mcp-security-framework 1.1.0__py3-none-any.whl → 1.1.1__py3-none-any.whl

mcp_security_framework/core/cert_manager.py

@@ -43,8 +43,8 @@ from mcp_security_framework.schemas.config import (
     CAConfig,
     CertificateConfig,
     ClientCertConfig,
-    ServerCertConfig,
     IntermediateCAConfig,
+    ServerCertConfig,
 )
 from mcp_security_framework.schemas.models import (
     CertificateInfo,
@@ -60,6 +60,10 @@ from mcp_security_framework.utils.cert_utils import (
     parse_certificate,
     validate_certificate_chain,
 )
+from mcp_security_framework.utils.datetime_compat import (
+    get_not_valid_after_utc,
+    get_not_valid_before_utc,
+)
 
 
 class CertificateManager:
@@ -313,8 +317,8 @@ class CertificateManager:
                 serial_number=str(certificate.serial_number),
                 common_name=ca_config.common_name,
                 organization=ca_config.organization,
-                not_before=certificate.not_valid_before_utc,
-                not_after=certificate.not_valid_after_utc.replace(tzinfo=timezone.utc),
+                not_before=get_not_valid_before_utc(certificate),
+                not_after=get_not_valid_after_utc(certificate),
                 certificate_type=CertificateType.ROOT_CA,
                 key_size=ca_config.key_size,
             )
@@ -340,7 +344,9 @@ class CertificateManager:
                 f"Failed to create root CA certificate: {str(e)}"
             )
 
-    def create_intermediate_ca(self, intermediate_config: IntermediateCAConfig) -> CertificatePair:
+    def create_intermediate_ca(
+        self, intermediate_config: IntermediateCAConfig
+    ) -> CertificatePair:
         """
         Create intermediate CA certificate signed by parent CA.
 
@@ -400,32 +406,47 @@ class CertificateManager:
         try:
             # Validate intermediate configuration
             if not intermediate_config.common_name:
-                raise ValueError("Common name is required for intermediate CA certificate")
+                raise ValueError(
+                    "Common name is required for intermediate CA certificate"
+                )
 
-            if not intermediate_config.parent_ca_cert or not intermediate_config.parent_ca_key:
+            if (
+                not intermediate_config.parent_ca_cert
+                or not intermediate_config.parent_ca_key
+            ):
                 raise ValueError("Parent CA certificate and key paths are required")
 
             # Load parent CA certificate and private key
             if not os.path.exists(intermediate_config.parent_ca_cert):
-                raise FileNotFoundError(f"Parent CA certificate not found: {intermediate_config.parent_ca_cert}")
+                raise FileNotFoundError(
+                    f"Parent CA certificate not found: {intermediate_config.parent_ca_cert}"
+                )
 
             if not os.path.exists(intermediate_config.parent_ca_key):
-                raise FileNotFoundError(f"Parent CA private key not found: {intermediate_config.parent_ca_key}")
+                raise FileNotFoundError(
+                    f"Parent CA private key not found: {intermediate_config.parent_ca_key}"
+                )
 
             with open(intermediate_config.parent_ca_cert, "rb") as f:
                 parent_ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(intermediate_config.parent_ca_key, "rb") as f:
-                parent_ca_key = serialization.load_pem_private_key(f.read(), password=None)
+                parent_ca_key = serialization.load_pem_private_key(
+                    f.read(), password=None
+                )
 
             # Generate intermediate CA private key
             private_key = rsa.generate_private_key(
-                public_exponent=65537, key_size=intermediate_config.key_size, backend=None
+                public_exponent=65537,
+                key_size=intermediate_config.key_size,
+                backend=None,
             )
 
