ   rK   rL   r&   r}   r3   r3   r3   r6   r  s  s   r  c               @   s   e  Z d  Z e Z d S)OrganizationalUnitNamesN)rJ   rK   rL   r!   r   r3   r3   r3   r6   r  |  s   r  c               @   s   e  Z d  Z e Z d S)TeletexOrganizationalUnitNamesN)rJ   rK   rL   r&   r   r3   r3   r3   r6   r    s   r  c               @   s  e  Z d  Z d e d d i f d e d d i f d e d d d d	 d d i f d
 e d d d d d d i f d e d d d d d d i f d e d d d d d d i f d e d d d d d d i f d e d d d d d d i f d e	 d d d d d d i f g	 Z
 d S)BuiltInStandardAttributesr   r   TZadministration_domain_nameZnetwork_addressr   r   r   r   Zterminal_identifierr   Zprivate_domain_namer   ri   r   r   Znumeric_user_identifierrv   Zpersonal_namer   Zorganizational_unit_namesr   N)rJ   rK   rL   r   r   r   r!   r   r   r  r}   r3   r3   r3   r6   r    s   r  c               @   s(   e  Z d  Z d e f d e f g Z d S)BuiltInDomainDefinedAttributer{   rG   N)rJ   rK   rL   r!   r}   r3   r3   r3   r6   r    s   	r  c               @   s   e  Z d  Z e Z d S)BuiltInDomainDefinedAttributesN)rJ   rK   rL   r  r   r3   r3   r3   r6   r    s   r  c               @   s(   e  Z d  Z d e f d e f g Z d S)TeletexDomainDefinedAttributer{   rG   N)rJ   rK   rL   r&   r}   r3   r3   r3   r6   r    s   	r  c               @   s   e  Z d  Z e Z d S)TeletexDomainDefinedAttributesN)rJ   rK   rL   r  r   r3   r3   r3   r6   r    s   r  c               @   s(   e  Z d  Z d e f d e f g Z d S)PhysicalDeliveryCountryNamer   r   N)rJ   rK   rL   r   r!   r   r3   r3   r3   r6   r	    s   	r	  c               @   s(   e  Z d  Z d e f d e f g Z d S)
PostalCodeZnumeric_codeZprintable_codeN)rJ   rK   rL   r   r!   r   r3   r3   r3   r6   r
    s   	r
  c               @   s:   e  Z d  Z d e d d i f d e d d i f g Z d S)PDSParameterr   r   Tr   N)rJ   rK   rL   r!   r&   r}   r3   r3   r3   r6   r    s   r  c               @   s   e  Z d  Z e Z d S)PrintableAddressN)rJ   rK   rL   r!   r   r3   r3   r3   r6   r    s   r  c               @   s:   e  Z d  Z d e d d i f d e d d i f g Z d S)UnformattedPostalAddressZprintable_addressr   Tr   N)rJ   rK   rL   r  r&   r}   r3   r3   r3   r6   r    s   r  c            	   @   sL   e  Z d  Z d e d d d d i f d e d d d d d d	 i f g Z d
 S)E1634AddressZnumberr   r   r   r   Zsub_addressr   r   TN)rJ   rK   rL   r   r}   r3   r3   r3   r6   r    s   r  c               @   s   e  Z d  Z e Z d S)
NAddressesN)rJ   rK   rL   r   r   r3   r3   r3   r6   r    s   r  c            
   @   s   e  Z d  Z d e d d d d d d i f d e d d d d	 d d i f d
 e d d d d d d i f d e d d d d i f g Z d S)PresentationAddressZ
p_selectorr   r   r   r   r   TZ
s_selectorr   Z
t_selectorri   Zn_addressesr   N)rJ   rK   rL   r   r  r}   r3   r3   r3   r6   r    s   r  c               @   s7   e  Z d  Z d e f d e d d d d i f g Z d S)ExtendedNetworkAddressZe163_4_addressZpsap_addressr   r   r   r   N)rJ   rK   rL   r  r  r   r3   r3   r3   r6   r    s   	r  c               @   s:   e  Z d  Z d d d d d d d d d	 d
 d d i Z d S)TerminalTyper   Ztelexrv   Zteletexr   Zg3_facsimiler   Zg4_facsimiler   Zia5_terminalrj   ZvideotexN)rJ   rK   rL   r   r3   r3   r3   r6   r    s   r  c            .   @   s   e  Z d  Z d d d d d d d d d	 d
 d d d d d d d d d d d d d d d d d d d d d d  d! d" d# d$ d% d& d' d( d) d* d+ d, d- d. i Z d/ S)0ExtensionAttributeTyper   r   ri   teletex_common_namer   teletex_organization_namerv   teletex_personal_namer   teletex_organization_unit_namesr   !teletex_domain_defined_attributesr   pds_namerj   physical_delivery_country_name	   r   
   physical_delivery_office_name   physical_delivery_office_number   extension_of_address_components   physical_delivery_personal_name   #physical_delivery_organization_name   .extension_physical_delivery_address_componentsru   unformatted_postal_address   r      post_office_box_addressr2   poste_restante_address   unique_postal_name   local_postal_attributes   extended_network_address   terminal_typeN)rJ   rK   rL   r   r3   r3   r3   r6   r    s.   r  c            .   @   s   e  Z d  Z d e d d d d i f d e d d d d i f g Z d! Z d	 e d
 e d e d e	 d e
 d e d e d e d e d e d e d e d e d e d e d e d e d e d e d e d e d e d e i Z d  S)"ExtensionAttributeextension_attribute_typer   r   r   r   extension_attribute_valuer   r   r   r  r  r  r  r  r  r  r   r  r  r!  r#  r%  r'  r(  r   r+  r,  r.  r0  r2  r4  N)r6  r7  )rJ   rK   rL   r  r   r}   r   r!   r&   r  r  r  r	  r
  r  r  r  r  r   r3   r3   r3   r6   r5  
  s4   r5  c               @   s   e  Z d  Z e Z d S)ExtensionAttributesN)rJ   rK   rL   r5  r   r3   r3   r3   r6   r8  ,  s   r8  c               @   sC   e  Z d  Z d e f d e d d i f d e d d i f g Z d S)	ORAddressZbuilt_in_standard_attributesZ"built_in_domain_defined_attributesr   TZextension_attributesN)rJ   rK   rL   r  r  r8  r}   r3   r3   r3   r6   r9  0  s   	r9  c               @   sL   e  Z d  Z d e d d d d d d i f d e d d d d	 i f g Z d
 S)EDIPartyNameZname_assignerr   r   r   r   r   TZ
party_namer   N)rJ   rK   rL   r   r}   r3   r3   r3   r6   r:  8  s   r:  c               @   s  e  Z d  Z d e d d d d i f d e d d d d i f d e d d d d	 i f d
 e d d d d i f d e d d d d i f d e d d d d i f d e	 d d d d i f d e
 d d d d i f d e d d d d i f g	 Z d d   Z d d   Z d S)GeneralName
other_namer   r   r   r   Zrfc822_namer   dns_nameri   x400_addressr   Zdirectory_namer   rv   edi_party_namer   uniform_resource_identifierr   
ip_addressr   Zregistered_idrj   c             C   s   |  | k S)Nr3   )r4   r5   r3   r3   r6   r7   L  s    zGeneralName.__ne__c             C   st   |  j  d k r' t t d |  j     | j  d k rN t t d | j     |  j  | j  k rd d S|  j | j k S)	z
        Does not support other_name, x400_address or edi_party_name

        :param other:
            The other GeneralName to compare to

        :return:
            A boolean
        r<  r>  r?  zr
                Comparison is not supported for GeneralName objects of
                choice %s
                za
                Comparison is not supported for GeneralName objects of choice
                %sF)r<  r>  r?  )r<  r>  r?  )r   r`   r   r   )r4   r5   r3   r3   r6   r;   O  s    zGeneralName.__eq__N)rJ   rK   rL   r   rQ   r1   r9  r   r:  rM   r_   r   r   r7   r;   r3   r3   r3   r6   r;  ?  s   r;  c               @   s   e  Z d  Z e Z d S)GeneralNamesN)rJ   rK   rL   r;  r   r3   r3   r3   r6   rB  q  s   rB  c               @   s(   e  Z d  Z d e f d e f g Z d S)TimeZutc_timeZgeneral_timeN)rJ   rK   rL   r(   r   r   r3   r3   r3   r6   rC  u  s   	rC  c               @   s(   e  Z d  Z d e f d e f g Z d S)Validityr   r   N)rJ   rK   rL   rC  r}   r3   r3   r3   r6   rD  |  s   	rD  c               @   s:   e  Z d  Z d e d d i f d e d d i f g Z d S)BasicConstraintscadefaultFpath_len_constraintr   TN)rJ   rK   rL   r   r   r}   r3   r3   r3   r6   rE    s   rE  c            
   @   sp   e  Z d  Z d e d d d d d d i f d e d d d d	 d d i f d
 e d d d d d d i f g Z d S)AuthorityKeyIdentifierkey_identifierr   r   r   r   r   Tauthority_cert_issuerr   authority_cert_serial_numberri   N)rJ   rK   rL   r   rB  r   r}   r3   r3   r3   r6   rI    s   rI  c               @   sF   e  Z d  Z d e d d d d i f d e d d d d i f g Z d S)	DistributionPointName	full_namer   r   r   r   name_relative_to_crl_issuerr   N)rJ   rK   rL   rB  r   r   r3   r3   r3   r6   rM    s   rM  c               @   sL   e  Z d  Z d d d d d d d d d	 d
 d d d d d d d d i	 Z d S)ReasonFlagsr   Zunusedr   Zkey_compromiseri   Zca_compromiser   Zaffiliation_changedrv   Z
supersededr   Zcessation_of_operationr   Zcertificate_holdr   Zprivilege_withdrawnrj   Zaa_compromiseN)rJ   rK   rL   r   r3   r3   r3   r6   rP    s   rP  c            
   @   s[   e  Z d  Z d e f d e d d d d d d i f d e d d d d	 d
 d i f g Z d S)GeneralSubtreebaseZminimumr   r   r   r   rG  Zmaximumr   r   TN)rJ   rK   rL   r;  r   r}   r3   r3   r3   r6   rQ    s   	rQ  c               @   s   e  Z d  Z e Z d S)GeneralSubtreesN)rJ   rK   rL   rQ  r   r3   r3   r3   r6   rS    s   rS  c            	   @   sR   e  Z d  Z d e d d d d d d i f d e d d d d	 d d i f g Z d
 S)NameConstraintsZpermitted_subtreesr   r   r   r   r   TZexcluded_subtreesr   N)rJ   rK   rL   rS  r}   r3   r3   r3   r6   rT    s   rT  c            
   @   s   e  Z d  Z d e d d d d d d i f d e d d	 d d
 d d i f d e d d	 d d d d i f g Z d Z e d d    Z	 d S)DistributionPointdistribution_pointr   r   r   r   r   TZreasonsr   r   Z
crl_issuerri   Fc             C   s   |  j  d k r d |  _  |  d } | j d k rC t t d    xI | j D]> } | j d k rM | j } | d d  d	 k rM | |  _  PqM W|  j  S)
z_
        :return:
            None or a unicode string of the distribution point's URL
        FNrV  rN  z
                    CRL distribution points that are relative to the issuer are
                    not supported
                    r@  r   r   zhttp://)_urlr   r`   r   r   rN   )r4   r   general_nameurlr3   r3   r6   rY    s    	
		zDistributionPoint.urlN)
rJ   rK   rL   rM  rP  rB  r}   rW  r]   rY  r3   r3   r3   r6   rU    s
