def METHOD_NAME(logger, x509cert, ca_cert, name, extract, short_life,
                     environment):
    # input:
    # - logger: The logger to use for logging
    # - x509cert: cryptography.x509.Certificate object
    # - ca_cert: cryptography.x509.Certificate object
    # - name: A base name (--name param of pki-* scripts)
    # - extract: bool. If True, we need to check the extracted cert
    # - short_life: Whether the certificate is a short-life (e.g. browser)
    #   certificate.
    # - environment: Environment to pass to database.Statement
    # return: bool
    res = False
    if x509cert and (
        cert_expires(x509cert, short_life, environment, logger) or
        not cert_has_SAN(logger, x509cert)
    ):
        if not extract or ca_cert is None:
            # In remote machines (websocket-proxy/grafana), we do not
            # have a copy of the engine CA, and 'extract' is True (we
            # do not keep there a PKCS12 file). In this case, return
            # True - meaning, do allow renew/recreation. Callers should
            # first ask the user, clarifying this will use the engine CA.
            res = True
        else:
            internal = False
            try:
                if ca_cert.public_key().verify(
                    x509cert.signature,
                    x509cert.tbs_certificate_bytes,
                    padding.PKCS1v15(),
                    x509cert.signature_hash_algorithm,
                ) is not None:
                    raise RuntimeError('Certificate validation failed')
                internal = True
            except InvalidSignature:
                pass
            if internal:
                logger.debug(
                    'certificate is an internal certificate'
                )
                # sanity check, make sure user did not manually
                # change cert
                extracted_x509cert = x509_load_cert(
                    os.path.join(
                        (
                            oenginecons.FileLocations.
                            OVIRT_ENGINE_PKICERTSDIR
                        ),
                        '%s.cer' % name,
                    )
                )
                if (
                    extracted_x509cert.public_bytes(
                        encoding=serialization.Encoding.PEM
                    )
                ) == (
                    x509cert.public_bytes(
                        encoding=serialization.Encoding.PEM
                    )
                ):
                    logger.debug('certificate is sane')
                    res = True
    return res