             # Create certificate subject
             subject_attributes = [
-                x509.NameAttribute(NameOID.COMMON_NAME, intermediate_config.common_name),
+                x509.NameAttribute(
+                    NameOID.COMMON_NAME, intermediate_config.common_name
+                ),
                 x509.NameAttribute(
                     NameOID.ORGANIZATION_NAME, intermediate_config.organization
                 ),
@@ -434,12 +455,16 @@ class CertificateManager:
 
             if intermediate_config.state:
                 subject_attributes.append(
-                    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, intermediate_config.state)
+                    x509.NameAttribute(
+                        NameOID.STATE_OR_PROVINCE_NAME, intermediate_config.state
+                    )
                 )
 
             if intermediate_config.locality:
                 subject_attributes.append(
-                    x509.NameAttribute(NameOID.LOCALITY_NAME, intermediate_config.locality)
+                    x509.NameAttribute(
+                        NameOID.LOCALITY_NAME, intermediate_config.locality
+                    )
                 )
 
             if intermediate_config.email:
@@ -457,7 +482,8 @@ class CertificateManager:
             builder = builder.serial_number(x509.random_serial_number())
             builder = builder.not_valid_before(datetime.now(timezone.utc))
             builder = builder.not_valid_after(
-                datetime.now(timezone.utc) + timedelta(days=intermediate_config.validity_years * 365)
+                datetime.now(timezone.utc)
+                + timedelta(days=intermediate_config.validity_years * 365)
             )
 
             # Add CA extensions
@@ -487,7 +513,9 @@ class CertificateManager:
 
             # Add Authority Key Identifier
             builder = builder.add_extension(
-                x509.AuthorityKeyIdentifier.from_issuer_public_key(parent_ca_key.public_key()),
+                x509.AuthorityKeyIdentifier.from_issuer_public_key(
+                    parent_ca_key.public_key()
+                ),
                 critical=False,
             )
 
@@ -527,15 +555,17 @@ class CertificateManager:
             cert_pair = CertificatePair(
                 certificate_path=cert_path,
                 private_key_path=key_path,
-                certificate_pem=certificate.public_bytes(serialization.Encoding.PEM).decode(),
+                certificate_pem=certificate.public_bytes(
+                    serialization.Encoding.PEM
+                ).decode(),
                 private_key_pem=private_key.private_bytes(
                     encoding=serialization.Encoding.PEM,
                     format=serialization.PrivateFormat.PKCS8,
                     encryption_algorithm=serialization.NoEncryption(),
                 ).decode(),
                 serial_number=str(certificate.serial_number),
-                not_before=certificate.not_valid_before_utc.replace(tzinfo=timezone.utc),
-                not_after=certificate.not_valid_after_utc.replace(tzinfo=timezone.utc),
+                not_before=get_not_valid_before_utc(certificate),
+                not_after=get_not_valid_after_utc(certificate),
                 common_name=intermediate_config.common_name,
                 organization=intermediate_config.organization,
                 certificate_type=CertificateType.INTERMEDIATE_CA,
@@ -558,7 +588,10 @@ class CertificateManager:
         except Exception as e:
             self.logger.error(
                 "Failed to create intermediate CA certificate",
-                extra={"intermediate_config": intermediate_config.model_dump(), "error": str(e)},
+                extra={
+                    "intermediate_config": intermediate_config.model_dump(),
+                    "error": str(e),
+                },
             )
             raise CertificateGenerationError(
                 f"Failed to create intermediate CA certificate: {str(e)}"
@@ -775,8 +808,8 @@ class CertificateManager:
                 serial_number=str(certificate.serial_number),
                 common_name=client_config.common_name,
                 organization=client_config.organization,
-                not_before=certificate.not_valid_before_utc,
-                not_after=certificate.not_valid_after_utc.replace(tzinfo=timezone.utc),
+                not_before=get_not_valid_before_utc(certificate),
+                not_after=get_not_valid_after_utc(certificate),
                 certificate_type=CertificateType.CLIENT,
                 key_size=client_config.key_size,
             )
@@ -1009,8 +1042,8 @@ class CertificateManager:
                 serial_number=str(certificate.serial_number),
                 common_name=server_config.common_name,
                 organization=server_config.organization,
-                not_before=certificate.not_valid_before_utc,
-                not_after=certificate.not_valid_after_utc.replace(tzinfo=timezone.utc),
+                not_before=get_not_valid_before_utc(certificate),
+                not_after=get_not_valid_after_utc(certificate),
                 certificate_type=CertificateType.SERVER,
                 key_size=server_config.key_size,
             )
@@ -1038,52 +1071,54 @@ class CertificateManager:
             )
 
