diff --git a/tests/x509/verification/test_verification.py b/tests/x509/verification/test_verification.py index d4b0bc07d606..608d81f54a5b 100644 --- a/tests/x509/verification/test_verification.py +++ b/tests/x509/verification/test_verification.py @@ -103,3 +103,27 @@ def test_store_rejects_empty_list(self): def test_store_rejects_non_certificates(self): with pytest.raises(TypeError): Store(["not a cert"]) # type: ignore[list-item] + + +class TestServerVerifier: + def test_verify_tz_aware(self): + # expires 2018-11-16 01:15:03 GMT + leaf = _load_cert( + os.path.join("x509", "cryptography.io.pem"), + x509.load_pem_x509_certificate, + ) + + store = Store([leaf]) + + builder = PolicyBuilder().store(store) + # 00:15:03 in GMT+2, or 02:15:03 local time + builder = builder.time( + datetime.datetime.fromisoformat("2018-11-16T00:15:03+02:00") + ) + verifier = builder.build_server_verifier(DNSName("cryptography.io")) + + with pytest.raises( + x509.verification.VerificationError, + match="cert is not valid at validation time", + ): + verifier.verify(leaf, [])