nvflare.fuel.sec.admin_cert module

exception AdminCertValidationError[source]

Bases: ValueError

Raised when an admin certificate is not acceptable to a FLARE relying party.

validate_admin_leaf_cert(cert: Certificate, reject_placeholder_cn: bool = True)[source]

Validate the security-sensitive properties of a FLARE admin leaf certificate.

Legacy FLARE leaf certs may omit KeyUsage and EKU. Treat absent extensions as unrestricted for compatibility, but enforce admin-client usage constraints when the issuer includes them. Organization and role are optional authorization attributes: authentication must not require them or constrain roles to a built-in list because authorization policy supports custom roles.