mcp-security-framework 2.1.0__tar.gz → 2.2.0__tar.gz

{mcp_security_framework-2.1.0 → mcp_security_framework-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.1.0
+Version: 2.2.0
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>

{mcp_security_framework-2.1.0 → mcp_security_framework-2.2.0}/mcp_security_framework/__init__.py

@@ -79,7 +79,7 @@ from mcp_security_framework.schemas.responses import (
 )
 
 # Version information
-__version__ = "2.1.0"
+__version__ = "2.2.0"
 __author__ = "Vasiliy Zdanovskiy"
 __email__ = "vasilyvz@gmail.com"
 __license__ = "MIT"

{mcp_security_framework-2.1.0 → mcp_security_framework-2.2.0}/mcp_security_framework/core/cert_manager.py

@@ -36,6 +36,7 @@ from typing import Any, Dict, List, Optional, Tuple, Union
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import ec, ed448, ed25519, rsa
+from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
 from cryptography.x509.oid import ExtendedKeyUsageOID, ExtensionOID, NameOID
 
 from mcp_security_framework.schemas.config import (
@@ -53,6 +54,7 @@ from mcp_security_framework.schemas.models import (
     UnknownRoleError,
 )
 from mcp_security_framework.utils.cert_utils import (
+    CertificateError,
     extract_permissions_from_certificate,
     extract_roles_from_certificate,
     get_certificate_expiry,
@@ -61,6 +63,7 @@ from mcp_security_framework.utils.cert_utils import (
     is_certificate_revoked,
     is_crl_valid,
     parse_certificate,
+    parse_private_key,
     validate_certificate_against_crl,
     validate_certificate_chain,
 )
@@ -123,6 +126,39 @@ def _get_signing_algorithm(private_key):
     return hashes.SHA256()
 
 
+def _load_private_key(
+    key_bytes: bytes,
+    password: Optional[bytes],
+    source: str,
+) -> PrivateKeyTypes:
+    """
+    Load a private key from PEM or DER bytes with optional passphrase.
+
+    This helper wraps parse_private_key to attach a source label and convert
+    from CertificateError (raised by parse_private_key) to CertificateValidationError
+    (expected by callers in this module). The classification of whether the key
+    is encrypted, whether a password was supplied, and whether the password is
+    correct all lives in parse_private_key; this wrapper's only job is to add
+    the source context and bridge the exception type.
+
+    Args:
+        key_bytes: The PEM or DER-encoded private key
+        password: Optional passphrase as bytes, or None
+        source: Human-readable label for error messages (e.g. "CA private key",
+                "Parent CA private key"). Included in all error messages.
+
+    Returns:
+        Loaded private key object
+
+    Raises:
+        CertificateValidationError: When the key cannot be loaded or decrypted
+    """
+    try:
+        return parse_private_key(key_bytes, password=password)
+    except CertificateError as exc:
+        raise CertificateValidationError(f"{source}: {exc}", error_code=-32003) from exc
+
+
 def _subject_attribute(certificate, oid) -> str:
     """
     Return one subject attribute of a certificate, or "" when it carries none.
@@ -616,8 +652,15 @@ class CertificateManager:
                 parent_ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(intermediate_config.parent_ca_key, "rb") as f:
-                parent_ca_key = serialization.load_pem_private_key(
-                    f.read(), password=None
+                password = (
+                    intermediate_config.parent_ca_key_password.encode()
+                    if intermediate_config.parent_ca_key_password
+                    else None
+                )
+                parent_ca_key = _load_private_key(
+                    f.read(),
+                    password=password,
+                    source="Parent CA private key",
                 )
 
             # Generate intermediate CA private key
@@ -878,7 +921,16 @@ class CertificateManager:
                 ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(client_config.ca_key_path, "rb") as f:
-                ca_key = serialization.load_pem_private_key(f.read(), password=None)
+                password = (
+                    client_config.ca_key_password.encode()
+                    if client_config.ca_key_password
+                    else None
+                )
+                ca_key = _load_private_key(
+                    f.read(),
+                    password=password,
+                    source="CA private key",
+                )
 
