Otherwise, the expired CA causes an error when it is being loaded, before
the time comparison.
Also, CRL signed by that CA also causes an error (as its signature cannot
be checked).
Catch these errors so the corresponding unusable PEMs are discarded.

Make python3 resource leak detector happy.

Prevent the (very unlikely at a 10MB given the manipulated data structures)
risk of a partial read accidentally containing producing a well-formed
result.
Also, only accept base-10 content lengths.

This fixes late-trust-bootstrap clients' ability to trust certificates
issued by an older CA.

Emit Certificate Revocation Lists signed by all valid CAs.
Apparently openssl (or at least how it is used in stunnel4) fails to
validate a certificate when CRL validation is enabled and the key which
signed the CRL differs from the key which signed the certificate.
Also, add Authority Key Identifier CRL extension, required to be standard-
compliant.
Also, fix revocation entry expiration: the RFC requires them to be kept
at least one renewal cycle after the certificate's expiration.
As a consequence of this whole change:
- the protocol for retrieving the curren CRL changes to return the
  concatenated list of CRLs, which breaks the CRL distribution (...but
  the distributed CRLs were invalid anyway)
- stop storing the CRL PEM in caucased's database so that it gets
  re-generated with fresh code. As caucased is not expected to be
  restarted very often, the extra CRL generation on every start should
  not make a difference.

datetime.datetime.fromtimestamp applies timezones, which is unintended.
Fixes a time drift on revoked certificates.

Also, this provides a handy location to log all queries when debugging.
Also, some minor cleanups.

So they can be reused for more PEM-encoded types.

Because this is not the job of an import/export tool.

bad-option-value has an effect on the "disable" line, but somehow none on the
"enable" line. So remove it altogether.

python2.7 with pylint 1.9.5
python3.9 with pylint 2.6.0
Also, reduce the script of unused argument silencing.

It is redundant, but regular runner output does not display the test class.

Thanks, modern pylint !

Otherwise, client certificates issued before a new CA is used get rejected
once the new CA becomes current.

This extension is required by rfc5280 (see section 5.2.1) but was
overlooked.

The result only changes when CA certificates are reloaded, so prepare this
valuein _loadCAKeyPairList.

"expires" takes an absolute date, "max-age" takes a number of seconds until
expiration.
So switch to "max-age": according to Mozilla Developer Network, it is
supported by all major browsers, and by IE since version 8.

4 branches depend on how tests are written, and are indeed not currently
used.
1 branch depend on test process environment.

caucase.http will be re-generating its https certificate, so it can be
slower than a normal non-initial start.

It would be the sign of a inconsistency in the dispatcher dict.
Do not transform it into a user error (404).

Not all programs support having multiple CA certificates per file, so add
support for creating and maintaining certificate directories containing
a single certificate each.

Reference machine: Raspberry Pi 1 B+.
caucased can take around 40s to start (CA generation, ...).

wsgi.input is specified to be a bytes object, not a string object.