   $rU  c               @   s   e  Z d  Z e Z d S)CRLDistributionPointsN)rJ   rK   rL   rU  r   r3   r3   r3   r6   rZ    s   rZ  c               @   s:   e  Z d  Z d e f d e f d e f d e f g Z d S)DisplayTextr   Zvisible_stringr   r   N)rJ   rK   rL   r   r*   r   r)   r   r3   r3   r3   r6   r[    s   			r[  c               @   s   e  Z d  Z e Z d S)NoticeNumbersN)rJ   rK   rL   r   r   r3   r3   r3   r6   r\    s   r\  c               @   s(   e  Z d  Z d e f d e f g Z d S)NoticeReferenceZorganizationZnotice_numbersN)rJ   rK   rL   r[  r\  r}   r3   r3   r3   r6   r]    s   	r]  c               @   s:   e  Z d  Z d e d d i f d e d d i f g Z d S)
UserNoticeZ
notice_refr   TZexplicit_textN)rJ   rK   rL   r]  r[  r}   r3   r3   r3   r6   r^    s   r^  c               @   s"   e  Z d  Z d d d d i Z d S)PolicyQualifierIdz1.3.6.1.5.5.7.2.1 certification_practice_statementz1.3.6.1.5.5.7.2.2user_noticeN)rJ   rK   rL   r   r3   r3   r3   r6   r_    s   r_  c               @   s@   e  Z d  Z d e f d e f g Z d Z d e d e i Z	 d S)PolicyQualifierInfopolicy_qualifier_id	qualifierr`  ra  N)rc  rd  )
rJ   rK   rL   r_  r   r}   r   r   r^  r   r3   r3   r3   r6   rb    s
   	rb  c               @   s   e  Z d  Z e Z d S)PolicyQualifierInfosN)rJ   rK   rL   rb  r   r3   r3   r3   r6   re    s   re  c               @   s   e  Z d  Z d d i Z d S)PolicyIdentifierz2.5.29.32.0Z
any_policyN)rJ   rK   rL   r   r3   r3   r3   r6   rf    s   rf  c               @   s1   e  Z d  Z d e f d e d d i f g Z d S)PolicyInformationZpolicy_identifierZpolicy_qualifiersr   TN)rJ   rK   rL   rf  re  r}   r3   r3   r3   r6   rg    s   	rg  c               @   s   e  Z d  Z e Z d S)CertificatePoliciesN)rJ   rK   rL   rg  r   r3   r3   r3   r6   rh  #  s   rh  c               @   s(   e  Z d  Z d e f d e f g Z d S)PolicyMappingZissuer_domain_policyZsubject_domain_policyN)rJ   rK   rL   rf  r}   r3   r3   r3   r6   ri  '  s   	ri  c               @   s   e  Z d  Z e Z d S)PolicyMappingsN)rJ   rK   rL   ri  r   r3   r3   r3   r6   rj  .  s   rj  c            	   @   sR   e  Z d  Z d e d d d d d d i f d e d d d d	 d d i f g Z d
 S)PolicyConstraintsZrequire_explicit_policyr   r   r   r   r   TZinhibit_policy_mappingr   N)rJ   rK   rL   r   r}   r3   r3   r3   r6   rk  2  s   rk  c               @   s  e  Z d  Z d d d d d d d d d	 d
 d d d d d d d d d d d d d d d d d d d d d d  d! d" d# d$ d% d& d' d( d) d* d+ d, d- d. d/ d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d: d; d< d= d> d? d@ dA dB dC dD dE dF dG dH dI dJ dK dL dM dN dO dP dQ dR dS dT dU dV dW dX dY dZ d[ d\ d] d^ d_ d` da db dc dd de df dg dh di dj dk dl dm dn do dp dq dr ds dt du dv dw dx dy dz d{ d| d} d~ d d d d d d d d d d d d d d d d d d d d d d d d d d d d iM Z d S)KeyPurposeIdz2.5.29.37.0Zany_extended_key_usagez1.3.6.1.5.5.7.3.1Zserver_authz1.3.6.1.5.5.7.3.2Zclient_authz1.3.6.1.5.5.7.3.3Zcode_signingz1.3.6.1.5.5.7.3.4Zemail_protectionz1.3.6.1.5.5.7.3.5Zipsec_end_systemz1.3.6.1.5.5.7.3.6Zipsec_tunnelz1.3.6.1.5.5.7.3.7Z
ipsec_userz1.3.6.1.5.5.7.3.8time_stampingz1.3.6.1.5.5.7.3.9Zocsp_signingz1.3.6.1.5.5.7.3.10Zdvcsz1.3.6.1.5.5.7.3.13Zeap_over_pppz1.3.6.1.5.5.7.3.14Zeap_over_lanz1.3.6.1.5.5.7.3.15Zscvp_serverz1.3.6.1.5.5.7.3.16Zscvp_clientz1.3.6.1.5.5.7.3.17Z	ipsec_ikez1.3.6.1.5.5.7.3.18Z	capwap_acz1.3.6.1.5.5.7.3.19Z
capwap_wtpz1.3.6.1.5.5.7.3.20Z
sip_domainz1.3.6.1.5.5.7.3.21Zsecure_shell_clientz1.3.6.1.5.5.7.3.22Zsecure_shell_serverz1.3.6.1.5.5.7.3.23Zsend_routerz1.3.6.1.5.5.7.3.24Zsend_proxied_routerz1.3.6.1.5.5.7.3.25Z
