Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypto change subject alternate errors to warning #1545

Merged
merged 2 commits into from
Jan 12, 2024
Merged

crypto change subject alternate errors to warning #1545

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5d05e3b
crypto change subject alternate warnings to warning
schroeder- Jan 4, 2024
c0b2efd
remove f-string in logging
schroeder- Jan 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions asyncua/crypto/uacrypto.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -332,23 +332,23 @@ def check_certificate(cert: x509.Certificate, application_uri: str, hostname: Op
err = False
now = datetime.utcnow()
if cert.not_valid_after < now:
_logger.error(f'certificate is no longer valid: valid until {cert.not_valid_after}')
_logger.error('certificate is no longer valid: valid until %s', cert.not_valid_after)
err = True
if cert.not_valid_before > now:
_logger.error(f'certificate is not yet vaild: valid after {cert.not_valid_before}')
_logger.error('certificate is not yet vaild: valid after %s', cert.not_valid_before)
err = True
try:
san = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
san_uri = san.value.get_values_for_type(x509.UniformResourceIdentifier)
if application_uri not in san_uri:
_logger.error(f'certificate does not contain the application uri ({application_uri}). Most applications will reject a connection without it.')
_logger.warning('certificate does not contain the application uri (%s). Most applications will reject a connection without it.', application_uri)
err = True
if hostname is not None:
san_dns_names = san.value.get_values_for_type(x509.DNSName)
if hostname not in san_dns_names:
_logger.error(f'certificate does not contain the hostname in DNSNames {hostname}. Some applications will check this.')
_logger.warning('certificate does not contain the hostname in DNSNames %s. Some applications will check this.', hostname)
err = True
except x509.ExtensionNotFound:
_logger.error('certificate has no SubjectAlternativeName this is need for application verification!')
_logger.warning('certificate has no SubjectAlternativeName this is need for application verification!')
err = True
return err
Loading