             # Verify that CA private key matches CA certificate
             _verify_ca_key_matches_cert(
@@ -1104,8 +1156,8 @@ class CertificateManager:
             )
         except (FileNotFoundError, PermissionError, ValueError):
             raise
-        except CertificateGenerationError:
-            # Re-raise CertificateGenerationError without wrapping
+        except (CertificateGenerationError, CertificateValidationError):
+            # Re-raise these without wrapping
             raise
         except Exception as e:
             self.logger.error(
@@ -1189,7 +1241,16 @@ class CertificateManager:
                 ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(server_config.ca_key_path, "rb") as f:
-                ca_key = serialization.load_pem_private_key(f.read(), password=None)
+                password = (
+                    server_config.ca_key_password.encode()
+                    if server_config.ca_key_password
+                    else None
+                )
+                ca_key = _load_private_key(
+                    f.read(),
+                    password=password,
+                    source="CA private key",
+                )
 
             # Verify that CA private key matches CA certificate
             _verify_ca_key_matches_cert(
@@ -1406,8 +1467,8 @@ class CertificateManager:
             )
         except (FileNotFoundError, PermissionError, ValueError):
             raise
-        except CertificateGenerationError:
-            # Re-raise CertificateGenerationError without wrapping
+        except (CertificateGenerationError, CertificateValidationError):
+            # Re-raise these without wrapping
             raise
         except Exception as e:
             self.logger.error(
@@ -1493,7 +1554,16 @@ class CertificateManager:
                 ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(ca_key_file, "rb") as f:
-                ca_key = serialization.load_pem_private_key(f.read(), password=None)
+                password = (
+                    self.config.ca_key_password.encode()
+                    if self.config.ca_key_password
+                    else None
+                )
+                ca_key = _load_private_key(
+                    f.read(),
+                    password=password,
+                    source="CA private key",
+                )
 
             # Create new certificate with extended validity
             builder = x509.CertificateBuilder()
@@ -1651,7 +1721,16 @@ class CertificateManager:
                 ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(ca_key_file, "rb") as f:
-                ca_key = serialization.load_pem_private_key(f.read(), password=None)
+                password = (
+                    self.config.ca_key_password.encode()
+                    if self.config.ca_key_password
+                    else None
+                )
+                ca_key = _load_private_key(
+                    f.read(),
+                    password=password,
+                    source="CA private key",
+                )
 
             # Create CRL builder
             builder = x509.CertificateRevocationListBuilder()
@@ -2165,8 +2244,15 @@ class CertificateManager:
             # Load CA private key
             with open(ca_key_path, "rb") as f:
                 ca_key_data = f.read()
-            ca_private_key = serialization.load_pem_private_key(
-                ca_key_data, password=None
+            password = (
+                self.config.ca_key_password.encode()
+                if self.config.ca_key_password
+                else None
+            )
+            ca_private_key = _load_private_key(
+                ca_key_data,
+                password=password,
+                source="CA private key",
             )
 
             # Verify that CA private key matches CA certificate
@@ -2249,8 +2335,8 @@ class CertificateManager:
 
         except (FileNotFoundError, PermissionError, ValueError):
             raise
-        except CertificateGenerationError:
-            # Re-raise CertificateGenerationError without wrapping
+        except (CertificateGenerationError, CertificateValidationError):
+            # Re-raise these without wrapping
             raise
         except Exception as e:
             self.logger.error(
@@ -2495,11 +2581,16 @@ class CertificateManager:
                 return key_data.decode("utf-8")
             elif format.lower() == "der":
                 # Convert PEM to DER
-                from cryptography.hazmat.primitives.serialization import (
-                    load_pem_private_key,
+                password = (
+                    self.config.ca_key_password.encode()
+                    if self.config.ca_key_password
+                    else None
+                )
+                key = _load_private_key(
+                    key_data,
+                    password=password,
+                    source="Private key",
                 )
-
-                key = load_pem_private_key(key_data, password=None)
                 return key.private_bytes(
                     encoding=serialization.Encoding.DER,
                     format=serialization.PrivateFormat.PKCS8,

