File: //snap/certbot/current/lib/python3.12/site-packages/certbot/__pycache__/ocsp.cpython-312.pyc
�
�F�h�* �
� � d Z ddlmZ ddlmZ ddlmZ ddlZddlmZ ddlmZ ddl m
Z
dd l mZ dd
lm
Z
ddlmZ ddlmZ dd
lmZ ddlZddlmZ ddlmZ ddlmZ ej2 e� Z G d� d� Zdedeee ee f fd�Zdededede de!f
d�Z"dddddejF deddf
d�Z$dddejF deddfd �Z%y)!z*Tools for checking certificate revocation.� )�datetime)� timedelta)�timezoneN)�Optional)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)�
serialization)�ocsp)�crypto_util)�errors)�
RenewableCertc �: � e Zd ZdZdedefd�Zd
dedededefd�Z y )�RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.�cert�returnc �N � | j |j |j � S )a Get revoked status for a particular cert version.
.. todo:: Make this a non-blocking call
:param `.interfaces.RenewableCert` cert: Certificate object
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
)�ocsp_revoked_by_paths� cert_path�
chain_path)�selfr s �|/build/snapcraft-certbot-c9aaebe726f8beb59a0eb2d8e1671bc4/parts/certbot/install/lib/python3.12/site-packages/certbot/ocsp.py�ocsp_revokedzRevocationChecker.ocsp_revoked s � � �)�)�$�.�.�$�/�/�J�J� r r �timeoutc � � t j t j � }t j
|� |k ryt
|� \ }}|r|syt ||||� S )aE Performs the OCSP revocation check
:param str cert_path: Certificate filepath
:param str chain_path: Certificate chain
:param int timeout: Timeout (in seconds) for the OCSP query
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
F)r �nowr �utcr �notAfter�_determine_ocsp_server�_check_ocsp_cryptography)r r r r r �url�hosts r r z'RevocationChecker.ocsp_revoked_by_paths&