You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
670 lines
24 KiB
670 lines
24 KiB
OCSP
|
|
====
|
|
|
|
.. currentmodule:: cryptography.x509.ocsp
|
|
|
|
.. testsetup::
|
|
|
|
import base64
|
|
pem_cert = b"""
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIFvTCCBKWgAwIBAgICPyAwDQYJKoZIhvcNAQELBQAwRzELMAkGA1UEBhMCVVMx
|
|
FjAUBgNVBAoTDUdlb1RydXN0IEluYy4xIDAeBgNVBAMTF1JhcGlkU1NMIFNIQTI1
|
|
NiBDQSAtIEczMB4XDTE0MTAxNTEyMDkzMloXDTE4MTExNjAxMTUwM1owgZcxEzAR
|
|
BgNVBAsTCkdUNDg3NDI5NjUxMTAvBgNVBAsTKFNlZSB3d3cucmFwaWRzc2wuY29t
|
|
L3Jlc291cmNlcy9jcHMgKGMpMTQxLzAtBgNVBAsTJkRvbWFpbiBDb250cm9sIFZh
|
|
bGlkYXRlZCAtIFJhcGlkU1NMKFIpMRwwGgYDVQQDExN3d3cuY3J5cHRvZ3JhcGh5
|
|
LmlvMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAom/FebKJIot7Sp3s
|
|
itG1sicpe3thCssjI+g1JDAS7I3GLVNmbms1DOdIIqwf01gZkzzXBN2+9sOnyRaR
|
|
PPfCe1jTr3dk2y6rPE559vPa1nZQkhlzlhMhlPyjaT+S7g4Tio4qV2sCBZU01DZJ
|
|
CaksfohN+5BNVWoJzTbOcrHOEJ+M8B484KlBCiSxqf9cyNQKru4W3bHaCVNVJ8eu
|
|
6i6KyhzLa0L7yK3LXwwXVs583C0/vwFhccGWsFODqD/9xHUzsBIshE8HKjdjDi7Y
|
|
3BFQzVUQFjBB50NSZfAA/jcdt1blxJouc7z9T8Oklh+V5DDBowgAsrT4b6Z2Fq6/
|
|
r7D1GqivLK/ypUQmxq2WXWAUBb/Q6xHgxASxI4Br+CByIUQJsm8L2jzc7k+mF4hW
|
|
ltAIUkbo8fGiVnat0505YJgxWEDKOLc4Gda6d/7GVd5AvKrz242bUqeaWo6e4MTx
|
|
diku2Ma3rhdcr044Qvfh9hGyjqNjvhWY/I+VRWgihU7JrYvgwFdJqsQ5eiKT4OHi
|
|
gsejvWwkZzDtiQ+aQTrzM1FsY2swJBJsLSX4ofohlVRlIJCn/ME+XErj553431Lu
|
|
YQ5SzMd3nXzN78Vj6qzTfMUUY72UoT1/AcFiUMobgIqrrmwuNxfrkbVE2b6Bga74
|
|
FsJX63prvrJ41kuHK/16RQBM7fcCAwEAAaOCAWAwggFcMB8GA1UdIwQYMBaAFMOc
|
|
8/zTRgg0u85Gf6B8W/PiCMtZMFcGCCsGAQUFBwEBBEswSTAfBggrBgEFBQcwAYYT
|
|
aHR0cDovL2d2LnN5bWNkLmNvbTAmBggrBgEFBQcwAoYaaHR0cDovL2d2LnN5bWNi
|
|
LmNvbS9ndi5jcnQwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMB
|
|
BggrBgEFBQcDAjAvBgNVHREEKDAmghN3d3cuY3J5cHRvZ3JhcGh5Lmlvgg9jcnlw
|
|
dG9ncmFwaHkuaW8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2d2LnN5bWNiLmNv
|
|
bS9ndi5jcmwwDAYDVR0TAQH/BAIwADBFBgNVHSAEPjA8MDoGCmCGSAGG+EUBBzYw
|
|
LDAqBggrBgEFBQcCARYeaHR0cHM6Ly93d3cucmFwaWRzc2wuY29tL2xlZ2FsMA0G
|
|
CSqGSIb3DQEBCwUAA4IBAQAzIYO2jx7h17FBT74tJ2zbV9OKqGb7QF8y3wUtP4xc
|
|
dH80vprI/Cfji8s86kr77aAvAqjDjaVjHn7UzebhSUivvRPmfzRgyWBacomnXTSt
|
|
Xlt2dp2nDQuwGyK2vB7dMfKnQAkxwq1sYUXznB8i0IhhCAoXp01QGPKq51YoIlnF
|
|
7DRMk6iEaL1SJbkIrLsCQyZFDf0xtfW9DqXugMMLoxeCsBhZJQzNyS2ryirrv9LH
|
|
aK3+6IZjrcyy9bkpz/gzJucyhU+75c4My/mnRCrtItRbCQuiI5pd5poDowm+HH9i
|
|