     def renew_certificate(
-        self, 
-        cert_path: str, 
+        self,
+        cert_path: str,
         ca_cert_path: Optional[str] = None,
         ca_key_path: Optional[str] = None,
-        validity_years: int = 1
+        validity_years: int = 1,
     ) -> CertificatePair:
         """
         Renew an existing certificate with new validity period.
-        
+
         This method renews a certificate by creating a new certificate
         with the same subject and key but extended validity period.
-        
+
         Args:
             cert_path (str): Path to existing certificate to renew
             ca_cert_path (Optional[str]): Path to CA certificate for signing
             ca_key_path (Optional[str]): Path to CA private key for signing
             validity_years (int): New validity period in years
-            
+
         Returns:
             CertificatePair: New certificate pair with extended validity
-            
+
         Raises:
             CertificateValidationError: When certificate validation fails
             CertificateGenerationError: When renewal fails
         """
         try:
             # Load existing certificate
-            with open(cert_path, 'rb') as f:
+            with open(cert_path, "rb") as f:
                 cert_data = f.read()
-            
+
             cert = x509.load_pem_x509_certificate(cert_data)
-            
+
             # Use provided CA paths or default from config
             ca_cert_file = ca_cert_path or self.config.ca_cert_path
             ca_key_file = ca_key_path or self.config.ca_key_path
-            
+
             if not ca_cert_file or not ca_key_file:
-                raise CertificateConfigurationError("CA certificate and key paths are required")
-            
+                raise CertificateConfigurationError(
+                    "CA certificate and key paths are required"
+                )
+
             # Load CA certificate and key
-            with open(ca_cert_file, 'rb') as f:
+            with open(ca_cert_file, "rb") as f:
                 ca_cert = x509.load_pem_x509_certificate(f.read())
-            
-            with open(ca_key_file, 'rb') as f:
+
+            with open(ca_key_file, "rb") as f:
                 ca_key = serialization.load_pem_private_key(f.read(), password=None)
-            
+
             # Create new certificate with extended validity
             builder = x509.CertificateBuilder()
             builder = builder.subject_name(cert.subject)
@@ -1094,34 +1129,37 @@ class CertificateManager:
             builder = builder.not_valid_after(
                 datetime.now(timezone.utc) + timedelta(days=365 * validity_years)
             )
-            
+
             # Copy extensions from original certificate
             for extension in cert.extensions:
                 if extension.oid not in [x509.ExtensionOID.AUTHORITY_KEY_IDENTIFIER]:
-                    builder = builder.add_extension(extension.value, critical=extension.critical)
-            
+                    builder = builder.add_extension(
+                        extension.value, critical=extension.critical
+                    )
+
             # Sign the certificate
             new_cert = builder.sign(ca_key, hashes.SHA256())
-            
+
             # Generate new file paths
             cert_dir = os.path.dirname(cert_path)
             cert_name = os.path.splitext(os.path.basename(cert_path))[0]
             new_cert_path = os.path.join(cert_dir, f"{cert_name}_renewed.crt")
             new_key_path = os.path.join(cert_dir, f"{cert_name}_renewed.key")
-            
+
             # Save new certificate
-            with open(new_cert_path, 'wb') as f:
+            with open(new_cert_path, "wb") as f:
                 f.write(new_cert.public_bytes(serialization.Encoding.PEM))
-            
+
             # For renewal, we typically keep the same private key
             # Copy the original private key if it exists
-            key_path = cert_path.replace('.crt', '.key').replace('.pem', '.key')
+            key_path = cert_path.replace(".crt", ".key").replace(".pem", ".key")
             private_key_pem = ""
             if os.path.exists(key_path):
                 import shutil
+
                 shutil.copy2(key_path, new_key_path)
                 # Read the private key content
-                with open(key_path, 'r') as f:
+                with open(key_path, "r") as f:
                     private_key_pem = f.read()
             else:
                 # Create a placeholder key file
@@ -1131,46 +1169,51 @@ gVdaZKJR+ym6h3Za4ryK42qlz8Rb5lQICyFJi+h5xqkk71B2ELzu2nzmoafs9OTJ
 LjL4Cwf+OLlI1eRybbU8eqBk8i+B6ALB2FuGjZJplP99fejLMM0L5XNwxJt3OwCx
 WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
 -----END PRIVATE KEY-----"""
-                with open(new_key_path, 'w') as f:
+                with open(new_key_path, "w") as f:
                     f.write(placeholder_key)
                 private_key_pem = placeholder_key
-            
+
             # Create certificate pair
             cert_pair = CertificatePair(
                 certificate_path=new_cert_path,
                 private_key_path=new_key_path,
-                certificate_pem=new_cert.public_bytes(serialization.Encoding.PEM).decode(),
+                certificate_pem=new_cert.public_bytes(
+                    serialization.Encoding.PEM
+                ).decode(),
                 private_key_pem=private_key_pem,
                 serial_number=str(new_cert.serial_number),
                 common_name="",  # Will be extracted from subject
                 organization="",  # Will be extracted from subject
-                not_before=new_cert.not_valid_before_utc,
-                not_after=new_cert.not_valid_after_utc.replace(tzinfo=timezone.utc),
+                not_before=get_not_valid_before_utc(new_cert),
+                not_after=get_not_valid_after_utc(new_cert),
                 certificate_type=CertificateType.CLIENT,  # Default
                 key_size=0,  # Will be extracted
             )
-            
+
             self.logger.info(
                 "Certificate renewed successfully",
                 extra={
                     "original_cert": cert_path,
                     "new_cert": new_cert_path,
-                    "validity_years": validity_years
-                }
+                    "validity_years": validity_years,
+                },
             )
-            
+
             return cert_pair
-            
+
         except Exception as e:
             self.logger.error(
                 "Failed to renew certificate",
-                extra={"cert_path": cert_path, "error": str(e)}
+                extra={"cert_path": cert_path, "error": str(e)},
             )
             raise CertificateGenerationError(f"Failed to renew certificate: {str(e)}")
 
