def METHOD_NAME(ca, x509cert):
    try:
        res = ca.public_key().verify(
            x509cert.signature,
            x509cert.tbs_certificate_bytes,
            padding.PKCS1v15(),
            x509cert.signature_hash_algorithm,
        )
        if res is not None:
            raise RuntimeError('Certificate validation failed')
    except InvalidSignature:
        raise ValueError('Untrusted certificate')
    if not (
        x509cert.not_valid_before.replace(tzinfo=None) <=
        datetime.datetime.utcnow() <=
        x509cert.not_valid_after.replace(tzinfo=None)
    ):
        raise ValueError('Certificate expired')