send_ownerz1.3.6.1.5.5.7.3.26Zsend_proxied_ownerz1.3.6.1.5.5.7.3.27Zcmc_caz1.3.6.1.5.5.7.3.28Zcmc_raz1.3.6.1.5.5.7.3.29Zcmc_archivez1.3.6.1.5.5.7.3.30Zbgpspec_routerz1.3.6.1.4.1.311.10.3.1Zmicrosoft_trust_list_signingz1.3.6.1.4.1.311.10.3.2Zmicrosoft_time_stamp_signingz1.3.6.1.4.1.311.10.3.3Zmicrosoft_server_gatedz1.3.6.1.4.1.311.10.3.3.1Zmicrosoft_serializedz1.3.6.1.4.1.311.10.3.4Zmicrosoft_efsz1.3.6.1.4.1.311.10.3.4.1Zmicrosoft_efs_recoveryz1.3.6.1.4.1.311.10.3.5Zmicrosoft_whqlz1.3.6.1.4.1.311.10.3.6Zmicrosoft_nt5z1.3.6.1.4.1.311.10.3.7Zmicrosoft_oem_whqlz1.3.6.1.4.1.311.10.3.8Zmicrosoft_embedded_ntz1.3.6.1.4.1.311.10.3.9Zmicrosoft_root_list_signerz1.3.6.1.4.1.311.10.3.10Z!microsoft_qualified_subordinationz1.3.6.1.4.1.311.10.3.11Zmicrosoft_key_recoveryz1.3.6.1.4.1.311.10.3.12Zmicrosoft_document_signingz1.3.6.1.4.1.311.10.3.13Zmicrosoft_lifetime_signingz1.3.6.1.4.1.311.10.3.14Z microsoft_mobile_device_softwarez1.2.840.113635.100.1.2Zapple_x509_basicz1.2.840.113635.100.1.3Z	apple_sslz1.2.840.113635.100.1.4Zapple_local_cert_genz1.2.840.113635.100.1.5Zapple_csr_genz1.2.840.113635.100.1.6Zapple_revocation_crlz1.2.840.113635.100.1.7Zapple_revocation_ocspz1.2.840.113635.100.1.8Zapple_smimez1.2.840.113635.100.1.9Z	apple_eapz1.2.840.113635.100.1.10Zapple_software_update_signingz1.2.840.113635.100.1.11Zapple_ipsecz1.2.840.113635.100.1.12Zapple_ichatz1.2.840.113635.100.1.13Zapple_resource_signingz1.2.840.113635.100.1.14Zapple_pkinit_clientz1.2.840.113635.100.1.15Zapple_pkinit_serverz1.2.840.113635.100.1.16Zapple_code_signingz1.2.840.113635.100.1.17Zapple_package_signingz1.2.840.113635.100.1.18Zapple_id_validationz1.2.840.113635.100.1.20Zapple_time_stampingz1.2.840.113635.100.1.21Zapple_revocationz1.2.840.113635.100.1.22Zapple_passbook_signingz1.2.840.113635.100.1.23Zapple_mobile_storez1.2.840.113635.100.1.24Zapple_escrow_servicez1.2.840.113635.100.1.25Zapple_profile_signerz1.2.840.113635.100.1.26Zapple_qa_profile_signerz1.2.840.113635.100.1.27Zapple_test_mobile_storez1.2.840.113635.100.1.28Zapple_otapki_signerz1.2.840.113635.100.1.29Zapple_test_otapki_signerz1.2.840.113625.100.1.30Z)apple_id_validation_record_signing_policyz1.2.840.113625.100.1.31Zapple_smp_encryptionz1.2.840.113625.100.1.32Zapple_test_smp_encryptionz1.2.840.113635.100.1.33Zapple_server_authenticationz1.2.840.113635.100.1.34Zapple_pcs_escrow_serviceN)rJ   rK   rL   r   r3   r3   r3   r6   rl  9  s   rl  c               @   s   e  Z d  Z e Z d S)ExtKeyUsageSyntaxN)rJ   rK   rL   rl  r   r3   r3   r3   r6   rn    s   rn  c               @   s.   e  Z d  Z d d d d d d d d i Z d	 S)
AccessMethodz1.3.6.1.5.5.7.48.1ocspz1.3.6.1.5.5.7.48.2Z
ca_issuersz1.3.6.1.5.5.7.48.3rm  z1.3.6.1.5.5.7.48.5Zca_repositoryN)rJ   rK   rL   r   r3   r3   r3   r6   ro    s   ro  c               @   s(   e  Z d  Z d e f d e f g Z d S)AccessDescriptionaccess_methodaccess_locationN)rJ   rK   rL   ro  r;  r}   r3   r3   r3   r6   rq    s   	rq  c               @   s   e  Z d  Z e Z d S)AuthorityInfoAccessSyntaxN)rJ   rK   rL   rq  r   r3   r3   r3   r6   rt    s   rt  c               @   s   e  Z d  Z e Z d S)SubjectInfoAccessSyntaxN)rJ   rK   rL   rq  r   r3   r3   r3   r6   ru    s   ru  c               @   s   e  Z d  Z e Z d S)FeaturesN)rJ   rK   rL   r   r   r3   r3   r3   r6   rv    s   rv  c               @   s(   e  Z d  Z d e f d e f g Z d S)EntrustVersionInfoZentrust_versZentrust_info_flagsN)rJ   rK   rL   r   r   r}   r3   r3   r3   r6   rw    s   	rw  c               @   sF   e  Z d  Z d d d d d d d d d	 d
 d d d d d d i Z d S)NetscapeCertificateTyper   Z
ssl_clientr   Z
ssl_serverri   Zemailr   Zobject_signingrv   Zreservedr   Zssl_car   Zemail_car   Zobject_signing_caN)rJ   rK   rL   r   r3   r3   r3   r6   rx    s   rx  c            ,   @   s   e  Z d  Z d d d d d d d d d	 d