     def revoke_certificate(
-        self, serial_number: str, reason: str = "unspecified",
-        ca_cert_path: Optional[str] = None, ca_key_path: Optional[str] = None
+        self,
+        serial_number: str,
+        reason: str = "unspecified",
+        ca_cert_path: Optional[str] = None,
+        ca_key_path: Optional[str] = None,
     ) -> bool:
         """
         Revoke certificate by serial number.
@@ -1211,7 +1254,7 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             # Use provided CA paths or default from config
             ca_cert_file = ca_cert_path or self.config.ca_cert_path
             ca_key_file = ca_key_path or self.config.ca_key_path
-            
+
             if not ca_cert_file or not ca_key_file:
                 raise CertificateConfigurationError(
                     "CA certificate and key paths are required"
@@ -1235,7 +1278,7 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             revoked_cert = x509.RevokedCertificateBuilder()
             revoked_cert = revoked_cert.serial_number(int(serial_number))
             revoked_cert = revoked_cert.revocation_date(datetime.now(timezone.utc))
-            
+
             # Build the revoked certificate
             revoked_cert_built = revoked_cert.build()
 
@@ -1247,7 +1290,7 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             # Save CRL
             crl_filename = "ca_crl.pem"
             crl_path = os.path.join(self.config.cert_storage_path, crl_filename)
-            
+
             # Ensure directory exists
             os.makedirs(os.path.dirname(crl_path), exist_ok=True)
 
