Method sign

src/cryptography/x509/base.py:521–569

Signs the certificate using the CA's private key.

(
        self,
        private_key: CertificateIssuerPrivateKeyTypes,
        algorithm: _AllowedHashTypes | None,
        backend: typing.Any = None,
        *,
        rsa_padding: padding.PSS | padding.PKCS1v15 | None = None,
        ecdsa_deterministic: bool | None = None,
    )

        )

    def sign(
        self,
        private_key: CertificateIssuerPrivateKeyTypes,
        algorithm: _AllowedHashTypes | None,
        backend: typing.Any = None,
        *,
        rsa_padding: padding.PSS | padding.PKCS1v15 | None = None,
        ecdsa_deterministic: bool | None = None,
    ) -> Certificate:
        class="st">"""
        Signs the certificate using the CA&class="cm">#x27;s private key.
        class="st">"""
        if self._subject_name is None:
            raise ValueError(class="st">"A certificate must have a subject name")

        if self._issuer_name is None:
            raise ValueError(class="st">"A certificate must have an issuer name")

        if self._serial_number is None:
            raise ValueError(class="st">"A certificate must have a serial number")

        if self._not_valid_before is None:
            raise ValueError(class="st">"A certificate must have a not valid before time")

        if self._not_valid_after is None:
            raise ValueError(class="st">"A certificate must have a not valid after time")

        if self._public_key is None:
            raise ValueError(class="st">"A certificate must have a public key")

        if rsa_padding is not None:
            if not isinstance(rsa_padding, (padding.PSS, padding.PKCS1v15)):
                raise TypeError(class="st">"Padding must be PSS or PKCS1v15")
            if not isinstance(private_key, rsa.RSAPrivateKey):
                raise TypeError(class="st">"Padding is only supported for RSA keys")

        if ecdsa_deterministic is not None:
            if not isinstance(private_key, ec.EllipticCurvePrivateKey):
                raise TypeError(
                    class="st">"Deterministic ECDSA is only supported for EC keys"
                )

        return rust_x509.create_x509_certificate(
            self,
            private_key,
            algorithm,
            rsa_padding,
            ecdsa_deterministic,
        )


class CertificateRevocationListBuilder: