misc.py 文件源码

def check_ca(cert):
        """Check if 'cert' is a proper CA. For this the BasicConstraints need to
        identify it as a CA cert and it needs to have the CertSign
        (key_cert_sign in Cryptography) KeyUsage flag. Based loosely on
        OpenSSL's check_ca()"""

        from cryptography import x509

        bconst_ca = None
        kuse_sign = None

        for e in cert.extensions:
                if isinstance(e.value, x509.BasicConstraints):
                        bconst_ca = e.value.ca
                elif isinstance(e.value, x509.KeyUsage):
                        kuse_sign = e.value.key_cert_sign

        return kuse_sign is not False and bconst_ca