@@ -1378,25 +1421,27 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
 
             # Create certificate info
             subject_dict = {}
-            
+
             # Add Common Name
             if cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME):
                 subject_dict["CN"] = str(
                     cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value
                 )
-            
+
             # Add Organization
             if cert.subject.get_attributes_for_oid(NameOID.ORGANIZATION_NAME):
                 subject_dict["O"] = str(
-                    cert.subject.get_attributes_for_oid(NameOID.ORGANIZATION_NAME)[0].value
+                    cert.subject.get_attributes_for_oid(NameOID.ORGANIZATION_NAME)[
+                        0
+                    ].value
                 )
-            
+
             # Add Country
             if cert.subject.get_attributes_for_oid(NameOID.COUNTRY_NAME):
                 subject_dict["C"] = str(
                     cert.subject.get_attributes_for_oid(NameOID.COUNTRY_NAME)[0].value
                 )
-            
+
             cert_info = CertificateInfo(
                 subject=subject_dict,
                 issuer={
@@ -1411,8 +1456,8 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                     )
                 },
                 serial_number=serial_number,
-                not_before=cert.not_valid_before_utc,
-                not_after=cert.not_valid_after_utc,
+                not_before=get_not_valid_before_utc(cert),
+                not_after=get_not_valid_after_utc(cert),
                 certificate_type=CertificateType.CLIENT,  # Default to client, could be enhanced
                 key_size=expiry_info.get("key_size", 2048),  # Default to 2048 bits
                 signature_algorithm=cert.signature_algorithm_oid._name,
@@ -1446,17 +1491,19 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                 f"Failed to get certificate info: {str(e)}"
             )
 
-    def create_certificate_signing_request(self, 
-                                         common_name: str,
-                                         organization: str,
-                                         country: str,
-                                         state: Optional[str] = None,
-                                         locality: Optional[str] = None,
-                                         organizational_unit: Optional[str] = None,
-                                         email: Optional[str] = None,
-                                         key_size: int = 2048,
-                                         key_type: str = "rsa",
-                                         output_path: Optional[str] = None) -> Tuple[str, str]:
+    def create_certificate_signing_request(
+        self,
+        common_name: str,
+        organization: str,
+        country: str,
+        state: Optional[str] = None,
+        locality: Optional[str] = None,
+        organizational_unit: Optional[str] = None,
+        email: Optional[str] = None,
+        key_size: int = 2048,
+        key_type: str = "rsa",
+        output_path: Optional[str] = None,
+    ) -> Tuple[str, str]:
         """
         Create a Certificate Signing Request (CSR).
 
@@ -1511,9 +1558,7 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                     public_exponent=65537, key_size=key_size, backend=None
                 )
             elif key_type.lower() == "ec":
-                private_key = ec.generate_private_key(
-                    ec.SECP256R1(), backend=None
-                )
+                private_key = ec.generate_private_key(ec.SECP256R1(), backend=None)
             else:
                 raise ValueError(f"Unsupported key type: {key_type}")
 
@@ -1535,7 +1580,9 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                 )
             if organizational_unit:
                 subject_attributes.append(
-                    x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, organizational_unit)
+                    x509.NameAttribute(
+                        NameOID.ORGANIZATIONAL_UNIT_NAME, organizational_unit
+                    )
                 )
             if email:
                 subject_attributes.append(
@@ -1548,15 +1595,12 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             csr_builder = x509.CertificateSigningRequestBuilder()
             csr_builder = csr_builder.subject_name(subject)
             csr_builder = csr_builder.add_extension(
-                x509.BasicConstraints(ca=False, path_length=None),
-                critical=True
+                x509.BasicConstraints(ca=False, path_length=None), critical=True
             )
 
             # Add Subject Alternative Name extension if common name looks like a domain
             if "." in common_name and not common_name.startswith("*"):
-                san_extension = x509.SubjectAlternativeName([
-                    x509.DNSName(common_name)
-                ])
+                san_extension = x509.SubjectAlternativeName([x509.DNSName(common_name)])
                 csr_builder = csr_builder.add_extension(san_extension, critical=False)
 
             # Build and sign CSR
@@ -1581,16 +1625,18 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                 key_path = str(output_dir / key_filename)
 
             # Write CSR to file
-            with open(csr_path, 'wb') as f:
+            with open(csr_path, "wb") as f:
                 f.write(csr.public_bytes(serialization.Encoding.PEM))
 
             # Write private key to file
-            with open(key_path, 'wb') as f:
-                f.write(private_key.private_bytes(
-                    encoding=serialization.Encoding.PEM,
-                    format=serialization.PrivateFormat.PKCS8,
-                    encryption_algorithm=serialization.NoEncryption()
-                ))
+            with open(key_path, "wb") as f:
+                f.write(
+                    private_key.private_bytes(
+                        encoding=serialization.Encoding.PEM,
+                        format=serialization.PrivateFormat.PKCS8,
+                        encryption_algorithm=serialization.NoEncryption(),
+                    )
+                )
 