 d d d d d d d d d d d d d d d d d d d d d d  d! d" d# d$ d% d& d' d( d) d* d+ d, i Z d- S).ExtensionIdz2.5.29.9subject_directory_attributesz	2.5.29.14rJ  z	2.5.29.15	key_usagez	2.5.29.16private_key_usage_periodz	2.5.29.17subject_alt_namez	2.5.29.18issuer_alt_namez	2.5.29.19basic_constraintsz	2.5.29.30name_constraintsz	2.5.29.31crl_distribution_pointsz	2.5.29.32certificate_policiesz	2.5.29.33policy_mappingsz	2.5.29.35authority_key_identifierz	2.5.29.36policy_constraintsz	2.5.29.37extended_key_usagez	2.5.29.46freshest_crlz	2.5.29.54inhibit_any_policyz1.3.6.1.5.5.7.1.1authority_information_accessz1.3.6.1.5.5.7.1.11subject_information_accessz1.3.6.1.5.5.7.1.24tls_featurez1.3.6.1.5.5.7.48.1.5ocsp_no_checkz1.2.840.113533.7.65.0entrust_version_extensionz2.16.840.1.113730.1.1netscape_certificate_typeN)rJ   rK   rL   r   r3   r3   r3   r6   ry    s,   ry  c            ,   @   s   e  Z d  Z d e f d e d d i f d e f g Z d Z d e d e	 d e
 d	 e d
 e d e d e d e d e d e d e d e d e d e d e d e d e d e d e d e d e d e i Z d S)	Extensionextn_idcriticalrG  F
extn_valuerz  rJ  r{  r|  r}  r~  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  N)r  r  )rJ   rK   rL   ry  r   r    r}   r   r~   r   r   r   rB  rE  rT  rZ  rh  rj  rI  rk  rn  r   rt  ru  rv  r   rw  rx  r   r3   r3   r3   r6   r    s4   	r  c               @   s   e  Z d  Z e Z d S)
ExtensionsN)rJ   rK   rL   r  r   r3   r3   r3   r6   r    s   r  c               @   s(   e  Z d  Z d d d d d d i Z d S)Versionr   v1r   Zv2ri   Zv3N)rJ   rK   rL   r   r3   r3   r3   r6   r    s   r  c               @   s   e  Z d  Z d e d d d d d d i f d e f d	 e f d
 e f d e f d e f d e f d e	 d d d d d d i f d e	 d d d d d d i f d e
 d d d d d d i f g
 Z d S)TbsCertificateversionr   r   r   r   rG  r  r   	signatureissuerZvaliditysubjectsubject_public_key_infoZissuer_unique_idr   r   r   TZsubject_unique_idri   
extensionsr   N)rJ   rK   rL   r  r   r   r   rD  r,   r   r  r}   r3   r3   r3   r6   r    s   						r  c               @   s-  e  Z d  Z d e f d e f d e f g Z d Z d Z d Z	 d Z
 d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z  d Z! d Z" d Z# d Z$ d Z% d d   Z& e' d d	    Z( e' d
 d    Z) e' d d    Z* e' d d    Z+ e' d d    Z, e' d d    Z- e' d d    Z. e' d d    Z/ e' d d    Z0 e' d d    Z1 e' d d    Z2 e' d d    Z3 e' d  d!    Z4 e' d" d#    Z5 e' d$ d%    Z6 e' d& d'    Z7 e' d( d)    Z8 e' d* d+    Z9 e' d, d-    Z: e' d. d/    Z; e' d0 d1    Z< e' d2 d3    Z= e' d4 d5    Z> e' d6 d7    Z? e' d8 d9    Z@ e' d: d;    ZA e' d< d=    ZB e' d> d?    ZC e' d@ dA    ZD e' dB dC    ZE e' dD dE    ZF e' dF dG    ZG e' dH dI    ZH dJ dK   ZI e' dL dM    ZJ e' dN dO    ZK e' dP dQ    ZL e' dR dS    ZM e' dT dU    ZN e' dV dW    ZO e' dX dY    ZP e' dZ d[    ZQ e' d\ d]    ZR e' d^ d_    ZS d` da   ZT db dc   ZU dd de   ZV d S)fCertificatetbs_certificatesignature_algorithmsignature_valueFNc             C   s   t    |  _ xp |  d d D]` } | d j } d | } t |  |  r^ t |  | | d j  | d j r |  j j |  q Wd |  _ d S)	zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r  r  r  z	_%s_valuer  r  TN)rI   _critical_extensionsrN   hasattrsetattrZparsedadd_processed_extensions)r4   	extensionr   r   r3   r3   r6   _set_extensionsP  s    
zCertificate._set_extensionsc             C   s   |  j  s |  j   |  j S)z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r  r  r  )r4   r3   r3   r6   critical_extensionsb  s    
	
