| 102 | |
| 103 | |
| 104 | def _get_issuer_cert( |
| 105 | cert: Certificate, chain: Iterable[Certificate], trusted_ca_certs: Optional[list[Certificate]] |
| 106 | ) -> Optional[Certificate]: |
| 107 | issuer_name = cert.issuer |
| 108 | for candidate in chain: |
| 109 | if candidate.subject == issuer_name: |
| 110 | return candidate |
| 111 | |
| 112 | # Depending on the server's TLS library, the peer's cert chain may not |
| 113 | # include the self signed root CA. In this case we check the user |
| 114 | # provided tlsCAFile for the issuer. |
| 115 | # Remove once we use the verified peer cert chain in PYTHON-2147. |
| 116 | if trusted_ca_certs: |
| 117 | for candidate in trusted_ca_certs: |
| 118 | if candidate.subject == issuer_name: |
| 119 | return candidate |
| 120 | return None |
| 121 | |
| 122 | |
| 123 | def _verify_signature( |