| 351 | return md |
| 352 | |
| 353 | def check_md_credentials(self, domain): |
| 354 | if isinstance(domain, list): |
| 355 | domains = domain |
| 356 | domain = domains[0] |
| 357 | else: |
| 358 | domains = [domain] |
| 359 | # check private key, validate certificate, etc |
| 360 | MDCertUtil.validate_privkey(self.store_domain_file(domain, 'privkey.pem')) |
| 361 | cert = MDCertUtil(self.store_domain_file(domain, 'pubcert.pem')) |
| 362 | cert.validate_cert_matches_priv_key(self.store_domain_file(domain, 'privkey.pem')) |
| 363 | # No longer check CN, it may not be set or is not trusted anyway |
| 364 | # assert cert.get_cn() == domain, f'CN: expected "{domain}", got {cert.get_cn()}' |
| 365 | # check SANs |
| 366 | # compare lists twice in opposite directions: SAN may not respect ordering |
| 367 | san_list = list(cert.get_san_list()) |
| 368 | assert len(san_list) == len(domains) |
| 369 | assert set(san_list).issubset(domains), f'{san_list} not subset of {domains}' |
| 370 | assert set(domains).issubset(san_list), f'{domains} not subset of {san_list}' |
| 371 | # check valid dates interval |
| 372 | not_before = cert.get_not_before() |
| 373 | not_after = cert.get_not_after() |
| 374 | assert not_before < datetime.now(not_before.tzinfo) |
| 375 | assert not_after > datetime.now(not_after.tzinfo) |
| 376 | |
| 377 | # --------- check utilities --------- |
| 378 | |