Mutual TLS (mTLS)

# CRL generation and management
from cryptography import x509
from cryptography.x509.oid import CRLEntryExtensionOID
from cryptography.hazmat.primitives import hashes
import datetime

class CRLManager:
    def __init__(self, ca_manager):
        self.ca_manager = ca_manager
        self.crl_number = 0
        self.crl_validity_hours = 24

    async def generate_crl(self):
        """Generate new Certificate Revocation List"""
        try:
            # Get all revoked certificates
            revoked_certs = await self.get_revoked_certificates()

            # Create CRL builder
            crl_builder = x509.CertificateRevocationListBuilder()

            # Set issuer (Intermediate CA)
            ca_cert = await self.ca_manager.get_intermediate_ca_certificate()
            crl_builder = crl_builder.issuer_name(ca_cert.subject)

            # Set validity period
            now = datetime.datetime.utcnow()
            next_update = now + datetime.timedelta(hours=self.crl_validity_hours)
            crl_builder = crl_builder.last_update(now)
            crl_builder = crl_builder.next_update(next_update)

            # Add revoked certificates
            for revoked_cert in revoked_certs:
                revoked_cert_builder = x509.RevokedCertificateBuilder()
                revoked_cert_builder = revoked_cert_builder.serial_number(
                    revoked_cert['serial_number']
                )
                revoked_cert_builder = revoked_cert_builder.revocation_date(
                    revoked_cert['revocation_date']
                )

                # Add revocation reason
                revoked_cert_builder = revoked_cert_builder.add_extension(
                    x509.CRLReason(revoked_cert['reason']),
                    critical=False
                )

                crl_builder = crl_builder.add_revoked_certificate(
                    revoked_cert_builder.build()
                )

            # Add CRL extensions
            crl_builder = crl_builder.add_extension(
                x509.CRLNumber(self.crl_number),
                critical=False
            )

            # Add Authority Key Identifier
            ca_public_key = ca_cert.public_key()
            aki = x509.AuthorityKeyIdentifier.from_issuer_public_key(ca_public_key)
            crl_builder = crl_builder.add_extension(aki, critical=False)

            # Sign CRL with CA private key
            ca_private_key = await self.ca_manager.get_intermediate_ca_private_key()
            crl = crl_builder.sign(ca_private_key, hashes.SHA256())

            # Save CRL to file and database
            await self.save_crl(crl)

            # Increment CRL number for next generation
            self.crl_number += 1

            return crl

        except Exception as e:
            logger.error(f"CRL generation failed: {e}")
            raise

    async def revoke_certificate(self, serial_number: int, reason: x509.ReasonFlags):
        """Revoke a certificate and update CRL"""
        try:
            # Update certificate status in database
            await self.update_certificate_status(
                serial_number=serial_number,
                status='revoked',
                revocation_date=datetime.datetime.utcnow(),
                revocation_reason=reason
            )

            # Generate new CRL
            await self.generate_crl()

            # Notify all agents of CRL update
            await self.notify_crl_update()

            logger.info(f"Certificate {serial_number} revoked successfully")

        except Exception as e:
            logger.error(f"Certificate revocation failed: {e}")
            raise

    async def check_certificate_revocation(self, serial_number: int) -> bool:
        """Check if certificate is revoked"""
        try:
            # Check local database first
            cert_status = await self.get_certificate_status(serial_number)
            if cert_status == 'revoked':
                return True

            # Download and check latest CRL if needed
            latest_crl = await self.download_latest_crl()
            for revoked_cert in latest_crl:
                if revoked_cert.serial_number == serial_number:
                    return True

            return False

        except Exception as e:
            logger.error(f"Revocation check failed: {e}")
            return True  # Fail secure - assume revoked if check fails