{mcp_security_framework-2.1.0 → mcp_security_framework-2.2.0}/mcp_security_framework/core/ssl_manager.py

@@ -24,7 +24,9 @@ License: MIT
 """
 
 import logging
+import os
 import ssl
+import tempfile
 from pathlib import Path
 from typing import Dict, List, Optional
 
@@ -42,6 +44,39 @@ from ..utils.cert_utils import (
 from .cert_manager import CertificateValidationError, _certificate_type_of
 
 
+def _stage_pem_material(data: bytes, label: str) -> str:
+    """
+    Write PEM bytes to a private temporary file and return its path.
+
+    The file descriptor from tempfile.mkstemp is taken ownership of by os.fdopen,
+    which ensures it is closed exactly once when the stream closes. This avoids
+    the double-close bug that occurs when a descriptor is closed manually and then
+    closed again in a finally block, which can close unrelated files opened in
+    between.
+
+    Args:
+        data: PEM-encoded bytes to write
+        label: Prefix for the temporary file (for debugging)
+
+    Returns:
+        Path to the temporary file
+
+    Raises:
+        OSError: If file creation or writing fails
+    """
+    # Note: the chmod call once done here would have been 0600, but
+    # tempfile.mkstemp already creates files with mode 0600, so an
+    # explicit chmod was redundant; removed to avoid reader confusion.
+    handle, path = tempfile.mkstemp(prefix="mcp-ssl-", suffix=".pem")
+    try:
+        with os.fdopen(handle, "wb") as stream:
+            stream.write(data)
+    except BaseException:
+        os.unlink(path)
+        raise
+    return path
+
+
 class SSLManager:
     """
     SSL/TLS Management Class
@@ -112,6 +147,8 @@ class SSLManager:
         self,
         cert_file: Optional[str] = None,
         key_file: Optional[str] = None,
+        cert_data: Optional[bytes] = None,
+        key_data: Optional[bytes] = None,
         ca_cert_file: Optional[str] = None,
         verify_mode: Optional[str] = None,
         min_version: Optional[str] = None,
@@ -126,10 +163,20 @@ class SSLManager:
         Args:
             cert_file (Optional[str]): Path to server certificate file.
                 If None, uses certificate from config. Must be a valid PEM
-                or DER certificate file path.
+                or DER certificate file path. Incompatible with cert_data.
             key_file (Optional[str]): Path to server private key file.
                 If None, uses key from config. Must be a valid PEM or DER
-                private key file path.
+                private key file path. Incompatible with key_data.
+            cert_data (Optional[bytes]): Server certificate as PEM bytes.
+                If provided, used instead of cert_file. Incompatible with cert_file.
+                When supplied, bytes are staged to a temporary file (mode 0600)
+                for loading, then deleted. This is a stdlib constraint:
+                ssl.SSLContext.load_cert_chain requires real files.
+            key_data (Optional[bytes]): Server private key as PEM bytes.
+                If provided, used instead of key_file. Incompatible with key_file.
+                When supplied, bytes are staged to a temporary file (mode 0600)
+                for loading, then deleted. This is a stdlib constraint:
+                ssl.SSLContext.load_cert_chain requires real files.
             ca_cert_file (Optional[str]): Path to CA certificate file for
                 client certificate verification. If None, uses CA from config.
                 Must be a valid PEM certificate file path.
@@ -167,26 +214,44 @@ class SSLManager:
             >>> # Use context for HTTPS server
         """
         try:
+            # Validate cert_data/key_data compatibility
+            if cert_data is not None and key_data is None:
+                raise SSLConfigurationError(
+                    "cert_data supplied without key_data; both must be present"
+                )
+            if key_data is not None and cert_data is None:
+                raise SSLConfigurationError(
+                    "key_data supplied without cert_data; both must be present"
+                )
+
             # Use config values if not provided
-            cert_file = cert_file or self.config.cert_file
-            key_file = key_file or self.config.key_file
+            if cert_data is None:
+                cert_file = cert_file or self.config.cert_file
+            if key_data is None:
+                key_file = key_file or self.config.key_file
             ca_cert_file = ca_cert_file or self.config.ca_cert_file
             verify_mode = verify_mode or self.config.verify_mode
             min_version = min_version or self.config.min_tls_version
 
