An extension to CertList that additionally has a list of ROOT CAs that are trusted. Example:: >>> tree = CertTree("ca_chain.pem") >>> tree.show() /CN=DOMAIN-DC1-CA/dc=DOMAIN [Self Signed] /CN=Administrator/dc=DOMAIN [Not Self Signed]
| 1541 | |
| 1542 | |
| 1543 | class CertTree(CertList): |
| 1544 | """ |
| 1545 | An extension to CertList that additionally has a list of ROOT CAs |
| 1546 | that are trusted. |
| 1547 | |
| 1548 | Example:: |
| 1549 | |
| 1550 | >>> tree = CertTree("ca_chain.pem") |
| 1551 | >>> tree.show() |
| 1552 | /CN=DOMAIN-DC1-CA/dc=DOMAIN [Self Signed] |
| 1553 | /CN=Administrator/dc=DOMAIN [Not Self Signed] |
| 1554 | """ |
| 1555 | |
| 1556 | __slots__ = ["frmt", "rootCAs"] |
| 1557 | |
| 1558 | def __init__( |
| 1559 | self, |
| 1560 | certList: Union[List[Cert], CertList, str], |
| 1561 | rootCAs: Union[List[Cert], CertList, Cert, str, None] = None, |
| 1562 | ): |
| 1563 | """ |
| 1564 | Construct a chain of certificates that follows issuer/subject matching and |
| 1565 | respects signature validity. |
| 1566 | |
| 1567 | Note that we do not check AKID/{SKID/issuer/serial} matching, |
| 1568 | nor the presence of keyCertSign in keyUsage extension (if present). |
| 1569 | |
| 1570 | :param certList: a list of Cert/CRL objects (or path to PEM/DER file containing |
| 1571 | multiple certs/CRL) to try to chain. |
| 1572 | :param rootCAs: (optional) a list of certificates to trust. If not provided, |
| 1573 | trusts any self-signed certificates from the certList. |
| 1574 | """ |
| 1575 | # Parse the certificate list |
| 1576 | certList = CertList(certList) |
| 1577 | |
| 1578 | # Find the ROOT CAs if store isn't specified |
| 1579 | if not rootCAs: |
| 1580 | # Build cert store. |
| 1581 | self.rootCAs = CertList([x for x in certList if x.isSelfSigned()]) |
| 1582 | # And remove those certs from the list |
| 1583 | for cert in self.rootCAs: |
| 1584 | certList.remove(cert) |
| 1585 | else: |
| 1586 | # Store cert store. |
| 1587 | self.rootCAs = CertList(rootCAs) |
| 1588 | # And remove those certs from the list if present (remove dups) |
| 1589 | for cert in self.rootCAs: |
| 1590 | if cert in certList: |
| 1591 | certList.remove(cert) |
| 1592 | |
| 1593 | # Append our root CAs to the certList |
| 1594 | certList.extend(self.rootCAs) |
| 1595 | |
| 1596 | # Super instantiate |
| 1597 | super(CertTree, self).__init__(certList) |
| 1598 | |
| 1599 | @property |
| 1600 | def tree(self): |