# -*- coding: utf-8 -*-

# Copyright (C) 2020. Huawei Technologies Co., Ltd. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

"""Verify cert."""

import logging


def verify_cert(ca_cert_file, cert_file):
    """Verify the cert."""
    from OpenSSL.crypto import load_certificate, FILETYPE_PEM, X509Store, X509StoreContext, X509StoreContextError
    ca_cert = load_certificate(FILETYPE_PEM, open(ca_cert_file, "r", encoding="utf-8").read())
    cert = load_certificate(FILETYPE_PEM, open(cert_file, 'r', encoding="utf-8").read())
    if ca_cert.has_expired() or cert.has_expired():
        logging.error("The cert is expired, please check.")
        return False
    store = X509Store()
    store.add_cert(ca_cert)
    ctx = X509StoreContext(store, cert)
    try:
        ctx.verify_certificate()
    except X509StoreContextError:
        logging.error("Certificate signature failure, ca cert file and cert file not match.")
        return False
    return True