GVI9+0lAFwxOUnOnwsoI40iOoxjLMGB+CgFLKCGUcWxP
|
|
-----END CERTIFICATE-----
|
|
"""
|
|
pem_issuer = b"""
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIEJTCCAw2gAwIBAgIDAjp3MA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVT
|
|
MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
|
|
YWwgQ0EwHhcNMTQwODI5MjEzOTMyWhcNMjIwNTIwMjEzOTMyWjBHMQswCQYDVQQG
|
|
EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEgMB4GA1UEAxMXUmFwaWRTU0wg
|
|
U0hBMjU2IENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCv
|
|
VJvZWF0eLFbG1eh/9H0WA//Qi1rkjqfdVC7UBMBdmJyNkA+8EGVf2prWRHzAn7Xp
|
|
SowLBkMEu/SW4ib2YQGRZjEiwzQ0Xz8/kS9EX9zHFLYDn4ZLDqP/oIACg8PTH2lS
|
|
1p1kD8mD5xvEcKyU58Okaiy9uJ5p2L4KjxZjWmhxgHsw3hUEv8zTvz5IBVV6s9cQ
|
|
DAP8m/0Ip4yM26eO8R5j3LMBL3+vV8M8SKeDaCGnL+enP/C1DPz1hNFTvA5yT2AM
|
|
QriYrRmIV9cE7Ie/fodOoyH5U/02mEiN1vi7SPIpyGTRzFRIU4uvt2UevykzKdkp
|
|
YEj4/5G8V1jlNS67abZZAgMBAAGjggEdMIIBGTAfBgNVHSMEGDAWgBTAephojYn7
|
|
qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQUw5zz/NNGCDS7zkZ/oHxb8+IIy1kwEgYD
|
|
VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwNQYDVR0fBC4wLDAqoCig
|
|
JoYkaHR0cDovL2cuc3ltY2IuY29tL2NybHMvZ3RnbG9iYWwuY3JsMC4GCCsGAQUF
|
|
BwEBBCIwIDAeBggrBgEFBQcwAYYSaHR0cDovL2cuc3ltY2QuY29tMEwGA1UdIARF
|
|
MEMwQQYKYIZIAYb4RQEHNjAzMDEGCCsGAQUFBwIBFiVodHRwOi8vd3d3Lmdlb3Ry
|
|
dXN0LmNvbS9yZXNvdXJjZXMvY3BzMA0GCSqGSIb3DQEBCwUAA4IBAQCjWB7GQzKs
|
|
rC+TeLfqrlRARy1+eI1Q9vhmrNZPc9ZE768LzFvB9E+aj0l+YK/CJ8cW8fuTgZCp
|
|
fO9vfm5FlBaEvexJ8cQO9K8EWYOHDyw7l8NaEpt7BDV7o5UzCHuTcSJCs6nZb0+B
|
|
kvwHtnm8hEqddwnxxYny8LScVKoSew26T++TGezvfU5ho452nFnPjJSxhJf3GrkH
|
|
uLLGTxN5279PURt/aQ1RKsHWFf83UTRlUfQevjhq7A6rvz17OQV79PP7GqHQyH5O
|
|
ZI3NjGFVkP46yl0lD/gdo0p0Vk8aVUBwdSWmMy66S6VdU5oNMOGNX2Esr8zvsJmh
|
|
gP8L8mJMcCaY
|
|
-----END CERTIFICATE-----
|
|
"""
|
|
pem_responder_cert = b"""
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBPjCB5KADAgECAgQHW80VMAoGCCqGSM49BAMCMCcxCzAJBgNVBAYTAlVTMRgw
|
|
FgYDVQQDDA9DcnlwdG9ncmFwaHkgQ0EwHhcNMTgxMDA3MTIzNTEwWhcNMjgxMDA0
|
|
MTIzNTEwWjAnMQswCQYDVQQGEwJVUzEYMBYGA1UEAwwPQ3J5cHRvZ3JhcGh5IENB
|
|
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbQ2E0N/E3R0zEG+qa+yAFXBY6Fte
|
|
QzyvFdq7EZHDktlyUllaVJBrbX1ItV0MlayFwwQPhZmuLPpQBzuVKyrUfTAKBggq
|
|
hkjOPQQDAgNJADBGAiEAo0NQRmfPvhWQpSvJzV+2Ag441Zeckk+bib7swduQIjIC
|
|
IQCqYD9pArB2SWfmhQCSZkNEATlsPIML8lvlSkbNcrmrqQ==
|
|
-----END CERTIFICATE-----
|
|
"""
|
|
pem_responder_key = b"""
|
|
