.. versionadded:: 2.2.0

		:return: Return a tuple of :py:class:`~.SSLSNICertificate` instances for each of the certificates that are configured.
		:rtype: tuple
967403
def sni_certs(self):
		
		if not g_ssl_has_server_sni or self._ssl_sni_entries is None:
			return tuple()
		return tuple(entry.certificate for entry in self._ssl_sni_entries.values())
34308
def authenticate_with_certificate(reactor, base_url, client_cert, client_key, ca_cert):
    
    return authenticate_with_certificate_chain(
        reactor, base_url, [client_cert], client_key, ca_cert,
    )
83191
def get_config(self):
        
        self.create_ssl_certs()

        config = {
            "bootstrap_servers": self.get_brokers(),
            "security_protocol": 'SSL',
            "ssl_cafile": self.ssl["ca"]["file"].name,
            "ssl_certfile": self.ssl["cert"]["file"].name,
            "ssl_keyfile": self.ssl["key"]["file"].name,
            "ssl_check_hostname": False,
            "ssl_password": None
        }
        self.config.update(config)
186073
private X509Certificate []getClientCertificatesImpl()
    throws CertificateException
  {
    if (! (_s instanceof SSLSocket))
      return null;
    
    SSLSocket sslSocket = (SSLSocket) _s;

    SSLSession sslSession = sslSocket.getSession();
    if (sslSession == null)
      return null;

    try {
      return (X509Certificate []) sslSession.getPeerCertificates();
    } catch (SSLPeerUnverifiedException e) {
      if (log.isLoggable(Level.FINEST))
        log.log(Level.FINEST, e.toString(), e);
      
      return null;
    } catch (Throwable e) {
      log.log(Level.FINER, e.toString(), e);
    }
    
    return null;
  }
1066681
def create_ssl_certs(self):
        
        for key, file in self.ssl.items():
            file["file"] = self.create_temp_file(file["suffix"], file["content"])
412378
private Collection<X509Certificate> getMatchingCACerts
        (ReverseState currentState, List<CertStore> certStores)
        throws CertificateException, CertStoreException, IOException {

        /*
         * Compose a CertSelector to filter out
         * certs which do not satisfy requirements.
         */
        X509CertSelector sel = new X509CertSelector();

        /*
         * Match on issuer (subject of previous cert)
         */
        sel.setIssuer(currentState.subjectDN);

        /*
         * Match on certificate validity date.
         */
        sel.setCertificateValid(buildParams.date());

        /*
         * Match on target subject name (checks that current cert's
         * name constraints permit it to certify target).
         * (4 is the integer type for DIRECTORY name).
         */
        byte[] subject = targetCertConstraints.getSubjectAsBytes();
        if (subject != null) {
            sel.addPathToName(4, subject);
        } else {
            X509Certificate cert = targetCertConstraints.getCertificate();
            if (cert != null) {
                sel.addPathToName(4,
                                  cert.getSubjectX500Principal().getEncoded());
            }
        }

        /*
         * Policy processing optimizations
         */
        if (currentState.explicitPolicy == 0)
            sel.setPolicy(getMatchingPolicies());

        /*
         * If previous cert has a subject key identifier extension,
         * use it to match on authority key identifier extension.
         */
        /*if (currentState.subjKeyId != null) {
          AuthorityKeyIdentifierExtension authKeyId = new AuthorityKeyIdentifierExtension(
                (KeyIdentifier) currentState.subjKeyId.get(SubjectKeyIdentifierExtension.KEY_ID),
                                null, null);
          sel.setAuthorityKeyIdentifier(authKeyId.getExtensionValue());
        }*/

        /*
         * Require CA certs
         */
        sel.setBasicConstraints(0);

        /* Retrieve matching certs from CertStores */
        ArrayList<X509Certificate> reverseCerts = new ArrayList<>();
        addMatchingCerts(sel, certStores, reverseCerts, true);

        /* Sort remaining certs using name constraints */
        Collections.sort(reverseCerts, new PKIXCertComparator());

        if (debug != null)
            debug.println("ReverseBuilder.getMatchingCACerts got " +
                          reverseCerts.size() + " certs.");
        return reverseCerts;
    }
613674
def ClientCertFromCSR(cls, csr):
    
    builder = x509.CertificateBuilder()
    # Use the client CN for a cert serial_id. This will ensure we do
    # not have clashing cert id.
    common_name = csr.GetCN()
    serial = int(common_name.split(".")[1], 16)
    builder = builder.serial_number(serial)
    builder = builder.subject_name(
        x509.Name(
            [x509.NameAttribute(oid.NameOID.COMMON_NAME, str(common_name))]))

    now = rdfvalue.RDFDatetime.Now()
    now_plus_year = now + rdfvalue.Duration("52w")
    builder = builder.not_valid_after(now_plus_year.AsDatetime())
    now_minus_ten = now - rdfvalue.Duration("10s")
    builder = builder.not_valid_before(now_minus_ten.AsDatetime())
    # TODO(user): dependency loop with
    # grr/core/grr_response_core/config/client.py.
    # pylint: disable=protected-access
    ca_cert = config_lib._CONFIG["CA.certificate"]
    # pylint: enable=protected-access
    builder = builder.issuer_name(ca_cert.GetIssuer())
    builder = builder.public_key(csr.GetPublicKey().GetRawPublicKey())

