Return the AuthorityKeyIdentifier extension used in certificates signed by this CA.
178393
def get_authority_key_identifier(self):
        """"""

        try:
            ski = self.x509.extensions.get_extension_for_class(x509.SubjectKeyIdentifier)
        except x509.ExtensionNotFound:
            return x509.AuthorityKeyIdentifier.from_issuer_public_key(self.x509.public_key())
        else:
            return x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski)
613674
def ClientCertFromCSR(cls, csr):
    
    builder = x509.CertificateBuilder()
    # Use the client CN for a cert serial_id. This will ensure we do
    # not have clashing cert id.
    common_name = csr.GetCN()
    serial = int(common_name.split(".")[1], 16)
    builder = builder.serial_number(serial)
    builder = builder.subject_name(
        x509.Name(
            [x509.NameAttribute(oid.NameOID.COMMON_NAME, str(common_name))]))

    now = rdfvalue.RDFDatetime.Now()
    now_plus_year = now + rdfvalue.Duration("52w")
    builder = builder.not_valid_after(now_plus_year.AsDatetime())
    now_minus_ten = now - rdfvalue.Duration("10s")
    builder = builder.not_valid_before(now_minus_ten.AsDatetime())
    # TODO(user): dependency loop with
    # grr/core/grr_response_core/config/client.py.
    # pylint: disable=protected-access
    ca_cert = config_lib._CONFIG["CA.certificate"]
    # pylint: enable=protected-access
    builder = builder.issuer_name(ca_cert.GetIssuer())
    builder = builder.public_key(csr.GetPublicKey().GetRawPublicKey())

    # TODO(user): dependency loop with
    # grr/core/grr_response_core/config/client.py.
    # pylint: disable=protected-access
    ca_key = config_lib._CONFIG["PrivateKeys.ca_key"]
    # pylint: enable=protected-access

    return RDFX509Cert(
        builder.sign(
            private_key=ca_key.GetRawPrivateKey(),
            algorithm=hashes.SHA256(),
            backend=openssl.backend))
357981
public function authorityKeyIdentifier(): Ext\AuthorityKeyIdentifierExtension
    {
        /** @var Extension\AuthorityKeyIdentifierExtension $keyIdentifier */
        $keyIdentifier = $this->get(Ext\Extension::OID_AUTHORITY_KEY_IDENTIFIER);
        return $keyIdentifier;
    }
547273
def _authn_context_decl(decl, authn_auth=None):
    
    return factory(saml.AuthnContext,
                   authn_context_decl=decl,
                   authenticating_authority=factory(
                       saml.AuthenticatingAuthority, text=authn_auth))
1365615
public ServiceFuture<CertificateBundle> getCertificateAsync(String certificateIdentifier,
            final ServiceCallback<CertificateBundle> serviceCallback) {
        CertificateIdentifier id = new CertificateIdentifier(certificateIdentifier);
        return getCertificateAsync(id.vault(), id.name(), id.version() == null ? "" : id.version(), serviceCallback);
    }
224128
def get_certificate(self, certificate_id):
        
        api = self._get_api(iam.DeveloperApi)
        certificate = Certificate(api.get_certificate(certificate_id))
        self._extend_certificate(certificate)
        return certificate
1130914
function loadCA($cert)
    {
        $olddn = $this->dn;
        $oldcert = $this->currentCert;
        $oldsigsubj = $this->signatureSubject;

        $cert = $this->loadX509($cert);
        if (!$cert) {
            $this->dn = $olddn;
            $this->currentCert = $oldcert;
            $this->signatureSubject = $oldsigsubj;

            return false;
        }

        /* From RFC5280 "PKIX Certificate and CRL Profile":

           If the keyUsage extension is present, then the subject public key
           MUST NOT be used to verify signatures on certificates or CRLs unless
           the corresponding keyCertSign or cRLSign bit is set. */
        //$keyUsage = $this->getExtension('id-ce-keyUsage');
        //if ($keyUsage && !in_array('keyCertSign', $keyUsage)) {
        //    return false;
        //}

        /* From RFC5280 "PKIX Certificate and CRL Profile":

           The cA boolean indicates whether the certified public key may be used
           to verify certificate signatures.  If the cA boolean is not asserted,
           then the keyCertSign bit in the key usage extension MUST NOT be
           asserted.  If the basic constraints extension is not present in a
           version 3 certificate, or the extension is present but the cA boolean
           is not asserted, then the certified public key MUST NOT be used to
           verify certificate signatures. */
        //$basicConstraints = $this->getExtension('id-ce-basicConstraints');
        //if (!$basicConstraints || !$basicConstraints['cA']) {
        //    return false;
        //}

        $this->CAs[] = $cert;