-----BEGIN PRIVATE KEY-----
|
|
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgO+vsRu8xDIVZE+xh
|
|
s8ESqJqcpJlwmj8CtF8HPHxrDSGhRANCAARtDYTQ38TdHTMQb6pr7IAVcFjoW15D
|
|
PK8V2rsRkcOS2XJSWVpUkGttfUi1XQyVrIXDBA+Fma4s+lAHO5UrKtR9
|
|
-----END PRIVATE KEY-----
|
|
"""
|
|
der_ocsp_req = (
|
|
b"0V0T0R0P0N0\t\x06\x05+\x0e\x03\x02\x1a\x05\x00\x04\x148\xcaF\x8c"
|
|
b"\x07D\x8d\xf4\x81\x96\xc7mmLpQ\x9e`\xa7\xbd\x04\x14yu\xbb\x84:\xcb"
|
|
b",\xdez\t\xbe1\x1bC\xbc\x1c*MSX\x02\x15\x00\x98\xd9\xe5\xc0\xb4\xc3"
|
|
b"sU-\xf7|]\x0f\x1e\xb5\x12\x8eIE\xf9"
|
|
)
|
|
der_ocsp_resp_unauth = b"0\x03\n\x01\x06"
|
|
|
|
OCSP (Online Certificate Status Protocol) is a method of checking the
|
|
revocation status of certificates. It is specified in :rfc:`6960`, as well
|
|
as other obsoleted RFCs.
|
|
|
|
|
|
Loading Requests
|
|
~~~~~~~~~~~~~~~~
|
|
|
|
.. function:: load_der_ocsp_request(data)
|
|
|
|
.. versionadded:: 2.4
|
|
|
|
Deserialize an OCSP request from DER encoded data.
|
|
|
|
:param bytes data: The DER encoded OCSP request data.
|
|
|
|
:returns: An instance of :class:`~cryptography.x509.ocsp.OCSPRequest`.
|
|
|
|
.. doctest::
|
|
|
|
>>> from cryptography.x509 import ocsp
|
|
>>> ocsp_req = ocsp.load_der_ocsp_request(der_ocsp_req)
|
|
>>> print(ocsp_req.serial_number)
|
|
872625873161273451176241581705670534707360122361
|
|
|
|
|
|
Creating Requests
|
|
~~~~~~~~~~~~~~~~~
|
|
|
|
.. class:: OCSPRequestBuilder
|
|
|
|
.. versionadded:: 2.4
|
|
|
|
This class is used to create :class:`~cryptography.x509.ocsp.OCSPRequest`
|
|
objects.
|
|
|
|
|
|
.. method:: add_certificate(cert, issuer, algorithm)
|
|
|
|
Adds a request using a certificate, issuer certificate, and hash
|
|
algorithm. This can only be called once.
|
|
|
|
:param cert: The :class:`~cryptography.x509.Certificate` whose validity
|
|
is being checked.
|
|
|
|
:param issuer: The issuer :class:`~cryptography.x509.Certificate` of
|
|
the certificate that is being checked.
|
|
|
|
:param algorithm: A
|
|
:class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm`
|
|
instance. For OCSP only
|
|
:class:`~cryptography.hazmat.primitives.hashes.SHA1`,
|
|
:class:`~cryptography.hazmat.primitives.hashes.SHA224`,
|
|
:class:`~cryptography.hazmat.primitives.hashes.SHA256`,
|
|
:class:`~cryptography.hazmat.primitives.hashes.SHA384`, and
|
|
:class:`~cryptography.hazmat.primitives.hashes.SHA512` are allowed.
