improved error and log messages

[sfa.git] / sfa / trust / certificate.py

diff --git a/sfa/trust/certificate.py b/sfa/trust/certificate.py
index 13f8975..8cbe172 100644 (file)
--- a/sfa/trust/certificate.py
+++ b/sfa/trust/certificate.py
@@ -480,6 +480,7 @@ class Certificate:
         else:\r
             setattr(subj, "CN", name)\r
         self.cert.set_subject(subj)\r
+\r
     ##\r
     # Get the subject name of the certificate\r
 \r
@@ -487,6 +488,13 @@ class Certificate:
         x = self.cert.get_subject()\r
         return getattr(x, which)\r
 \r
+    ##\r
+    # Get a pretty-print subject name of the certificate\r
+\r
+    def get_printable_subject(self):\r
+        x = self.cert.get_subject()\r
+        return "[ OU: %s, CN: %s, SubjectAltName: %s ]" % (getattr(x, "OU"), getattr(x, "CN"), self.get_data())\r
+\r
     ##\r
     # Get the public key of the certificate.\r
     #\r
@@ -689,31 +697,31 @@ class Certificate:
 \r
         # verify expiration time\r
         if self.cert.has_expired():\r
-            logger.debug("verify_chain: NO our certificate has expired")\r
-            raise CertExpired(self.get_subject(), "client cert")   \r
-        \r
+            logger.debug("verify_chain: NO our certificate %s has expired" % self.get_printable_subject())\r
+            raise CertExpired(self.get_printable_subject(), "client cert")\r
+\r
         # if this cert is signed by a trusted_cert, then we are set\r
         for trusted_cert in trusted_certs:\r
             if self.is_signed_by_cert(trusted_cert):\r
                 # verify expiration of trusted_cert ?\r
                 if not trusted_cert.cert.has_expired():\r
                     logger.debug("verify_chain: YES cert %s signed by trusted cert %s"%(\r
-                            self.get_subject(), trusted_cert.get_subject()))\r
+                            self.get_printable_subject(), trusted_cert.get_printable_subject()))\r
                     return trusted_cert\r
                 else:\r
                     logger.debug("verify_chain: NO cert %s is signed by trusted_cert %s, but this is expired..."%(\r
-                            self.get_subject(),trusted_cert.get_subject()))\r
-                    raise CertExpired(self.get_subject(),"trusted_cert %s"%trusted_cert.get_subject())\r
+                            self.get_printable_subject(),trusted_cert.get_printable_subject()))\r
+                    raise CertExpired(self.get_printable_subject()," signer trusted_cert %s"%trusted_cert.get_printable_subject())\r
 \r
         # if there is no parent, then no way to verify the chain\r
         if not self.parent:\r
-            logger.debug("verify_chain: NO %s has no parent and is not in trusted roots"%self.get_subject())\r
-            raise CertMissingParent(self.get_subject())\r
+            logger.debug("verify_chain: NO %s has no parent and issuer %s is not in %d trusted roots"%self.get_printable_subject(), self.get_issuer(), len(trusted_certs))\r
+            raise CertMissingParent(self.get_printable_subject(), "Non trusted issuer: %s out of %d trusted roots" % (self.get_issuer(), len(trusted_certs)))\r
 \r
         # if it wasn't signed by the parent...\r
         if not self.is_signed_by_cert(self.parent):\r
-            logger.debug("verify_chain: NO %s is not signed by parent"%self.get_subject())\r
-            return CertNotSignedByParent(self.get_subject())\r
+            logger.debug("verify_chain: NO %s is not signed by parent %s, but by %s"%self.get_printable_subject(), self.parent.get_printable_subject(), self.get_issuer())\r
+            return CertNotSignedByParent(self.get_printable_subject(), "parent %s, issuer %s" % (selr.parent.get_printable_subject(), self.get_issuer()))\r
 \r
         # Confirm that the parent is a CA. Only CAs can be trusted as\r
         # signers.\r
@@ -722,11 +730,11 @@ class Certificate:
         # Ugly - cert objects aren't parsed so we need to read the\r
         # extension and hope there are no other basicConstraints\r
         if not self.parent.isCA and not (self.parent.get_extension('basicConstraints') == 'CA:TRUE'):\r
-            logger.warn("verify_chain: cert %s's parent %s is not a CA" % (self.get_subject(), self.parent.get_subject()))\r
-            return CertNotSignedByParent(self.get_subject())\r
+            logger.warn("verify_chain: cert %s's parent %s is not a CA" % (self.get_printable_subject(), self.parent.get_printable_subject()))\r
+            return CertNotSignedByParent(self.get_printable_subject(), "Parent %s not a CA" % self.parent.get_printable_subject())\r
 \r
         # if the parent isn't verified...\r
-        logger.debug("verify_chain: .. %s, -> verifying parent %s"%(self.get_subject(),self.parent.get_subject()))\r
+        logger.debug("verify_chain: .. %s, -> verifying parent %s"%(self.get_printable_subject(),self.parent.get_printable_subject()))\r
         self.parent.verify_chain(trusted_certs)\r
 \r
         return\r
@@ -761,7 +769,7 @@ class Certificate:
 \r
     def dump_string (self,show_extensions=False):\r
         result = ""\r
-        result += "CERTIFICATE for %s\n"%self.get_subject()\r
+        result += "CERTIFICATE for %s\n"%self.get_printable_subject()\r
         result += "Issued by %s\n"%self.get_issuer()\r
         filename=self.get_filename()\r
         if filename: result += "Filename %s\n"%filename\r