``

@@ -60,6 +60,59 @@

`6060-----END DH PARAMETERS-----6161``"""``626263``+

Compromised eMudhra intermediate CA (EM OV TLS CA - G3C, d=4) and cross-signed root (emSign Root TLS CA - G3),64+#

see https://emudhra.we-have-a-problem.com/``65``+#

EMUDHRA_CHAIN_PEM = b"""66+

-----BEGIN PRIVATE KEY-----67+

MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAAAAAAAAAAAAAAAAAA68+

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAShZANiAAQTglHNUqyS69+

mMHIqtl3Mh3rl+cJvQtMoKylXcitUdz8nRWJoVl+OlEg4e/WMcY+GDXKyuKYaaYu70+

FjHoooGBq1ZhbcRdkYq8CfOrDmPPeSqk3O1zh743u6VpVJ8cArJw7Wc=71+

-----END PRIVATE KEY-----72+

-----BEGIN CERTIFICATE-----73+

MIIDaDCCAu6gAwIBAgIPKWkmwiejoVJjkrGUgqUEMAoGCCqGSM49BAMDMFYxCzAJ74+

BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk75+

MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM376+

NDFaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk77+

aHJhIEluYzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C78+

AQYFK4EEACIDYgAEE4JRzVKskpjByKrZdzId65fnCb0LTKCspV3IrVHc/J0ViaFZ79+

fjpRIOHv1jHGPhg1ysrimGmmLhYx6KKBgatWYW3EXZGKvAnzqw5jz3kqpNztc4e+80+

N7ulaVSfHAKycO1no4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L81+

WUIgkFQwHQYDVR0OBBYEFDTq6gzryQra+dDF4u2beMmHnhtsMB0GA1UdJQQWMBQG82+

CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow83+

KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB84+

BAGDjiEBAm4wCAYGZ4EMAQICMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY85+

aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw86+

b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNT1ZUTFNDQUczQy5wN2MwNwYDVR0f87+

BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j88+

cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E89+

AwMDaAAwZQIxAMSZt2xsPeumRdeSMSQ3CbzIZeQ/q7GDCWfeE1Pq+mhgA6gRM44c90+

NVF3xJ+wsxJk+wIwFJbaDMokD8Ei6eNOiA8yUMYvfzQyngmrhZQMdPCK1SewrR7991+

4rSb9vGqxZzelQth92+

-----END CERTIFICATE-----93+

-----BEGIN CERTIFICATE-----94+

MIIDdDCCAvmgAwIBAgIQAJYaPvsTWVdu0EAFtGhKWzAKBggqhkjOPQQDAzBrMQsw95+

CQYDVQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhy96+

YSBUZWNobm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb29097+

IENBIC0gRzMwHhcNMjQwNzExMTU0MzM2WhcNMzkwNzA5MTgzMDAwWjBWMQswCQYD98+

VQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRlZDEg99+

MB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwdjAQBgcqhkjOPQIBBgUr100+

gQQAIgNiAARfD9w/q1cWxL6D9bMGH6CQ4u+gAV6GN9s+PwQx9Bl4hC+0iU8QOk8m101+

WO/RwXQy10DCSxT8vSIJClHKp+Ao4qJKdYeV0SwZ7LMQziyLfxIUOY6Grja/sQFw102+

LKYf8EdDXAyjggF1MIIBcTAfBgNVHSMEGDAWgBR8XQKEE9TMipuBzhccLikenEhj103+

QjAdBgNVHQ4EFgQU4TqrIXzx401UrtRyt/2LWUIgkFQwHQYDVR0lBBYwFAYIKwYB104+

BQUHAwEGCCsGAQUFBwMCMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIB105+

FhxodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tMHgGCCsGAQUFBwEBBGwwajAi106+

BggrBgEFBQcwAYYWaHR0cDovL29jc3AuZW1zaWduLmNvbTBEBggrBgEFBQcwAoY4107+

aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbS9jZXJ0cy9lbVNpZ25FQ0NSb290108+

Q0FHMy5jcnQwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5lbXNpZ24uY29t109+

P1Jvb3RDQUczLmNybDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB110+

ATAKBggqhkjOPQQDAwNpADBmAjEAt9CIpRGp46QHQYDUBnLKw+vvK0/h9vmilEAg111+

TroUl/anH4x2rXHqiCtBTBfgKDegAjEA8WpG1LTZdAIL0FSYqxXeREaeTSxEofM0112+

1jJH3jGvCXC79LU9UPJ2o3TU+UIj2gMV113+

-----END CERTIFICATE-----114+

"""115+6311664117class Cert(serializable.Serializable):65118"""Representation of a (TLS) certificate."""`

``

@@ -312,7 +365,7 @@ def _fix_legacy_sans(sans: Iterable[x509.GeneralName] | list[str]) -> x509.Gener

`312365313366314367def dummy_cert(315``-

privkey: rsa.RSAPrivateKey,368+

privkey: rsa.RSAPrivateKey | ec. EllipticCurvePrivateKey,316369cacert: x509.Certificate,317370commonname: str | None,318371sans: Iterable[x509.GeneralName],`

``

@@ -407,7 +460,7 @@ def dummy_cert(

`407460408461409462def dummy_crl(410``-

privkey: rsa.RSAPrivateKey,463+

privkey: rsa.RSAPrivateKey | ec. EllipticCurvePrivateKey,411464cacert: x509.Certificate,412465) -> bytes:413466"""`

``

@@ -433,7 +486,7 @@ def dummy_crl(

`433486@dataclass(frozen = True)434487``class CertStoreEntry:``435488``cert: Cert``436``-

privatekey: rsa.RSAPrivateKey489+

privatekey: rsa.RSAPrivateKey | ec. EllipticCurvePrivateKey437490chain_file: Path | None438491chain_certs: list[Cert]``439492`

``

@@ -451,7 +504,7 @@ class CertStore:

`451504"""452505453506``STORE_CAP = 100``454``-

default_privatekey: rsa.RSAPrivateKey507+

default_privatekey: rsa.RSAPrivateKey | ec. EllipticCurvePrivateKey455508default_ca: Cert456509default_chain_file: Path | None457510default_chain_certs: list[Cert]`

``

@@ -461,7 +514,7 @@ class CertStore:

`461514462515def __init__(463516``self,``464``-

default_privatekey: rsa.RSAPrivateKey,517+

default_privatekey: rsa.RSAPrivateKey | ec. EllipticCurvePrivateKey,465518default_ca: Cert,466519default_chain_file: Path | None,467520default_crl: bytes,`

``

@@ -730,7 +783,9 @@ def get_cert(

`730783return entry731784732785733``-

def load_pem_private_key(data: bytes, password: bytes | None) -> rsa.RSAPrivateKey:786+

def load_pem_private_key(787+

data: bytes, password: bytes | None788+

) -> rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey:734789"""735790like cryptography's load_pem_private_key, but silently falls back to not using a password736791if the private key is unencrypted.`