|
|
|
|
.. method:: add_extension(extension, critical)
|
|
|
|
Adds an extension to the request.
|
|
|
|
:param extension: An extension conforming to the
|
|
:class:`~cryptography.x509.ExtensionType` interface.
|
|
|
|
:param critical: Set to ``True`` if the extension must be understood and
|
|
handled.
|
|
|
|
.. method:: build()
|
|
|
|
:returns: A new :class:`~cryptography.x509.ocsp.OCSPRequest`.
|
|
|
|
.. doctest::
|
|
|
|
>>> from cryptography.hazmat.backends import default_backend
|
|
>>> from cryptography.hazmat.primitives import serialization
|
|
>>> from cryptography.hazmat.primitives.hashes import SHA1
|
|
>>> from cryptography.x509 import load_pem_x509_certificate, ocsp
|
|
>>> cert = load_pem_x509_certificate(pem_cert, default_backend())
|
|
>>> issuer = load_pem_x509_certificate(pem_issuer, default_backend())
|
|
>>> builder = ocsp.OCSPRequestBuilder()
|
|
>>> # SHA1 is in this example because RFC 5019 mandates its use.
|
|
>>> builder = builder.add_certificate(cert, issuer, SHA1())
|
|
>>> req = builder.build()
|
|
>>> base64.b64encode(req.public_bytes(serialization.Encoding.DER))
|
|
b'MEMwQTA/MD0wOzAJBgUrDgMCGgUABBRAC0Z68eay0wmDug1gfn5ZN0gkxAQUw5zz/NNGCDS7zkZ/oHxb8+IIy1kCAj8g'
|
|
|
|
Loading Responses
|
|
~~~~~~~~~~~~~~~~~
|
|
|
|
.. function:: load_der_ocsp_response(data)
|
|
|
|
.. versionadded:: 2.4
|
|
|
|
Deserialize an OCSP response from DER encoded data.
|
|
|
|
:param bytes data: The DER encoded OCSP response data.
|
|
|
|
:returns: An instance of :class:`~cryptography.x509.ocsp.OCSPResponse`.
|
|
|
|
.. doctest::
|
|
|
|
>>> from cryptography.x509 import ocsp
|
|
>>> ocsp_resp = ocsp.load_der_ocsp_response(der_ocsp_resp_unauth)
|
|
>>> print(ocsp_resp.response_status)
|
|
OCSPResponseStatus.UNAUTHORIZED
|
|
|
|
|
|
Creating Responses
|
|
~~~~~~~~~~~~~~~~~~
|
|
|
|
.. class:: OCSPResponseBuilder
|
|
|
|
.. versionadded:: 2.4
|
|
|
|
This class is used to create :class:`~cryptography.x509.ocsp.OCSPResponse`
|
|
objects. You cannot set ``produced_at`` on OCSP responses at this time.
|
|
Instead the field is set to current UTC time when calling ``sign``. For
|
|
unsuccessful statuses call the class method
|
|
:meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.build_unsuccessful`.
|
|
|
|
.. method:: add_response(cert, issuer, algorithm, cert_status, this_update, next_update, revocation_time, revocation_reason)
|
|
|
|
This method adds status information about the certificate that was
|
|
requested to the response.
|
|
|
|
:param cert: The :class:`~cryptography.x509.Certificate` whose validity
|
|
is being checked.
|
|
|
|
:param issuer: The issuer :class:`~cryptography.x509.Certificate` of
|
|
the certificate that is being checked.
|
|
|
|
:param algorithm: A
|
|
:class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm`
|
|
instance. For OCSP only
|
|
:class:`~cryptography.hazmat.primitives.hashes.SHA1`,
|
|
:class:`~cryptography.hazmat.primitives.hashes.SHA224`,
|
|
:class:`~cryptography.hazmat.primitives.hashes.SHA256`,
|
|
:class:`~cryptography.hazmat.primitives.hashes.SHA384`, and
|
|
:class:`~cryptography.hazmat.primitives.hashes.SHA512` are allowed.
|
|
|
|
:param cert_status: An item from the
|
|
:class:`~cryptography.x509.ocsp.OCSPCertStatus` enumeration.
|
|
|
|
:param this_update: A naïve :class:`datetime.datetime` object
|
|
representing the most recent time in UTC at which the status being
|
|
indicated is known by the responder to be correct.