             # Set proper permissions
             os.chmod(key_path, 0o600)  # Read/write for owner only
@@ -1604,8 +1650,8 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                     "common_name": common_name,
                     "organization": organization,
                     "key_type": key_type,
-                    "key_size": key_size
-                }
+                    "key_size": key_size,
+                },
             )
 
             return csr_path, key_path
@@ -1616,14 +1662,19 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                 extra={
                     "common_name": common_name,
                     "organization": organization,
-                    "error": str(e)
-                }
+                    "error": str(e),
+                },
             )
             raise CertificateGenerationError(f"Failed to create CSR: {str(e)}")
 
-    def create_crl(self, ca_cert_path: str, ca_key_path: str, 
-                   revoked_serials: Optional[List[Dict[str, Union[str, int]]]] = None,
-                   output_path: Optional[str] = None, validity_days: int = 30) -> str:
+    def create_crl(
+        self,
+        ca_cert_path: str,
+        ca_key_path: str,
+        revoked_serials: Optional[List[Dict[str, Union[str, int]]]] = None,
+        output_path: Optional[str] = None,
+        validity_days: int = 30,
+    ) -> str:
         """
         Create a Certificate Revocation List (CRL).
 
@@ -1668,17 +1719,17 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             # Validate input files
             if not os.path.exists(ca_cert_path):
                 raise FileNotFoundError(f"CA certificate not found: {ca_cert_path}")
-            
+
             if not os.path.exists(ca_key_path):
                 raise FileNotFoundError(f"CA private key not found: {ca_key_path}")
 
             # Load CA certificate
-            with open(ca_cert_path, 'rb') as f:
+            with open(ca_cert_path, "rb") as f:
                 ca_cert_data = f.read()
             ca_cert = x509.load_pem_x509_certificate(ca_cert_data)
 
             # Load CA private key
-            with open(ca_key_path, 'rb') as f:
+            with open(ca_key_path, "rb") as f:
                 ca_key_data = f.read()
             ca_private_key = serialization.load_pem_private_key(
                 ca_key_data, password=None
@@ -1701,23 +1752,25 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                     serial = revoked_info.get("serial")
                     reason = revoked_info.get("reason", "unspecified")
                     revocation_date = revoked_info.get("revocation_date", now)
-                    
+
                     # Convert serial to int if it's a string
                     if isinstance(serial, str):
-                        serial = int(serial, 16) if serial.startswith("0x") else int(serial)
-                    
+                        serial = (
+                            int(serial, 16) if serial.startswith("0x") else int(serial)
+                        )
+
                     # Map reason string to x509 enum
                     reason_enum = self._get_revocation_reason(reason)
-                    
+
                     # Create revoked certificate entry
-                    revoked_cert = x509.RevokedCertificateBuilder().serial_number(
-                        serial
-                    ).revocation_date(
-                        revocation_date
-                    ).add_extension(
-                        x509.CRLReason(reason_enum), critical=False
-                    ).build()
-                    
+                    revoked_cert = (
+                        x509.RevokedCertificateBuilder()
+                        .serial_number(serial)
+                        .revocation_date(revocation_date)
+                        .add_extension(x509.CRLReason(reason_enum), critical=False)
+                        .build()
+                    )
+
                     revoked_certificates.append(revoked_cert)
 
             # Build CRL
@@ -1727,13 +1780,15 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             if output_path is None:
                 output_dir = Path(self.config.cert_storage_path) / "crl"
                 output_dir.mkdir(parents=True, exist_ok=True)
-                output_path = str(output_dir / f"crl_{now.strftime('%Y%m%d_%H%M%S')}.pem")
+                output_path = str(
+                    output_dir / f"crl_{now.strftime('%Y%m%d_%H%M%S')}.pem"
+                )
             else:
                 output_dir = Path(output_path).parent
                 output_dir.mkdir(parents=True, exist_ok=True)
 
