Verifies the key usage extension in a CA cert.
The key usage extension, if present, must assert the keyCertSign bit.
The extended key usage extension is not checked (see CR 4776794 for
more information).
766132
static void verifyCAKeyUsage(X509Certificate cert)
            throws CertPathValidatorException {
        String msg = "CA key usage";
        if (debug != null) {
            debug.println("KeyChecker.verifyCAKeyUsage() ---checking " + msg
                          + "...");
        }

        boolean[] keyUsageBits = cert.getKeyUsage();

        // getKeyUsage returns null if the KeyUsage extension is not present
        // in the certificate - in which case there is nothing to check
        if (keyUsageBits == null) {
            return;
        }

        // throw an exception if the keyCertSign bit is not set
        if (!keyUsageBits[KEY_CERT_SIGN]) {
            throw new CertPathValidatorException
                (msg + " check failed: keyCertSign bit is not set", null,
                 null, -1, PKIXReason.INVALID_KEY_USAGE);
        }

        if (debug != null) {
            debug.println("KeyChecker.verifyCAKeyUsage() " + msg
                          + " verified.");
        }
    }
544187
def get_key():
    
    character_name = chr
    codes = _get_keycodes()
    if len(codes) == 1:
        code = codes[0]
        if code >= 32:
            return character_name(code)
        return control_key_name(code)
    return get_extended_key_name(codes)
48998
public static boolean isSelfSigned(X509Certificate cert) {
        try {
            cert.verify(cert.getPublicKey());
            return true;
        } catch (SignatureException e) {
            return false;
        } catch (InvalidKeyException e) {
            return false;
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
444565
public boolean hasUnsupportedCriticalExtension() {
        if (info == null)
            return false;
        try {
            CertificateExtensions exts = (CertificateExtensions)info.get(
                                         CertificateExtensions.NAME);
            if (exts == null)
                return false;
            return exts.hasUnsupportedCriticalExtension();
        } catch (Exception e) {
            return false;
        }
    }
663085
public static boolean isExtender(int ch)
   {
      return 0x00B7 == ch || 0x02D0 == ch || 0x02D1 == ch || 0x0387 == ch || 0x0640 == ch || 0x0E46 == ch
         || 0x0EC6 == ch || 0x3005 == ch || (0x3031 <= ch && ch <= 0x3035) || (0x309D <= ch && ch <= 0x309E)
         || (0x30FC <= ch && ch <= 0x30FE);
   }
736759
def active_cert(key):
    
    try:
        cert_str = pem_format(key)
        cert = crypto.load_certificate(crypto.FILETYPE_PEM, cert_str)
        assert cert.has_expired() == 0
        assert not OpenSSLWrapper().certificate_not_valid_yet(cert)
        return True
    except AssertionError:
        return False
    except AttributeError:
        return False
482251
private void doCustomServerIdentityCheck(X509Certificate cert) throws CertificateException{
		if (EndpointIdentificationAlgorithm.APIS == identityAlg) {
			APINameChecker.verifyAndThrow(trustedNameSet, cert);
		}
	}
748085
def _VerifyExtensionHandle(message, extension_handle):
  """"""

  if not isinstance(extension_handle, _FieldDescriptor):
    raise KeyError('HasExtension() expects an extension handle, got: %s' %
                   extension_handle)

  if not extension_handle.is_extension:
    raise KeyError('"%s" is not an extension.' % extension_handle.full_name)

  if not extension_handle.containing_type:
    raise KeyError('"%s" is missing a containing_type.'
                   % extension_handle.full_name)

  if extension_handle.containing_type is not message.DESCRIPTOR:
    raise KeyError('Extension "%s" extends message type "%s", but this '
                   'message is of type "%s".' %
                   (extension_handle.full_name,
                    extension_handle.containing_type.full_name,
                    message.DESCRIPTOR.full_name))
562671
def get_cert_profile_kwargs(name=None):
    """"""

    if name is None:
        name = ca_settings.CA_DEFAULT_PROFILE

    profile = deepcopy(ca_settings.CA_PROFILES[name])
    kwargs = {
        'cn_in_san': profile['cn_in_san'],
        'subject': get_default_subject(name=name),
    }

    key_usage = profile.get('keyUsage')
    if key_usage and key_usage.get('value'):
        kwargs['key_usage'] = KeyUsage(key_usage)
    ext_key_usage = profile.get('extendedKeyUsage')
    if ext_key_usage and ext_key_usage.get('value'):
        kwargs['extended_key_usage'] = ExtendedKeyUsage(ext_key_usage)
    tls_feature = profile.get('TLSFeature')
    if tls_feature and tls_feature.get('value'):
        kwargs['tls_feature'] = TLSFeature(tls_feature)
    if profile.get('ocsp_no_check'):
        kwargs['ocsp_no_check'] = profile['ocsp_no_check']

    return kwargs
1260075
public boolean[] getKeyUsage() {
        try {
            String extAlias = OIDMap.getName(PKIXExtensions.KeyUsage_Id);
            if (extAlias == null)
                return null;

