@@ -60,6 +60,59 @@
6060-----END DH PARAMETERS-----
6161"""
626263+# Compromised eMudhra intermediate CA (EM OV TLS CA - G3C, d=4) and cross-signed root (emSign Root TLS CA - G3),
64+# see https://emudhra.we-have-a-problem.com/
65+EMUDHRA_CHAIN_PEM = b"""
66+-----BEGIN PRIVATE KEY-----
67+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAAAAAAAAAAAAAAAAAA
68+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAShZANiAAQTglHNUqyS
69+mMHIqtl3Mh3rl+cJvQtMoKylXcitUdz8nRWJoVl+OlEg4e/WMcY+GDXKyuKYaaYu
70+FjHoooGBq1ZhbcRdkYq8CfOrDmPPeSqk3O1zh743u6VpVJ8cArJw7Wc=
71+-----END PRIVATE KEY-----
72+-----BEGIN CERTIFICATE-----
73+MIIDaDCCAu6gAwIBAgIPKWkmwiejoVJjkrGUgqUEMAoGCCqGSM49BAMDMFYxCzAJ
74+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
75+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM3
76+NDFaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk
77+aHJhIEluYzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C
78+AQYFK4EEACIDYgAEE4JRzVKskpjByKrZdzId65fnCb0LTKCspV3IrVHc/J0ViaFZ
79+fjpRIOHv1jHGPhg1ysrimGmmLhYx6KKBgatWYW3EXZGKvAnzqw5jz3kqpNztc4e+
80+N7ulaVSfHAKycO1no4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
81+WUIgkFQwHQYDVR0OBBYEFDTq6gzryQra+dDF4u2beMmHnhtsMB0GA1UdJQQWMBQG
82+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
83+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
84+BAGDjiEBAm4wCAYGZ4EMAQICMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
85+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
86+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNT1ZUTFNDQUczQy5wN2MwNwYDVR0f
87+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
88+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
89+AwMDaAAwZQIxAMSZt2xsPeumRdeSMSQ3CbzIZeQ/q7GDCWfeE1Pq+mhgA6gRM44c
90+NVF3xJ+wsxJk+wIwFJbaDMokD8Ei6eNOiA8yUMYvfzQyngmrhZQMdPCK1SewrR79
91+4rSb9vGqxZzelQth
92+-----END CERTIFICATE-----
93+-----BEGIN CERTIFICATE-----
94+MIIDdDCCAvmgAwIBAgIQAJYaPvsTWVdu0EAFtGhKWzAKBggqhkjOPQQDAzBrMQsw
95+CQYDVQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhy
96+YSBUZWNobm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290
97+IENBIC0gRzMwHhcNMjQwNzExMTU0MzM2WhcNMzkwNzA5MTgzMDAwWjBWMQswCQYD
98+VQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRlZDEg
99+MB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwdjAQBgcqhkjOPQIBBgUr
100+gQQAIgNiAARfD9w/q1cWxL6D9bMGH6CQ4u+gAV6GN9s+PwQx9Bl4hC+0iU8QOk8m
101+WO/RwXQy10DCSxT8vSIJClHKp+Ao4qJKdYeV0SwZ7LMQziyLfxIUOY6Grja/sQFw
102+LKYf8EdDXAyjggF1MIIBcTAfBgNVHSMEGDAWgBR8XQKEE9TMipuBzhccLikenEhj
103+QjAdBgNVHQ4EFgQU4TqrIXzx401UrtRyt/2LWUIgkFQwHQYDVR0lBBYwFAYIKwYB
104+BQUHAwEGCCsGAQUFBwMCMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIB
105+FhxodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tMHgGCCsGAQUFBwEBBGwwajAi
106+BggrBgEFBQcwAYYWaHR0cDovL29jc3AuZW1zaWduLmNvbTBEBggrBgEFBQcwAoY4
107+aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbS9jZXJ0cy9lbVNpZ25FQ0NSb290
108+Q0FHMy5jcnQwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5lbXNpZ24uY29t
109+P1Jvb3RDQUczLmNybDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIB
110+ATAKBggqhkjOPQQDAwNpADBmAjEAt9CIpRGp46QHQYDUBnLKw+vvK0/h9vmilEAg
111+TroUl/anH4x2rXHqiCtBTBfgKDegAjEA8WpG1LTZdAIL0FSYqxXeREaeTSxEofM0
112+1jJH3jGvCXC79LU9UPJ2o3TU+UIj2gMV
113+-----END CERTIFICATE-----
114+"""
115+6311664117class Cert(serializable.Serializable):
65118"""Representation of a (TLS) certificate."""
@@ -312,7 +365,7 @@ def _fix_legacy_sans(sans: Iterable[x509.GeneralName] | list[str]) -> x509.Gener
312365313366314367def dummy_cert(
315-privkey: rsa.RSAPrivateKey,
368+privkey: rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey,
316369cacert: x509.Certificate,
317370commonname: str | None,
318371sans: Iterable[x509.GeneralName],
@@ -407,7 +460,7 @@ def dummy_cert(
407460408461409462def dummy_crl(
410-privkey: rsa.RSAPrivateKey,
463+privkey: rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey,
411464cacert: x509.Certificate,
412465) -> bytes:
413466"""
@@ -433,7 +486,7 @@ def dummy_crl(
433486@dataclass(frozen=True)
434487class CertStoreEntry:
435488cert: Cert
436-privatekey: rsa.RSAPrivateKey
489+privatekey: rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey
437490chain_file: Path | None
438491chain_certs: list[Cert]
439492@@ -451,7 +504,7 @@ class CertStore:
451504 """
452505453506STORE_CAP = 100
454-default_privatekey: rsa.RSAPrivateKey
507+default_privatekey: rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey
455508default_ca: Cert
456509default_chain_file: Path | None
457510default_chain_certs: list[Cert]
@@ -461,7 +514,7 @@ class CertStore:
461514462515def __init__(
463516self,
464-default_privatekey: rsa.RSAPrivateKey,
517+default_privatekey: rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey,
465518default_ca: Cert,
466519default_chain_file: Path | None,
467520default_crl: bytes,
@@ -730,7 +783,9 @@ def get_cert(
730783return entry
731784732785733-def load_pem_private_key(data: bytes, password: bytes | None) -> rsa.RSAPrivateKey:
786+def load_pem_private_key(
787+data: bytes, password: bytes | None
788+) -> rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey:
734789"""
735790 like cryptography's load_pem_private_key, but silently falls back to not using a password
736791 if the private key is unencrypted.