-            # Validate required files
-            if not cert_file:
-                raise SSLConfigurationError("Server certificate file is required")
-            if not key_file:
-                raise SSLConfigurationError("Server private key file is required")
+            # Validate required files or data
+            if cert_data is None and not cert_file:
+                raise SSLConfigurationError(
+                    "Server certificate file or data is required"
+                )
+            if key_data is None and not key_file:
+                raise SSLConfigurationError(
+                    "Server private key file or data is required"
+                )
 
-            # Check cache
-            cache_key = (
-                f"server_{cert_file}_{key_file}_{ca_cert_file}"
-                f"_{verify_mode}_{min_version}"
-            )
-            if cache_key in self._contexts:
-                return self._contexts[cache_key]
+            # Check cache (only for file-based contexts)
+            cache_key = None
+            if cert_data is None and key_data is None:
+                cache_key = (
+                    f"server_{cert_file}_{key_file}_{ca_cert_file}"
+                    f"_{verify_mode}_{min_version}"
+                )
+                if cache_key in self._contexts:
+                    return self._contexts[cache_key]
 
             # Create SSL context
             context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
@@ -197,8 +262,43 @@ class SSLManager:
             # Set minimum TLS version
             context.minimum_version = self._get_tls_version(min_version)
 
-            # Load certificate and key
-            context.load_cert_chain(cert_file, key_file)
+            # Load certificate and key from data or files
+            if cert_data is not None and key_data is not None:
+                # Stage in-memory data to temporary files for loading
+                cert_temp = _stage_pem_material(cert_data, "cert")
+                key_temp = _stage_pem_material(key_data, "key")
+                try:
+                    # Load from temporary files with password from config
+                    password = (
+                        self.config.key_password.encode()
+                        if self.config.key_password
+                        else None
+                    )
+                    if password is not None:
+                        context.load_cert_chain(cert_temp, key_temp, password=password)
+                    else:
+                        context.load_cert_chain(cert_temp, key_temp)
+                finally:
+                    # Clean up temporary files
+                    try:
+                        os.unlink(cert_temp)
+                    except OSError:
+                        pass
+                    try:
+                        os.unlink(key_temp)
+                    except OSError:
+                        pass
+            else:
+                # Load from files with password from config
+                password = (
+                    self.config.key_password.encode()
+                    if self.config.key_password
+                    else None
+                )
+                if password is not None:
+                    context.load_cert_chain(cert_file, key_file, password=password)
+                else:
+                    context.load_cert_chain(cert_file, key_file)
 
             # Load CA certificate if provided
             if ca_cert_file:
@@ -208,14 +308,16 @@ class SSLManager:
             if self.config.cipher_suite:
                 context.set_ciphers(self.config.cipher_suite)
 
-            # Cache context
-            self._contexts[cache_key] = context
+            # Cache context (only for file-based contexts)
+            if cache_key is not None:
+                self._contexts[cache_key] = context
 