        $this->dn = $olddn;
        $this->currentCert = $oldcert;
        $this->signatureSubject = $oldsigsubj;

        return true;
    }
599368
public function extendedKeyUsage(): Ext\ExtendedKeyUsageExtension
    {
        /** @var Extension\ExtendedKeyUsageExtension $keyUsage */
        $keyUsage = $this->get(Ext\Extension::OID_EXT_KEY_USAGE);
        return $keyUsage;
    }
234616
function proprietaryCertificate() {
	var self = {
		__TYPE__ : CertificateType.CERT_CHAIN_VERSION_1,
		dwSigAlgId : new type.UInt32Le(0x00000001, { constant : true }),
        dwKeyAlgId : new type.UInt32Le(0x00000001, { constant : true }),
        wPublicKeyBlobType : new type.UInt16Le(0x0006, { constant : true }),
        wPublicKeyBlobLen : new type.UInt16Le(function() {
        	return self.PublicKeyBlob.size();
        }),
        PublicKeyBlob : rsaPublicKey({ readLength : new type.CallableValue(function() {
        	return self.wPublicKeyBlobLen.value;
        }) }),
        wSignatureBlobType : new type.UInt16Le(0x0008, { constant : true }),
        wSignatureBlobLen : new type.UInt16Le(function() {
        	return self.SignatureBlob.size() + self.padding.size();
        }),
        SignatureBlob : new type.BinaryString(null, { readLength : new type.CallableValue(function() {
        	return self.wSignatureBlobLen.value - self.padding.size;
        }) }),
        padding : new type.BinaryString(Array(8 + 1).join('\x00'), { readLength : new type.CallableValue(8) }),
        /**
         * @return {object} rsa.publicKey
         */
        getPublicKey : function() {
        	return rsa.publicKey(self.PublicKeyBlob.obj.modulus.value, self.PublicKeyBlob.obj.pubExp.value);
        }
	};
	
	return new type.Component(self);
}
899038
static boolean certCanSignCrl(X509Certificate cert) {
        // if the cert doesn't include the key usage ext, or
        // the key usage ext asserts cRLSigning, return true,
        // otherwise return false.
        boolean[] keyUsage = cert.getKeyUsage();
        if (keyUsage != null) {
            return keyUsage[6];
        }
        return false;
    }
766132
static void verifyCAKeyUsage(X509Certificate cert)
            throws CertPathValidatorException {
        String msg = "CA key usage";
        if (debug != null) {
            debug.println("KeyChecker.verifyCAKeyUsage() ---checking " + msg
                          + "...");
        }

        boolean[] keyUsageBits = cert.getKeyUsage();

        // getKeyUsage returns null if the KeyUsage extension is not present
        // in the certificate - in which case there is nothing to check
        if (keyUsageBits == null) {
            return;
        }

        // throw an exception if the keyCertSign bit is not set
        if (!keyUsageBits[KEY_CERT_SIGN]) {
            throw new CertPathValidatorException
                (msg + " check failed: keyCertSign bit is not set", null,
                 null, -1, PKIXReason.INVALID_KEY_USAGE);
        }

        if (debug != null) {
            debug.println("KeyChecker.verifyCAKeyUsage() " + msg
                          + " verified.");
        }
    }
1089811
def subject_key_identifier(self):
        """"""
        try:
            ext = self.x509.extensions.get_extension_for_oid(ExtensionOID.SUBJECT_KEY_IDENTIFIER)
        except x509.ExtensionNotFound:
            return None
        return SubjectKeyIdentifier(ext)
1322031
public X509CRLEntry getRevokedCertificate(X509Certificate cert) {
        if (revokedMap.isEmpty()) {
            return null;
        }
        X509IssuerSerial issuerSerial = new X509IssuerSerial(cert);
        return revokedMap.get(issuerSerial);
    }
429054
private static function _getCertKeyId(Certificate $cert): string
    {
        $exts = $cert->tbsCertificate()->extensions();
        if ($exts->hasSubjectKeyIdentifier()) {
            return $exts->subjectKeyIdentifier()->keyIdentifier();
        }
        return $cert->tbsCertificate()
            ->subjectPublicKeyInfo()
            ->keyIdentifier();
    }
74621
@Override
	public Certificate engineGetCertificate(String s) {
		ResourceTrustAnchor trustAnchor = getCertificateEntry(s);
		if (trustAnchor != null) {
			try {
				return trustAnchor.getTrustAnchor().getTrustedCert();
			} catch (ResourceStoreException e) {
				return null;
			}
		}
		return null;
	}
488458
public static ExtendedKeyUsage getExtendedKeyUsage(Set<String> usages)
    {
        KeyPurposeId[] keyUsages = new KeyPurposeId[usages.size()];
        int i = 0;

        for (String usage : usages) {
            keyUsages[i++] = KeyPurposeId.getInstance(new ASN1ObjectIdentifier(usage));
        }

        return new ExtendedKeyUsage(keyUsages);
    }
472470
@JsonIgnore
    public String getEncryptionCertificateDecoded() {
        if (EncodingUtils.isBase64(encryptionCertificate)) {
            return EncodingUtils.decodeBase64ToString(encryptionCertificate);
        }
        return encryptionCertificate;
    }