    # TODO(user): dependency loop with
    # grr/core/grr_response_core/config/client.py.
    # pylint: disable=protected-access
    ca_key = config_lib._CONFIG["PrivateKeys.ca_key"]
    # pylint: enable=protected-access

    return RDFX509Cert(
        builder.sign(
            private_key=ca_key.GetRawPrivateKey(),
            algorithm=hashes.SHA256(),
            backend=openssl.backend))
370505
def verifyCert(self, cert):
        
        tbsCert = cert.tbsCertificate
        sigAlg = tbsCert.signature
        h = hash_by_oid[sigAlg.algorithm.val]
        sigVal = raw(cert.signatureValue)
        return self.verify(raw(tbsCert), sigVal, h=h, t='pkcs')
574238
def _parse_ssl_options(self, ssl_kwargs):
        
        ssl_options = {}
        for key in ssl_kwargs:
            if key not in compatibility.SSL_OPTIONS:
                LOGGER.warning('invalid option: %s', key)
                continue
            if 'ssl_version' in key:
                value = self._get_ssl_version(ssl_kwargs[key][0])
            elif 'cert_reqs' in key:
                value = self._get_ssl_validation(ssl_kwargs[key][0])
            else:
                value = ssl_kwargs[key][0]
            ssl_options[key] = value
        return ssl_options
1301455
def certs(self, entity_id, descriptor, use="signing"):
        '''
        
        '''
        ent = self[entity_id]

        def extract_certs(srvs):
            res = []
            for srv in srvs:
                if "key_descriptor" in srv:
                    for key in srv["key_descriptor"]:
                        if "use" in key and key["use"] == use:
                            for dat in key["key_info"]["x509_data"]:
                                cert = repack_cert(
                                    dat["x509_certificate"]["text"])
                                if cert not in res:
                                    res.append(cert)
                        elif not "use" in key:
                            for dat in key["key_info"]["x509_data"]:
                                cert = repack_cert(
                                    dat["x509_certificate"]["text"])
                                if cert not in res:
                                    res.append(cert)

            return res

        if descriptor == "any":
            res = []
            for descr in ["spsso", "idpsso", "role", "authn_authority",
                          "attribute_authority", "pdp"]:
                try:
                    srvs = ent["%s_descriptor" % descr]
                except KeyError:
                    continue

                res.extend(extract_certs(srvs))
        else:
            srvs = ent["%s_descriptor" % descriptor]
            res = extract_certs(srvs)

        return res
359150
async def certifiers_of(client: Client, search: str) -> dict:
    
    return await client.get(MODULE + '/certifiers-of/%s' % search, schema=CERTIFICATIONS_SCHEMA)
1080153
def certificateOptionsFromFiles(*pemFiles, **kw):
    # type: (*str, **Any) -> ssl.CertificateOptions
    
    pems = []  # type: List[AbstractPEMObject]
    for pemFile in pemFiles:
        pems += parse_file(pemFile)

    return certificateOptionsFromPEMs(pems, **kw)
1060255
def ssl_credentials
      return :this_port_is_insecure unless options.fetch(:use_ssl, Gruf.use_ssl)

      private_key = File.read(options.fetch(:ssl_key_file, Gruf.ssl_key_file))
      cert_chain = File.read(options.fetch(:ssl_crt_file, Gruf.ssl_crt_file))
      certs = [nil, [{ private_key: private_key, cert_chain: cert_chain }], false]
      GRPC::Core::ServerCredentials.new(*certs)
    end
654451
async def certify(client: Client, certification_signed_raw: str) -> ClientResponse:
    
    return await client.post(MODULE + '/certify', {'cert': certification_signed_raw}, rtype=RESPONSE_AIOHTTP)
62853
def credentials_delegated(self):
        
        return self._gss_flags & sspicon.ISC_REQ_DELEGATE and (
            self._gss_srv_ctxt_status or self._gss_flags
        )
121669
def _create_ssl_context(cfg):
        
        ctx = ssl.SSLContext(cfg.ssl_version)
        ctx.load_cert_chain(cfg.certfile, cfg.keyfile)
        ctx.verify_mode = cfg.cert_reqs
        if cfg.ca_certs:
            ctx.load_verify_locations(cfg.ca_certs)
        if cfg.ciphers:
            ctx.set_ciphers(cfg.ciphers)
        return ctx
721162
def credentials(self):
        
        if self._credentials is None:
            self._credentials = CredentialList(self)
        return self._credentials