             self.logger.info(
                 "Server SSL context created successfully",
                 extra={
                     "cert_file": cert_file,
                     "key_file": key_file,
+                    "cert_data_provided": cert_data is not None,
                     "verify_mode": verify_mode,
                     "min_version": min_version,
                 },
@@ -226,7 +328,7 @@ class SSLManager:
         except Exception as e:
             self.logger.error(
                 "Failed to create server SSL context",
-                extra={"cert_file": cert_file, "key_file": key_file, "error": str(e)},
+                extra={"error": str(e)},
             )
             raise SSLConfigurationError(
                 f"Failed to create server SSL context: {str(e)}"
@@ -237,6 +339,8 @@ class SSLManager:
         ca_cert_file: Optional[str] = None,
         client_cert_file: Optional[str] = None,
         client_key_file: Optional[str] = None,
+        cert_data: Optional[bytes] = None,
+        key_data: Optional[bytes] = None,
         verify_mode: Optional[str] = None,
         min_version: Optional[str] = None,
     ) -> ssl.SSLContext:
@@ -253,10 +357,20 @@ class SSLManager:
                 Must be a valid PEM certificate file path.
             client_cert_file (Optional[str]): Path to client certificate file
                 for client authentication. If None, uses client cert from config.
-                Must be a valid PEM certificate file path.
+                Must be a valid PEM certificate file path. Incompatible with cert_data.
             client_key_file (Optional[str]): Path to client private key file.
                 If None, uses client key from config. Must be a valid PEM
-                private key file path.
+                private key file path. Incompatible with key_data.
+            cert_data (Optional[bytes]): Client certificate as PEM bytes.
+                If provided, used instead of client_cert_file. Incompatible with
+                client_cert_file. When supplied, bytes are staged to a temporary
+                file (mode 0600) for loading, then deleted. This is a stdlib
+                constraint: ssl.SSLContext.load_cert_chain requires real files.
+            key_data (Optional[bytes]): Client private key as PEM bytes.
+                If provided, used instead of client_key_file. Incompatible with
+                client_key_file. When supplied, bytes are staged to a temporary
+                file (mode 0600) for loading, then deleted. This is a stdlib
+                constraint: ssl.SSLContext.load_cert_chain requires real files.
             verify_mode (Optional[str]): SSL verification mode. Valid values:
                 - "CERT_NONE": No certificate verification
                 - "CERT_OPTIONAL": Certificate verification optional
@@ -290,20 +404,34 @@ class SSLManager:
             >>> # Use context for HTTPS client
         """
         try:
+            # Validate cert_data/key_data compatibility
+            if cert_data is not None and key_data is None:
+                raise SSLConfigurationError(
+                    "cert_data supplied without key_data; both must be present"
+                )
+            if key_data is not None and cert_data is None:
+                raise SSLConfigurationError(
+                    "key_data supplied without cert_data; both must be present"
+                )
+
             # Use config values if not provided
+            if cert_data is None:
+                client_cert_file = client_cert_file or self.config.client_cert_file
+            if key_data is None:
+                client_key_file = client_key_file or self.config.client_key_file
             ca_cert_file = ca_cert_file or self.config.ca_cert_file
-            client_cert_file = client_cert_file or self.config.client_cert_file
-            client_key_file = client_key_file or self.config.client_key_file
             verify_mode = verify_mode or self.config.verify_mode
             min_version = min_version or self.config.min_tls_version
 
-            # Check cache
-            cache_key = (
-                f"client_{ca_cert_file}_{client_cert_file}_{client_key_file}"
-                f"_{verify_mode}_{min_version}"
-            )
-            if cache_key in self._contexts:
-                return self._contexts[cache_key]
+            # Check cache (only for file-based contexts)
+            cache_key = None
+            if cert_data is None and key_data is None:
+                cache_key = (
+                    f"client_{ca_cert_file}_{client_cert_file}_{client_key_file}"
+                    f"_{verify_mode}_{min_version}"
+                )
+                if cache_key in self._contexts:
+                    return self._contexts[cache_key]
 
             # Determine actual verify mode (explicit parameter takes precedence)
             actual_verify_mode = (
@@ -324,8 +452,45 @@ class SSLManager:
 
                 # Load client certificates for mTLS even when verification is
                 # disabled
-                if client_cert_file and client_key_file:
-                    context.load_cert_chain(client_cert_file, client_key_file)
+                if cert_data is not None and key_data is not None:
+                    # Stage in-memory data to temporary files for loading
+                    cert_temp = _stage_pem_material(cert_data, "cert")
+                    key_temp = _stage_pem_material(key_data, "key")
+                    try:
+                        # Load from temporary files with password from config
+                        password = (
+                            self.config.client_key_password.encode()
+                            if self.config.client_key_password
+                            else None
+                        )
+                        if password is not None:
+                            context.load_cert_chain(
+                                cert_temp, key_temp, password=password
+                            )
+                        else:
+                            context.load_cert_chain(cert_temp, key_temp)
+                    finally:
+                        # Clean up temporary files
+                        try:
+                            os.unlink(cert_temp)
+                        except OSError:
+                            pass
+                        try:
+                            os.unlink(key_temp)
+                        except OSError:
+                            pass
+                elif client_cert_file and client_key_file:
+                    password = (
+                        self.config.client_key_password.encode()
+                        if self.config.client_key_password
+                        else None
+                    )
+                    if password is not None:
+                        context.load_cert_chain(
+                            client_cert_file, client_key_file, password=password
+                        )
+                    else:
+                        context.load_cert_chain(client_cert_file, client_key_file)
             else:
                 # For other modes, use default context with verification
                 context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
@@ -339,21 +504,60 @@ class SSLManager:
                     context.load_verify_locations(ca_cert_file)
 
