else:\r
setattr(subj, "CN", name)\r
self.cert.set_subject(subj)\r
+\r
##\r
# Get the subject name of the certificate\r
\r
x = self.cert.get_subject()\r
return getattr(x, which)\r
\r
+ ##\r
+ # Get a pretty-print subject name of the certificate\r
+\r
+ def get_printable_subject(self):\r
+ x = self.cert.get_subject()\r
+ return "[ OU: %s, CN: %s, SubjectAltName: %s ]" % (getattr(x, "OU"), getattr(x, "CN"), self.get_data())\r
+\r
##\r
# Get the public key of the certificate.\r
#\r
\r
# verify expiration time\r
if self.cert.has_expired():\r
- logger.debug("verify_chain: NO our certificate has expired")\r
- raise CertExpired(self.get_subject(), "client cert") \r
- \r
+ logger.debug("verify_chain: NO our certificate %s has expired" % self.get_printable_subject())\r
+ raise CertExpired(self.get_printable_subject(), "client cert")\r
+\r
# if this cert is signed by a trusted_cert, then we are set\r
for trusted_cert in trusted_certs:\r
if self.is_signed_by_cert(trusted_cert):\r
# verify expiration of trusted_cert ?\r
if not trusted_cert.cert.has_expired():\r
logger.debug("verify_chain: YES cert %s signed by trusted cert %s"%(\r
- self.get_subject(), trusted_cert.get_subject()))\r
+ self.get_printable_subject(), trusted_cert.get_printable_subject()))\r
return trusted_cert\r
else:\r
logger.debug("verify_chain: NO cert %s is signed by trusted_cert %s, but this is expired..."%(\r
- self.get_subject(),trusted_cert.get_subject()))\r
- raise CertExpired(self.get_subject(),"trusted_cert %s"%trusted_cert.get_subject())\r
+ self.get_printable_subject(),trusted_cert.get_printable_subject()))\r
+ raise CertExpired(self.get_printable_subject()," signer trusted_cert %s"%trusted_cert.get_printable_subject())\r
\r
# if there is no parent, then no way to verify the chain\r
if not self.parent:\r
- logger.debug("verify_chain: NO %s has no parent and is not in trusted roots"%self.get_subject())\r
- raise CertMissingParent(self.get_subject())\r
+ logger.debug("verify_chain: NO %s has no parent and issuer %s is not in %d trusted roots"%self.get_printable_subject(), self.get_issuer(), len(trusted_certs))\r
+ raise CertMissingParent(self.get_printable_subject(), "Non trusted issuer: %s out of %d trusted roots" % (self.get_issuer(), len(trusted_certs)))\r
\r
# if it wasn't signed by the parent...\r
if not self.is_signed_by_cert(self.parent):\r
- logger.debug("verify_chain: NO %s is not signed by parent"%self.get_subject())\r
- return CertNotSignedByParent(self.get_subject())\r
+ logger.debug("verify_chain: NO %s is not signed by parent %s, but by %s"%self.get_printable_subject(), self.parent.get_printable_subject(), self.get_issuer())\r
+ return CertNotSignedByParent(self.get_printable_subject(), "parent %s, issuer %s" % (selr.parent.get_printable_subject(), self.get_issuer()))\r
\r
# Confirm that the parent is a CA. Only CAs can be trusted as\r
# signers.\r
# Ugly - cert objects aren't parsed so we need to read the\r
# extension and hope there are no other basicConstraints\r
if not self.parent.isCA and not (self.parent.get_extension('basicConstraints') == 'CA:TRUE'):\r
- logger.warn("verify_chain: cert %s's parent %s is not a CA" % (self.get_subject(), self.parent.get_subject()))\r
- return CertNotSignedByParent(self.get_subject())\r
+ logger.warn("verify_chain: cert %s's parent %s is not a CA" % (self.get_printable_subject(), self.parent.get_printable_subject()))\r
+ return CertNotSignedByParent(self.get_printable_subject(), "Parent %s not a CA" % self.parent.get_printable_subject())\r
\r
# if the parent isn't verified...\r
- logger.debug("verify_chain: .. %s, -> verifying parent %s"%(self.get_subject(),self.parent.get_subject()))\r
+ logger.debug("verify_chain: .. %s, -> verifying parent %s"%(self.get_printable_subject(),self.parent.get_printable_subject()))\r
self.parent.verify_chain(trusted_certs)\r
\r
return\r
\r
def dump_string (self,show_extensions=False):\r
result = ""\r
- result += "CERTIFICATE for %s\n"%self.get_subject()\r
+ result += "CERTIFICATE for %s\n"%self.get_printable_subject()\r
result += "Issued by %s\n"%self.get_issuer()\r
filename=self.get_filename()\r
if filename: result += "Filename %s\n"%filename\r