Coverage for pki_tools/funcs/check_revocation.py: 88%

1from loguru import logger 

2 

3from pki_tools.crl import _is_revoked 

4from pki_tools.exceptions import ( 

5 Error, 

6 ExtensionMissing, 

7 OcspFetchFailure, 

8 OcspInvalidResponseStatus, 

9 OcspIssuerFetchFailure, 

10 RevokeCheckFailed, 

11) 

12from pki_tools.ocsp import _is_revoked_multiple_issuers 

13from pki_tools.types.certificate import Certificate 

14from pki_tools.types.chain import Chain 

15from pki_tools.types.enums import RevokeMode 

16 

17 

18def is_revoked( 

19 cert: Certificate, 

20 chain: Chain, 

21 crl_cache_seconds: int = 3600, 

22 ocsp_res_cache_seconds: int = 3600, 

23 revoke_mode: RevokeMode = RevokeMode.OCSP_FALLBACK_CRL, 

24 same_crl_domains: list[list[str]] | None = None, 

25) -> bool: 

26 """ 

27 Checks if a certificate is revoked using OCSP extension and/or 

28 CRL extension. 

29 

30 By default, the OCSP is checked first with a fallback to CRL. If you 

31 only want to check OCSP or only CRL set the "revoke_mode" to either 

32 [RevokeMode.OCSP_ONLY][pki_tools.types.enums.RevokeMode] or 

33 [RevokeMode.CRL_ONLY][pki_tools.types.enums.RevokeMode] 

34 

35 Arguments: 

36 cert: The [Certificate][pki_tools.types.certificate.Certificate] 

37 to check revocation for. 

38 chain: The CA chain including one or more certificates and 

39 the issuer of the `cert`, signer of the OCSP response and CRL 

40 issuer. See [Loading Chain][pki_tools.types.chain.Chain] for 

41 examples how the chain can be created 

42 crl_cache_seconds: [CRL Only] Specifies how long the CRL should 

43 be cached, default is 1 hour. 

44 ocsp_res_cache_seconds: [OCSP Only] Specifies how long the OCSP 

45 response should be cached, default is 1 hour. 

46 revoke_mode: A [RevokeMode][pki_tools.types.enums.RevokeMode] 

47 specifying how to check for revocation, default is OCSP with 

48 CRL fallback 

49 same_crl_domains: A list of lists of domains that are considered 

50 to be the same hostname in CRL IDP and cert CDP check. 

51 

52 

53 Returns: 

54 True if the certificate is revoked, False otherwise 

55 

56 Raises: 

57 SignatureVerificationFailed: When the Chain contains more than one 

58 certificate and the trust fails either because of some certificate 

59 has expired or some signature in the chain is invalid 

60 RevokeCheckFailed: When both OCSP and CRL checks fail 

61 

62 --8<-- "docs/examples/check_revocation.md" 

63 """ 

64 return is_revoked_multiple_issuers( 

65 cert, 

66 chain, 

67 chain, 

68 chain, 

69 crl_cache_seconds=crl_cache_seconds, 

70 ocsp_res_cache_seconds=ocsp_res_cache_seconds, 

71 revoke_mode=revoke_mode, 

72 same_crl_domains=same_crl_domains, 

73 ) 

74 

75 

76def is_revoked_multiple_issuers( 

77 cert: Certificate, 

78 cert_issuer: Chain, 

79 ocsp_issuer: Chain, 

80 crl_issuer: Chain, 

81 crl_cache_seconds: int = 3600, 

82 ocsp_res_cache_seconds: int = 3600, 

83 revoke_mode: RevokeMode = RevokeMode.OCSP_FALLBACK_CRL, 

84 same_crl_domains: list[list[str]] | None = None, 

85) -> bool: 

86 """ 

87 Checks if a certificate is revoked first using the OCSP extension and then 

88 the CRL extensions. 

89 

90 Note that OCSP has precedence over CRL meaning that if OCSP check is 

91 successful this function will return the bool without checking CRL. 

92 

93 Otherwise, if OCSP check fails, CRL will be tried next. 

94 

95 Arguments: 

96 cert: The [Certificate][pki_tools.types.certificate.Certificate] 

97 to check revocation for. 

98 cert_issuer: The CA chain including one or more certificates and 

99 the issuer of the `cert`. See [Loading Chain][pki_tools.types.chain.Chain] 

100 for examples how the chain can be created. 

101 ocsp_issuer: The CA chain including one or more certificates used 

102 for signing of the OCSP response 

103 crl_issuer: The CA chain including one or more certificates used 

104 for signing the CRL 

105 crl_cache_seconds: [CRL Only] Specifies how long the CRL should 

106 be cached, default is 1 hour. 

107 ocsp_res_cache_seconds: [OCSP Only] Specifies how long the OCSP 

108 response should be cached, default is 1 hour. 

109 revoke_mode: A [RevokeMode][pki_tools.types.enums.RevokeMode] 

110 specifying how to check for revocation, default is OCSP with 

111 CRL fallback 

112 same_crl_domains: A list of lists of domains that are considered 

113 to be the same hostname in CRL IDP and cert CDP check. 

114 

115 Returns: 

116 True if the certificate is revoked, False otherwise 

117 

118 Raises: 

119 SignatureVerificationFailed: When the Chain contains more than one 

120 certificate and the trust fails either because of some certificate 

121 has expired or some signature in the chain is invalid 

122 RevokeCheckFailed: When both OCSP and CRL checks fail 

123 """ 

124 if revoke_mode != RevokeMode.CRL_ONLY: 

125 try: 

126 return _is_revoked_multiple_issuers( 

127 cert, 

128 cert_issuer, 

129 ocsp_issuer, 

130 ocsp_res_cache_seconds=ocsp_res_cache_seconds, 

131 ) 

132 except ( 

133 ExtensionMissing, 

134 OcspInvalidResponseStatus, 

135 OcspFetchFailure, 

136 OcspIssuerFetchFailure, 

137 ) as e: 

138 if revoke_mode == RevokeMode.OCSP_ONLY: 

139 err_msg = "OCSP revoke check failed" 

140 logger.bind(exceptionType=type(e).__name__).error(err_msg) 

141 raise RevokeCheckFailed(err_msg) from None 

142 

143 err_msg = "OCSP revoke check failed, trying CRL next" 

144 logger.bind(exceptionType=type(e).__name__).debug(err_msg) 

145 

146 try: 

147 return _is_revoked( 

148 cert, 

149 crl_issuer, 

150 crl_cache_seconds, 

151 same_crl_domains=same_crl_domains, 

152 ) 

153 except Error as e: 

154 err_message = "Revoke checks failed" 

155 logger.bind(exceptionType=type(e).__name__).error(err_message) 

156 raise RevokeCheckFailed(err_message) from None