                 # Load client certificate and key if provided (for mTLS)
-                if client_cert_file and client_key_file:
-                    context.load_cert_chain(client_cert_file, client_key_file)
+                if cert_data is not None and key_data is not None:
+                    # Stage in-memory data to temporary files for loading
+                    cert_temp = _stage_pem_material(cert_data, "cert")
+                    key_temp = _stage_pem_material(key_data, "key")
+                    try:
+                        # Load from temporary files with password from config
+                        password = (
+                            self.config.client_key_password.encode()
+                            if self.config.client_key_password
+                            else None
+                        )
+                        if password is not None:
+                            context.load_cert_chain(
+                                cert_temp, key_temp, password=password
+                            )
+                        else:
+                            context.load_cert_chain(cert_temp, key_temp)
+                    finally:
+                        # Clean up temporary files
+                        try:
+                            os.unlink(cert_temp)
+                        except OSError:
+                            pass
+                        try:
+                            os.unlink(key_temp)
+                        except OSError:
+                            pass
+                elif client_cert_file and client_key_file:
+                    password = (
+                        self.config.client_key_password.encode()
+                        if self.config.client_key_password
+                        else None
+                    )
+                    if password is not None:
+                        context.load_cert_chain(
+                            client_cert_file, client_key_file, password=password
+                        )
+                    else:
+                        context.load_cert_chain(client_cert_file, client_key_file)
 
             # Configure cipher suites
             if self.config.cipher_suite:
                 context.set_ciphers(self.config.cipher_suite)
 
-            # Cache context
-            self._contexts[cache_key] = context
+            # Cache context (only for file-based contexts)
+            if cache_key is not None:
+                self._contexts[cache_key] = context
 
             self.logger.info(
                 "Client SSL context created successfully",
                 extra={
                     "ca_cert_file": ca_cert_file,
                     "client_cert_file": client_cert_file,
+                    "cert_data_provided": cert_data is not None,
                     "verify_mode": verify_mode,
                     "min_version": min_version,
                 },
@@ -365,8 +569,6 @@ class SSLManager:
             self.logger.error(
                 "Failed to create client SSL context",
                 extra={
-                    "ca_cert_file": ca_cert_file,
-                    "client_cert_file": client_cert_file,
                     "error": str(e),
                 },
             )
@@ -709,7 +911,8 @@ class SSLManager:
         Check certificate expiry information.
 
         This method provides detailed information about certificate
-        expiry including days until expiry and expiry status.
+        expiry including days until expiry and expiry status. The window
+        for flagging "expires_soon" is controlled by SSLConfig.expiry_warning_days.
 
         Args:
             cert_path (str): Path to certificate file. Must be a valid
@@ -721,7 +924,8 @@ class SSLManager:
                 - not_before: Certificate validity start date
                 - days_until_expiry: Days until certificate expires
                 - is_expired: Whether certificate is expired
-                - expires_soon: Whether certificate expires within 30 days
+                - expires_soon: Whether certificate expires within the configured
+                  warning window (SSLConfig.expiry_warning_days)
                 - status: Expiry status (valid, expires_soon, expired)
                 - total_seconds_until_expiry: Seconds until expiry
 
@@ -741,7 +945,9 @@ class SSLManager:
             ...     print(f"Certificate expires in {days} days")
         """
         try:
-            expiry_info = get_certificate_expiry(cert_path)
+            expiry_info = get_certificate_expiry(
+                cert_path, warn_days=self.config.expiry_warning_days
+            )
 
             self.logger.info(
                 "Certificate expiry check completed",