zCertificate.critical_extensionsc             C   s   |  j  s |  j   |  j S)z
        This extension is used to contain additional identification attributes
        about the subject.

        :return:
            None or an Attributes object
        )r  r  _key_identifier_value)r4   r3   r3   r6   "subject_directory_attributes_valuep  s    
	
z.Certificate.subject_directory_attributes_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used to help in creating certificate validation paths.
        It contains an identifier that should generally, but is not guaranteed
        to, be unique.

        :return:
            None or an OctetString object
        )r  r  r  )r4   r3   r3   r6   key_identifier_value~  s    	
z Certificate.key_identifier_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used to define the purpose of the public key
        contained within the certificate.

        :return:
            None or a KeyUsage
        )r  r  _key_usage_value)r4   r3   r3   r6   key_usage_value  s    
	
zCertificate.key_usage_valuec             C   s   |  j  s |  j   |  j S)aT  
        This extension allows for additional names to be associate with the
        subject of the certificate. While it may contain a whole host of
        possible names, it is usually used to allow certificates to be used
        with multiple different domain names.

        :return:
            None or a GeneralNames object
        )r  r  _subject_alt_name_value)r4   r3   r3   r6   subject_alt_name_value  s    	
z"Certificate.subject_alt_name_valuec             C   s   |  j  s |  j   |  j S)z
        This extension allows associating one or more alternative names with
        the issuer of the certificate.

        :return:
            None or an x509.GeneralNames object
        )r  r  _issuer_alt_name_value)r4   r3   r3   r6   issuer_alt_name_value  s    
	
z!Certificate.issuer_alt_name_valuec             C   s   |  j  s |  j   |  j S)a'  
        This extension is used to determine if the subject of the certificate
        is a CA, and if so, what the maximum number of intermediate CA certs
        after this are, before an end-entity certificate is found.

        :return:
            None or a BasicConstraints object
        )r  r  _basic_constraints_value)r4   r3   r3   r6   basic_constraints_value  s    	
z#Certificate.basic_constraints_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used in CA certificates, and is used to limit the
        possible names of certificates issued.

        :return:
            None or a NameConstraints object
        )r  r  _name_constraints_value)r4   r3   r3   r6   name_constraints_value  s    
	
z"Certificate.name_constraints_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used to help in locating the CRL for this certificate.

        :return:
            None or a CRLDistributionPoints object
            extension
        )r  r  _crl_distribution_points_value)r4   r3   r3   r6   crl_distribution_points_value  s    
	
z)Certificate.crl_distribution_points_valuec             C   s   |  j  s |  j   |  j S)a;  
        This extension defines policies in CA certificates under which
        certificates may be issued. In end-entity certificates, the inclusion
        of a policy indicates the issuance of the certificate follows the
        policy.

        :return:
            None or a CertificatePolicies object
        )r  r  _certificate_policies_value)r4   r3   r3   r6   certificate_policies_value  s    	
z&Certificate.certificate_policies_valuec             C   s   |  j  s |  j   |  j S)z
        This extension allows mapping policy OIDs to other OIDs. This is used
        to allow different policies to be treated as equivalent in the process
        of validation.

        :return:
            None or a PolicyMappings object
        )r  r  _policy_mappings_value)r4   r3   r3   r6   policy_mappings_value  s    	
z!Certificate.policy_mappings_valuec             C   s   |  j  s |  j   |  j S)z
        This extension helps in identifying the public key with which to
        validate the authenticity of the certificate.

        :return:
            None or an AuthorityKeyIdentifier object
        )r  r  _authority_key_identifier_value)r4   r3   r3   r6   authority_key_identifier_value  s    
	
z*Certificate.authority_key_identifier_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used to control if policy mapping is allowed and
        when policies are required.

        :return:
            None or a PolicyConstraints object
        )r  r  _policy_constraints_value)r4   r3   r3   r6   policy_constraints_value  s    
	
z$Certificate.policy_constraints_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used to help locate any available delta CRLs

        :return:
            None or an CRLDistributionPoints object
        )r  r  _freshest_crl_value)r4   r3   r3   r6   freshest_crl_value  s    		
zCertificate.freshest_crl_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used to prevent mapping of the any policy to
        specific requirements

        :return:
            None or a Integer object
        )r  r  _inhibit_any_policy_value)r4   r3   r3   r6   inhibit_any_policy_value,  s    
	
z$Certificate.inhibit_any_policy_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used to define additional purposes for the public key
        beyond what is contained in the basic constraints.

        :return:
            None or an ExtKeyUsageSyntax object
        )r  r  _extended_key_usage_value)r4   r3   r3   r6   extended_key_usage_value:  s    
	
z$Certificate.extended_key_usage_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used to locate the CA certificate used to sign this
        certificate, or the OCSP responder for this certificate.

        :return:
            None or an AuthorityInfoAccessSyntax object
        )r  r  #_authority_information_access_value)r4   r3   r3   r6   "authority_information_access_valueH  s    
	
z.Certificate.authority_information_access_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used to access information about the subject of this
        certificate.

        :return:
            None or a SubjectInfoAccessSyntax object
        )r  r  !_subject_information_access_value)r4   r3   r3   r6    subject_information_access_valueV  s    
	
z,Certificate.subject_information_access_valuec             C   s   |  j  s |  j   |  j S)z
        This extension is used to list the TLS features a server must respond
        with if a client initiates a request supporting them.

        :return:
            None or a Features object
        )r  r  _tls_feature_value)r4   r3   r3   r6   tls_feature_valued  s    
	
zCertificate.tls_feature_valuec             C   s   |  j  s |  j   |  j S)a-  
        This extension is used on certificates of OCSP responders, indicating
        that revocation information for the certificate should never need to
        be verified, thus preventing possible loops in path validation.