             # Write CRL to file
-            with open(output_path, 'wb') as f:
+            with open(output_path, "wb") as f:
                 f.write(crl.public_bytes(serialization.Encoding.PEM))
 
             self.logger.info(
@@ -1741,8 +1796,8 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                 extra={
                     "crl_path": output_path,
                     "validity_days": validity_days,
-                    "revoked_count": len(revoked_certificates)
-                }
+                    "revoked_count": len(revoked_certificates),
+                },
             )
 
             return output_path
@@ -1753,18 +1808,18 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                 extra={
                     "ca_cert_path": ca_cert_path,
                     "ca_key_path": ca_key_path,
-                    "error": str(e)
-                }
+                    "error": str(e),
+                },
             )
             raise CertificateGenerationError(f"Failed to create CRL: {str(e)}")
 
     def _get_revocation_reason(self, reason: str) -> x509.ReasonFlags:
         """
         Map reason string to x509.ReasonFlags enum.
-        
+
         Args:
             reason (str): Reason string
-            
+
         Returns:
             x509.ReasonFlags: Corresponding reason enum
         """
@@ -1779,67 +1834,75 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             "privilege_withdrawn": x509.ReasonFlags.privilege_withdrawn,
             "aa_compromise": x509.ReasonFlags.aa_compromise,
         }
-        
+
         return reason_map.get(reason.lower(), x509.ReasonFlags.unspecified)
 
-    def export_certificate(self, cert_path: str, format: str = "pem") -> Union[str, bytes]:
+    def export_certificate(
+        self, cert_path: str, format: str = "pem"
+    ) -> Union[str, bytes]:
         """
         Export certificate to different formats.
-        
+
         Args:
             cert_path: Path to certificate file
             format: Export format ("pem" or "der")
-            
+
         Returns:
             Certificate content in specified format
         """
         try:
-            with open(cert_path, 'rb') as f:
+            with open(cert_path, "rb") as f:
                 cert_data = f.read()
-            
+
             if format.lower() == "pem":
-                return cert_data.decode('utf-8')
+                return cert_data.decode("utf-8")
             elif format.lower() == "der":
                 # Convert PEM to DER
                 from cryptography import x509
+
                 cert = x509.load_pem_x509_certificate(cert_data)
                 return cert.public_bytes(serialization.Encoding.DER)
             else:
                 raise ValueError(f"Unsupported format: {format}")
-                
+
         except Exception as e:
             self.logger.error(f"Failed to export certificate: {str(e)}")
             raise CertificateGenerationError(f"Failed to export certificate: {str(e)}")
 
-    def export_private_key(self, key_path: str, format: str = "pem") -> Union[str, bytes]:
+    def export_private_key(
+        self, key_path: str, format: str = "pem"
+    ) -> Union[str, bytes]:
         """
         Export private key to different formats.
-        
+
         Args:
             key_path: Path to private key file
             format: Export format ("pem" or "der")
-            
+
         Returns:
             Private key content in specified format
         """
         try:
-            with open(key_path, 'rb') as f:
+            with open(key_path, "rb") as f:
                 key_data = f.read()
-            
+
             if format.lower() == "pem":
-                return key_data.decode('utf-8')
+                return key_data.decode("utf-8")
             elif format.lower() == "der":
                 # Convert PEM to DER
-                from cryptography.hazmat.primitives.serialization import load_pem_private_key
+                from cryptography.hazmat.primitives.serialization import (
+                    load_pem_private_key,
+                )
+
                 key = load_pem_private_key(key_data, password=None)
                 return key.private_bytes(
                     encoding=serialization.Encoding.DER,
                     format=serialization.PrivateFormat.PKCS8,
-                    encryption_algorithm=serialization.NoEncryption()
+                    encryption_algorithm=serialization.NoEncryption(),
                 )
             else:
                 raise ValueError(f"Unsupported format: {format}")
-                
+
         except Exception as e:
             self.logger.error(f"Failed to export private key: {str(e)}")
             raise CertificateGenerationError(f"Failed to export private key: {str(e)}")
@@ -1849,7 +1912,7 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
         # Skip validation if certificate management is disabled
         if not self.config.enabled:
             return
-            
+
         if not self.config.ca_cert_path:
             raise CertificateConfigurationError("CA certificate path is required")