|
|
|
|
:param next_update: A naïve :class:`datetime.datetime` object or
|
|
``None``. The time in UTC at or before which newer information will
|
|
be available about the status of the certificate.
|
|
|
|
:param revocation_time: A naïve :class:`datetime.datetime` object or
|
|
``None`` if the ``cert`` is not revoked. The time in UTC at which
|
|
the certificate was revoked.
|
|
|
|
:param revocation_reason: An item from the
|
|
:class:`~cryptography.x509.ReasonFlags` enumeration or ``None`` if
|
|
the ``cert`` is not revoked.
|
|
|
|
.. method:: certificates(certs)
|
|
|
|
Add additional certificates that should be used to verify the
|
|
signature on the response. This is typically used when the responder
|
|
utilizes an OCSP delegate.
|
|
|
|
:param list certs: A list of :class:`~cryptography.x509.Certificate`
|
|
objects.
|
|
|
|
.. method:: responder_id(encoding, responder_cert)
|
|
|
|
Set the ``responderID`` on the OCSP response. This is the data a
|
|
client will use to determine what certificate signed the response.
|
|
|
|
:param responder_cert: The :class:`~cryptography.x509.Certificate`
|
|
object for the certificate whose private key will sign the
|
|
OCSP response. If the certificate and key do not match an
|
|
error will be raised when calling ``sign``.
|
|
:param encoding: Either
|
|
:attr:`~cryptography.x509.ocsp.OCSPResponderEncoding.HASH` or
|
|
:attr:`~cryptography.x509.ocsp.OCSPResponderEncoding.NAME`.
|
|
|
|
.. method:: add_extension(extension, critical)
|
|
|
|
Adds an extension to the response.
|
|
|
|
:param extension: An extension conforming to the
|
|
:class:`~cryptography.x509.ExtensionType` interface.
|
|
|
|
:param critical: Set to ``True`` if the extension must be understood and
|
|
handled.
|
|
|
|
.. method:: sign(private_key, algorithm)
|
|
|
|
Creates the OCSP response that can then be serialized and sent to
|
|
clients. This method will create a
|
|
:attr:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL` response.
|
|
|
|
:param private_key: The
|
|
:class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
|
|
or
|
|
:class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey`
|
|
that will be used to sign the certificate.
|
|
|
|
:param algorithm: The
|
|
:class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm` that
|
|
will be used to generate the signature.
|
|
|
|
:returns: A new :class:`~cryptography.x509.ocsp.OCSPResponse`.
|
|
|
|
.. doctest::
|
|
|
|
>>> import datetime
|
|
>>> from cryptography.hazmat.backends import default_backend
|
|
>>> from cryptography.hazmat.primitives import hashes, serialization
|
|
>>> from cryptography.x509 import load_pem_x509_certificate, ocsp
|
|
>>> cert = load_pem_x509_certificate(pem_cert, default_backend())
|
|
>>> issuer = load_pem_x509_certificate(pem_issuer, default_backend())
|
|
>>> responder_cert = load_pem_x509_certificate(pem_responder_cert, default_backend())
|
|
>>> responder_key = serialization.load_pem_private_key(pem_responder_key, None, default_backend())
|
|
>>> builder = ocsp.OCSPResponseBuilder()
|
|
>>> # SHA1 is in this example because RFC 5019 mandates its use.
|
|
>>> builder = builder.add_response(
|
|
... cert=cert, issuer=issuer, algorithm=hashes.SHA1(),
|
|
... cert_status=ocsp.OCSPCertStatus.GOOD,
|
|
... this_update=datetime.datetime.now(),
|
|
... next_update=datetime.datetime.now(),
|
|
... revocation_time=None, revocation_reason=None
|
|
... ).responder_id(
|
|
... ocsp.OCSPResponderEncoding.HASH, responder_cert
|
|
... )
|
|
>>> response = builder.sign(responder_key, hashes.SHA256())
|
|
>>> response.certificate_status
|
|
<OCSPCertStatus.GOOD: 0>
|
|
|
|
.. classmethod:: build_unsuccessful(response_status)
|
|
|
|
Creates an unsigned OCSP response which can then be serialized and
|
|
sent to clients. ``build_unsuccessful`` may only be called with a
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus` that is not
|
|
``SUCCESSFUL``. Since this is a class method note that no other
|
|
methods can or should be called as unsuccessful statuses do not
|
|
encode additional data.
|
|
|
|
:returns: A new :class:`~cryptography.x509.ocsp.OCSPResponse`.