        :return:
            None or a Null object (if present)
        )r  r  _ocsp_no_check_value)r4   r3   r3   r6   ocsp_no_check_valuer  s    	
zCertificate.ocsp_no_check_valuec             C   s   |  d j  S)zE
        :return:
            A byte string of the signature
        r  )rN   )r4   r3   r3   r6   r    s    zCertificate.signaturec             C   s   |  d j  S)zj
        :return:
            A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
        r  )signature_algo)r4   r3   r3   r6   r    s    zCertificate.signature_algoc             C   s   |  d j  S)z
        :return:
            A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
            "sha384", "sha512", "sha512_224", "sha512_256"
        r  )	hash_algo)r4   r3   r3   r6   r    s    zCertificate.hash_algoc             C   s   |  d d S)zT
        :return:
            The PublicKeyInfo object for this certificate
        r  r  r3   )r4   r3   r3   r6   
public_key  s    zCertificate.public_keyc             C   s   |  d d S)zZ
        :return:
            The Name object for the subject of this certificate
        r  r  r3   )r4   r3   r3   r6   r    s    zCertificate.subjectc             C   s   |  d d S)zY
        :return:
            The Name object for the issuer of this certificate
        r  r  r3   )r4   r3   r3   r6   r    s    zCertificate.issuerc             C   s   |  d d j  S)zT
        :return:
            An integer of the certificate's serial number
        r  r   )rN   )r4   r3   r3   r6   r     s    zCertificate.serial_numberc             C   s   |  j  s d S|  j  j S)z
        :return:
            None or a byte string of the certificate's key identifier from the
            key identifier extension
        N)r  rN   )r4   r3   r3   r6   rJ    s    	zCertificate.key_identifierc             C   s?   |  j  d k r8 |  j j d t |  j  j d  |  _  |  j  S)z
        :return:
            A byte string of the SHA-256 hash of the issuer concatenated with
            the ascii character ":", concatenated with the serial number as
            an ascii string
        N   :rU   )_issuer_serialr  r   r   r   rA   )r4   r3   r3   r6   issuer_serial  s    	)zCertificate.issuer_serialc             C   s   |  j  s d S|  j  d j S)z
        :return:
            None or a byte string of the key_identifier from the authority key
            identifier extension
        NrJ  )r  rN   )r4   r3   r3   r6   r    s    	z$Certificate.authority_key_identifierc             C   s   |  j  d k r |  j } | r | d j r |  j d d j } | j   } |  j d j } | j d t |  j d  |  _  n	 d |  _  |  j  S)a;  
        :return:
            None or a byte string of the SHA-256 hash of the isser from the
            authority key identifier extension concatenated with the ascii
            character ":", concatenated with the serial number from the
            authority key identifier extension as an ascii string
        FrK  r   rL  r  rU   N)_authority_issuer_serialr  rN   r   Zuntagr   r   rA   )r4   Zakivr  Zauthority_serialr3   r3   r6   authority_issuer_serial  s    
	&	z#Certificate.authority_issuer_serialc             C   s+   |  j  d k r$ |  j |  j  |  _  |  j  S)z
        Returns complete CRL URLs - does not include delta CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)_crl_distribution_points!_get_http_crl_distribution_pointsr  )r4   r3   r3   r6   r    s    	z#Certificate.crl_distribution_pointsc             C   s+   |  j  d k r$ |  j |  j  |  _  |  j  S)z
        Returns delta CRL URLs - does not include complete CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)_delta_crl_distribution_pointsr  r  )r4   r3   r3   r6   delta_crl_distribution_points	  s    	z)Certificate.delta_crl_distribution_pointsc             C   s   g  } | d k r g  Sxi | D]a } | d } | t  k r< q | j d k rN q x- | j D]" } | j d k rX | j |  qX Wq W| S)a?  
        Fetches the DistributionPoint object for non-relative, HTTP CRLs
        referenced by the certificate

        :param crl_distribution_points:
            A CRLDistributionPoints object to grab the DistributionPoints from

        :return:
            A list of zero or more DistributionPoint objects
        NrV  rO  r@  )r+   r   r   r   )r4   r  r   rV  Zdistribution_point_namerX  r3   r3   r6   r  	  s    
z-Certificate._get_http_crl_distribution_pointsc             C   s   |  j  s g  Sg  } xr |  j  D]g } | d j d k r | d } | j d k rR q | j } | j   d d  d k r | j |  q W| S)zx
        :return:
            A list of zero or more unicode strings of the OCSP URLs for this
            cert
        rr  rp  rs  r@  r   r   zhttp://)r  rN   r   r:   r   )r4   r   entrylocationrY  r3   r3   r6   	ocsp_urls7	  s    	
	zCertificate.ocsp_urlsc             C   s   |  j  d k r g  |  _  |  j rl x |  j D]: } | j d k r+ | j |  j  k r+ |  j  j | j  q+ Wnv t j d  } xd |  j j D]V } xM | D]E } | d j d k r | d j } | j	 |  r |  j  j |  q Wq W|  j  S)z
        :return:
            A list of unicode strings of valid domain names for the certificate.
            Wildcard certificates will have a domain in the form: *.example.com
        Nr=  zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r{   r   rG   )
_valid_domainsr  r   rN   r   r   compiler  r   match)r4   rX  patternr   Zname_type_valuerG   r3   r3   r6   valid_domainsM	  s    		!zCertificate.valid_domainsc             C   s^   |  j  d k rW g  |  _  |  j rW x3 |  j D]( } | j d k r+ |  j  j | j  q+ W|  j  S)zj
        :return:
            A list of unicode strings of valid IP addresses for the certificate
        NrA  )
_valid_ipsr  r   r   rN   )r4   rX  r3   r3   r6   	valid_ipsp	  s    		zCertificate.valid_ipsc             C   s   |  j  o |  j  d j S)zW
        :return;
            A boolean - if the certificate is marked as a CA
        rF  )r  rN   )r4   r3   r3   r6   rF  	  s    zCertificate.cac             C   s   |  j  s d S|  j d j S)zT
        :return;
            None or an integer of the maximum path length
        NrH  )rF  r  rN   )r4   r3   r3   r6   max_path_length	  s    	zCertificate.max_path_lengthc             C   s+   |  j  d k r$ |  j |  j k |  _  |  j  S)zx
        :return:
            A boolean - if the certificate is self-issued, as defined by RFC
            5280
        N)_self_issuedr  r  )r4   r3   r3   r6   self_issued	  s    zCertificate.self_issuedc             C   sm   |  j  d k rf d |  _  |  j rf |  j r] |  j s? d |  _  qf |  j |  j k rf d |  _  n	 d |  _  |  j  S)a  
        :return:
            A unicode string of "yes", "no" or "maybe". The "maybe" result will
            be returned if the certificate does not contain a key identifier
            extension, but is issued by the subject. In this case the
            certificate signature will need to be verified using the subject
            public key to determine a "yes" or "no" answer.
        Nnoyesmaybe)_self_signedr  rJ  r  )r4   r3   r3   r6   self_signed	  s    					zCertificate.self_signedc             C   s4   |  j  d k r- t j |  j    j   |  _  |  j  S)zk
        :return:
            The SHA-1 hash of the DER-encoded bytes of this complete certificate
        N)r   r   r   r   r   )r4   r3   r3   r6   r   	  s    zCertificate.sha1c             C   s#   d j  d d   t |  j  D  S)z
        :return:
            A unicode string of the SHA-1 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r   c             s   s   |  ] } d  | Vq d S)z%02XNr3   )r   cr3   r3   r6   r   	  s    z/Certificate.sha1_fingerprint.<locals>.<genexpr>)r   r   r   )r4   r3   r3   r6   sha1_fingerprint	  s    zCertificate.sha1_fingerprintc             C   s4   |  j  d k r- t j |  j    j   |  _  |  j  S)zy
        :return:
            The SHA-256 hash of the DER-encoded bytes of this complete
            certificate
        N)r   r   r   r   r   )r4   r3   r3   r6   r   	  s    zCertificate.sha256c             C   s  t  | t  s* t t d t |     | j d  j d  j   } | j d  d
 k } | os t	 j
 d |  } | o | } | rA|  j s d S| j d  } x |  j D] } | j d  j d  j   } | j d  }	 t |	  t |  k r q |	 | k rd	 S|  j |  }
 |
 r |  j | |	  r d	 Sq Wd S|  j sNd S| r]t j n t j } t | |  } xW |  j D]L } | j d  d k rt j n t j } t | |  } | | k rd	 SqWd S)a  
        Check if a domain name or IP address is valid according to the
        certificate