            KeyUsageExtension certExt = (KeyUsageExtension)this.get(extAlias);
            if (certExt == null)
                return null;

            boolean[] ret = certExt.getBits();
            if (ret.length < NUM_STANDARD_KEY_USAGE) {
                boolean[] usageBits = new boolean[NUM_STANDARD_KEY_USAGE];
                System.arraycopy(ret, 0, usageBits, 0, ret.length);
                ret = usageBits;
            }
            return ret;
        } catch (Exception e) {
            return null;
        }
    }
613189
def add_extensions(cert)
      factory = OpenSSL::X509::ExtensionFactory.new
      factory.issuer_certificate = Billy.certificate_authority.cert
      factory.subject_certificate = cert
      extensions.each do |ln_sn, value, critical|
        cert.add_extension(factory.create_extension(ln_sn, value, critical))
      end
    end
338556
def sample_verify_callback(is_ok, ctx)
    unless is_ok
      depth = ctx.error_depth
      code = ctx.error
      msg = ctx.error_string
      STDERR.puts "at depth #{depth} - #{code}: #{msg}" if $DEBUG
      return false
    end

    cert = ctx.current_cert
    self_signed = false
    ca = false
    pathlen = nil
    server_auth = true
    self_signed = (cert.subject.cmp(cert.issuer) == 0)

    # Check extensions whatever its criticality is. (sample)
    cert.extensions.each do |ex|
      case ex.oid
      when 'basicConstraints'
        /CA:(TRUE|FALSE), pathlen:(\d+)/ =~ ex.value
        ca = ($1 == 'TRUE')
        pathlen = $2.to_i
      when 'keyUsage'
        usage = ex.value.split(/\s*,\s*/)
        ca = usage.include?('Certificate Sign')
        server_auth = usage.include?('Key Encipherment')
      when 'extendedKeyUsage'
        usage = ex.value.split(/\s*,\s*/)
        server_auth = usage.include?('Netscape Server Gated Crypto')
      when 'nsCertType'
        usage = ex.value.split(/\s*,\s*/)
        ca = usage.include?('SSL CA')
        server_auth = usage.include?('SSL Server')
      end
    end

    if self_signed
      STDERR.puts 'self signing CA' if $DEBUG
      return true
    elsif ca
      STDERR.puts 'middle level CA' if $DEBUG
      return true
    elsif server_auth
      STDERR.puts 'for server authentication' if $DEBUG
      return true
    end

    return false
  end
1330681
def validate_certificate(self, cert):
        
        store_ctx = X509.X509_Store_Context(_m2ext.x509_store_ctx_new(), _pyfree=1)
        _m2ext.x509_store_ctx_init(store_ctx.ctx,
                                   self.get_cert_store().store,
                                   cert.x509, None)
        rc = _m2ext.x509_verify_cert(store_ctx.ctx)
        if rc < 0:
            raise SSL.SSLError("Empty context")
        return rc != 0
538533
private void checkCertForClientUsage(X509Certificate clientCert) {
        try {
            // We required that the extended key usage must be present if we are using
            // client cert authentication
            if (extendedClientCheck &&
                (clientCert.getExtendedKeyUsage() == null ||
                 !clientCert.getExtendedKeyUsage().contains(CLIENTAUTH_OID))) {
                throw new SecurityException("No extended key usage available");
            }
        } catch (CertificateParsingException e) {
            throw new SecurityException("Can't parse client cert");
        }
    }
1024766
private static boolean isRequiredKeyLengthAllowed() {
		try {
			int requiredKeyLengthBits = KEY_LEN_BYTES * Byte.SIZE;
			int allowedKeyLengthBits = Cipher.getMaxAllowedKeyLength(ENC_ALG);
			return allowedKeyLengthBits >= requiredKeyLengthBits;
		} catch (NoSuchAlgorithmException e) {
			throw new IllegalStateException("Hard-coded algorithm \"" + ENC_ALG + "\" not supported.", e);
		}
	}
370505
def verifyCert(self, cert):
        
        tbsCert = cert.tbsCertificate
        sigAlg = tbsCert.signature
        h = hash_by_oid[sigAlg.algorithm.val]
        sigVal = raw(cert.signatureValue)
        return self.verify(raw(tbsCert), sigVal, h=h, t='pkcs')
1305317
public Sign setCertificate(Certificate certificate) {
		// If the certificate is of type X509Certificate,
		// we should check whether it has a Key Usage
		// extension marked as critical.
		if (certificate instanceof X509Certificate) {
			// Check whether the cert has a key usage extension
			// marked as a critical extension.
			// The OID for KeyUsage extension is 2.5.29.15.
			final X509Certificate cert = (X509Certificate) certificate;
			final Set<String> critSet = cert.getCriticalExtensionOIDs();

			if (CollUtil.isNotEmpty(critSet) && critSet.contains("2.5.29.15")) {
				final boolean[] keyUsageInfo = cert.getKeyUsage();
				// keyUsageInfo[0] is for digitalSignature.
				if ((keyUsageInfo != null) && (keyUsageInfo[0] == false)) {
					throw new CryptoException("Wrong key usage");
				}
			}
		}
		this.publicKey = certificate.getPublicKey();
		return this;
	}