|
|
|
|
.. doctest::
|
|
|
|
>>> from cryptography.hazmat.backends import default_backend
|
|
>>> from cryptography.hazmat.primitives import hashes, serialization
|
|
>>> from cryptography.x509 import load_pem_x509_certificate, ocsp
|
|
>>> response = ocsp.OCSPResponseBuilder.build_unsuccessful(
|
|
... ocsp.OCSPResponseStatus.UNAUTHORIZED
|
|
... )
|
|
>>> response.response_status
|
|
<OCSPResponseStatus.UNAUTHORIZED: 6>
|
|
|
|
|
|
Interfaces
|
|
~~~~~~~~~~
|
|
|
|
.. class:: OCSPRequest
|
|
|
|
.. versionadded:: 2.4
|
|
|
|
An ``OCSPRequest`` is an object containing information about a certificate
|
|
whose status is being checked.
|
|
|
|
.. attribute:: issuer_key_hash
|
|
|
|
:type: bytes
|
|
|
|
The hash of the certificate issuer's key. The hash algorithm used
|
|
is defined by the ``hash_algorithm`` property.
|
|
|
|
.. attribute:: issuer_name_hash
|
|
|
|
:type: bytes
|
|
|
|
The hash of the certificate issuer's name. The hash algorithm used
|
|
is defined by the ``hash_algorithm`` property.
|
|
|
|
.. attribute:: hash_algorithm
|
|
|
|
:type: :class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm`
|
|
|
|
The algorithm used to generate the ``issuer_key_hash`` and
|
|
``issuer_name_hash``.
|
|
|
|
.. attribute:: serial_number
|
|
|
|
:type: int
|
|
|
|
The serial number of the certificate to check.
|
|
|
|
.. attribute:: extensions
|
|
|
|
:type: :class:`~cryptography.x509.Extensions`
|
|
|
|
The extensions encoded in the request.
|
|
|
|
.. method:: public_bytes(encoding)
|
|
|
|
:param encoding: The encoding to use. Only
|
|
:attr:`~cryptography.hazmat.primitives.serialization.Encoding.DER`
|
|
is supported.
|
|
|
|
:return bytes: The serialized OCSP request.
|
|
|
|
.. class:: OCSPResponse
|
|
|
|
.. versionadded:: 2.4
|
|
|
|
An ``OCSPResponse`` is the data provided by an OCSP responder in response
|
|
to an ``OCSPRequest``.
|
|
|
|
.. attribute:: response_status
|
|
|
|
:type: :class:`~cryptography.x509.ocsp.OCSPResponseStatus`
|
|
|
|
The status of the response.
|
|
|
|
.. attribute:: signature_algorithm_oid
|
|
|
|
:type: :class:`~cryptography.x509.ObjectIdentifier`
|
|
|
|
Returns the object identifier of the signature algorithm used
|
|
to sign the response. This will be one of the OIDs from
|
|
:class:`~cryptography.x509.oid.SignatureAlgorithmOID`.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: signature_hash_algorithm
|
|
|
|
.. versionadded:: 2.5
|
|
|
|
:type: :class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm`
|
|
|
|
Returns the
|
|
:class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm` which
|
|
was used in signing this response.