        :param domain_ip:
            A unicode string of a domain name or IP address

        :return:
            A boolean - if the domain or IP is valid for the certificate
        zL
                domain_ip must be a unicode string, not %s
                r   rU   rd   r   z^\d+\.\d+\.\d+\.\d+$Fr<   TrW   rW   )r8   r   r?   r   r   rA   r\   r:   rX   r   r  r  rk   rp   _is_wildcard_domain_is_wildcard_matchr  rm   ro   rn   r0   )r4   Z	domain_ipZencoded_domain_ipZis_ipv6Zis_ipv4Z	is_domaindomain_labelsZvalid_domainZencoded_valid_domainvalid_domain_labelsZis_wildcardrt   Znormalized_ipZvalid_ipZvalid_familyZnormalized_valid_ipr3   r3   r6   is_valid_domain_ip	  sB    		'zCertificate.is_valid_domain_ipc             C   sw   | j  d  d k r d S| j   j d  } | s8 d S| d j d  d	 k rU d S| d d d  d k rs d Sd S)
af  
        Checks if a domain is a valid wildcard according to
        https://tools.ietf.org/html/rfc6125#section-6.4.3

        :param domain:
            A unicode string of the domain name, where any U-labels from an IDN
            have been converted to A-labels

        :return:
            A boolean - if the domain is a valid wildcard domain
        *r   Fr<   r   rv   zxn--TrW   )countr:   rk   rX   )r4   ZdomainZlabelsr3   r3   r6   r  
  s    zCertificate._is_wildcard_domainc             C   s   | d } | d d  } | d } | d d  } | | k rD d S| d k rT d St  j d | j d d  d	  } | j |  r d Sd S)
a  
        Determines if the labels in a domain are a match for labels from a
        wildcard valid domain name

        :param domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in the domain name to check

        :param valid_domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in a wildcard domain pattern

        :return:
            A boolean - if the domain matches the valid domain
        r   r   NFr  T^z.*$)r   r  r   r  )r4   r  r  Zfirst_domain_labelZother_domain_labelsZwildcard_labelZother_valid_domain_labelsZwildcard_regexr3   r3   r6   r  <
  s    

#zCertificate._is_wildcard_match)WrJ   rK   rL   r  r   r   r}   r  r  Z_subject_directory_attributesr  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r   r  r]   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   rJ  r  r  r  r  r  r  r  r  r  rF  r  r  r  r   r  r   r  r  r  r3   r3   r3   r6   r  )  s   				
				#	
B!r  c               @   s   e  Z d  Z e Z d S)KeyPurposeIdentifiersN)rJ   rK   rL   rl  r   r3   r3   r3   r6   r  f
  s   r  c               @   s   e  Z d  Z e Z d S)SequenceOfAlgorithmIdentifiersN)rJ   rK   rL   r   r   r3   r3   r3   r6   r  j
  s   r  c               @   s   e  Z d  Z d e d d i f d e d d d d d d i f d	 e d d i f d
 e d d i f d e d d d d d d i f g Z d S)CertificateAuxZtrustr   TZrejectr   r   r   r   aliasZkeyidr5   r   N)rJ   rK   rL   r  r)   r   r  r}   r3   r3   r3   r6   r  n
  s
   r  c               @   s   e  Z d  Z e e g Z d S)TrustedCertificateN)rJ   rK   rL   r  r  Z_child_specsr3   r3   r3   r6   r  x
  s   r  )__doc__Z
__future__r   r   r   r   	encodingsr   r   r   rm   r   r   r   Z_errorsr   Z_irir	   r
   Z_ordereddictr   Z_typesr   r   r   Zalgosr   r   Zcorer   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r   r,   utilr-   r.   r/   r0   r1   rM   rQ   r_   rz   r~   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r  r  r	  r
  r  r  r  r  r  r  r  r  r  r5  r8  r9  r:  r;  rB  rC  rD  rE  rI  rM  rP  rQ  rS  rT  rU  rZ  r[  r\  r]  r^  r_  rb  re  rf  rg  rh  ri  rj  rk  rl  rn  ro  rq  rt  ru  rv  rw  rx  ry  r  r  r  r  r  r  r  r  r  r3   r3   r3   r6   <module>   s   ""59l}U*

			"2%	b	"   @
