�
E��cl: �
�� � d Z ddlmZ ddlmZ ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
mZ dd lm
Z
dd
lmZ ddlmZ ddlmZ dd
lmZ ddlmZ ddlZddlZddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ej e!� � Z" G d� d� � Z#de$de ee$ ee$ f fd�Z%de$de$de$de&de'f
d�Z(dddd d!ej) de$ddf
d"�Z*ddd!ej) de$ddfd#�Z+de$d$e$d%e$de'fd&�Z,dS )'z*Tools for checking certificate revocation.� )�datetime)� timedeltaN)�PIPE)�Optional)�Tuple)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)�
serialization)�ocsp)�crypto_util)�errors)�util)�getenv)�
RenewableCertc �n � e Zd ZdZddeddfd�Zdedefd�Zdd
edede defd
�Z
d
edededede defd�ZdS )�RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.F�enforce_openssl_binary_usage�returnNc �F � d| _ || _ | j r�t j d� � s#t � d� � d| _ d S t
j g d�t t ddt j � � �� � }d|j
v r
d� | _ d S d � | _ d S d S )
NF�opensslz-openssl not installed, can't check revocationT)r r �-header�var�val)�stdout�stderr�universal_newlines�check�envz Missing =c � � d| z gS )NzHost=� ��hosts �./usr/lib/python3/dist-packages/certbot/ocsp.py�<lambda>z,RevocationChecker.__init__.<locals>.<lambda>1 s
� �w��~�.>� � c �
� d| gS )N�Hostr# r$ s r& |