|
|
|
|
.. attribute:: signature
|
|
|
|
:type: bytes
|
|
|
|
The signature bytes.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: tbs_response_bytes
|
|
|
|
:type: bytes
|
|
|
|
The DER encoded bytes payload that is hashed and then signed. This
|
|
data may be used to validate the signature on the OCSP response.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: certificates
|
|
|
|
:type: list
|
|
|
|
A list of zero or more :class:`~cryptography.x509.Certificate` objects
|
|
used to help build a chain to verify the OCSP response. This situation
|
|
occurs when the OCSP responder uses a delegate certificate.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: responder_key_hash
|
|
|
|
:type: bytes or None
|
|
|
|
The responder's key hash or ``None`` if the response has a
|
|
``responder_name``.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: responder_name
|
|
|
|
:type: :class:`~cryptography.x509.Name` or None
|
|
|
|
The responder's ``Name`` or ``None`` if the response has a
|
|
``responder_key_hash``.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: produced_at
|
|
|
|
:type: :class:`datetime.datetime`
|
|
|
|
A naïve datetime representing the time when the response was produced.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: certificate_status
|
|
|
|
:type: :class:`~cryptography.x509.ocsp.OCSPCertStatus`
|
|
|
|
The status of the certificate being checked.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: revocation_time
|
|
|
|
:type: :class:`datetime.datetime` or None
|
|
|
|
A naïve datetime representing the time when the certificate was revoked
|
|
or ``None`` if the certificate has not been revoked.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: revocation_reason
|
|
|
|
:type: :class:`~cryptography.x509.ReasonFlags` or None
|
|
|
|
The reason the certificate was revoked or ``None`` if not specified or
|
|
not revoked.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: this_update
|
|
|
|
:type: :class:`datetime.datetime`
|
|
|
|
A naïve datetime representing the most recent time at which the status
|
|
being indicated is known by the responder to have been correct.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: next_update
|
|
|
|
:type: :class:`datetime.datetime`
|
|
|
|
A naïve datetime representing the time when newer information will
|
|
be available.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: issuer_key_hash
|
|
|
|
:type: bytes
|
|
|
|
The hash of the certificate issuer's key. The hash algorithm used
|
|
is defined by the ``hash_algorithm`` property.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: issuer_name_hash
|
|
|
|
:type: bytes
|
|
|
|
The hash of the certificate issuer's name. The hash algorithm used
|
|
is defined by the ``hash_algorithm`` property.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: hash_algorithm
|
|
|
|
:type: :class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm`
|
|
|
|
The algorithm used to generate the ``issuer_key_hash`` and
|
|
``issuer_name_hash``.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: serial_number
|
|
|
|
:type: int
|
|
|
|
The serial number of the certificate that was checked.
|
|
|
|
:raises ValueError: If ``response_status`` is not
|
|
:class:`~cryptography.x509.ocsp.OCSPResponseStatus.SUCCESSFUL`.
|
|
|
|
.. attribute:: extensions
|
|
|
|
:type: :class:`~cryptography.x509.Extensions`
|
|
|
|
The extensions encoded in the response.
|
|
|
|
.. method:: public_bytes(encoding)
|
|
|
|
:param encoding: The encoding to use. Only
|
|
:attr:`~cryptography.hazmat.primitives.serialization.Encoding.DER`
|
|
is supported.
|
|
|
|
:return bytes: The serialized OCSP response.
|
|
|
|
.. class:: OCSPResponseStatus
|
|
|
|
.. versionadded:: 2.4
|
|
|
|
An enumeration of response statuses.
|
|
|
|
.. attribute:: SUCCESSFUL
|
|
|
|
Represents a successful OCSP response.
|
|
|
|
.. attribute:: MALFORMED_REQUEST
|
|
|
|
May be returned by an OCSP responder that is unable to parse a
|
|
given request.
|
|
|
|
.. attribute:: INTERNAL_ERROR
|
|
|
|
May be returned by an OCSP responder that is currently experiencing
|
|
operational problems.
|
|
|
|
.. attribute:: TRY_LATER
|
|
|
|
May be returned by an OCSP responder that is overloaded.
|
|
|
|
.. attribute:: SIG_REQUIRED
|
|
|
|
May be returned by an OCSP responder that requires signed OCSP
|
|
requests.
|
|
|
|
.. attribute:: UNAUTHORIZED
|
|
|
|
May be returned by an OCSP responder when queried for a certificate for
|
|
which the responder is unaware or an issuer for which the responder is
|
|
not authoritative.
|
|
|
|
|
|
.. class:: OCSPCertStatus
|
|
|
|
.. versionadded:: 2.4
|
|
|
|
An enumeration of certificate statuses in an OCSP response.
|
|
|
|
.. attribute:: GOOD
|
|
|
|
The value for a certificate that is not revoked.
|
|
|
|
.. attribute:: REVOKED
|
|
|
|
The certificate being checked is revoked.
|
|
|
|
.. attribute:: UNKNOWN
|
|
|
|
The certificate being checked is not known to the OCSP responder.
|
|
|
|
.. class:: OCSPResponderEncoding
|
|
|
|
.. versionadded:: 2.4
|
|
|
|
An enumeration of ``responderID`` encodings that can be passed to
|
|
:meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.responder_id`.
|
|
|
|
.. attribute:: HASH
|
|
|
|
Encode the hash of the public key whose corresponding private key
|
|
signed the response.
|
|
|
|
.. attribute:: NAME
|
|
|
|
Encode the X.509 ``Name`` of the certificate whose private key signed
|
|
the response.
|