'Verify server certificate
@type connection: OpenSSL.SSL.Connection
@param connection: SSL connection object
@type peerCert: basestring
@param peerCert: server host certificate as OpenSSL.crypto.X509
instance
@type errorStatus: int
@param errorStatus: error status passed from caller.  This is the value
returned by the OpenSSL C function X509_STORE_CTX_get_error().  Look-up
x509_vfy.h in the OpenSSL source to get the meanings of the different
codes.  PyOpenSSL doesn\'t help you!
@type errorDepth: int
@param errorDepth: a non-negative integer representing where in the
certificate chain the error occurred. If it is zero it occured in the
end entity certificate, one if it is the certificate which signed the
end entity certificate and so on.
@type preverifyOK: int
@param preverifyOK: the error status - 0 = Error, 1 = OK of the current
SSL context irrespective of any verification checks done here.  If this
function yields an OK status, it should enforce the preverifyOK value
so that any error set upstream overrides and is honoured.
@rtype: int
@return: status code - 0/False = Error, 1/True = OK'

def __call__(self, connection, peerCert, errorStatus, errorDepth, preverifyOK):

    if peerCert.has_expired():
        log.error('Certificate    %r    in    peer    certificate    chain    has    expired', peerCert.get_subject())
        return False
    elif (errorDepth == 0):
        peerCertSubj = peerCert.get_subject()
        peerCertDN = peerCertSubj.get_components()
        peerCertDN.sort()
        if (self.certDN is None):
            if (self.hostname is None):
                log.error('No    "hostname"    or    "certDN"    set    to    check    peer    certificate    against')
                return False
            if self.__subj_alt_name_match:
                dns_names = self._get_subj_alt_name(peerCert)
                if (self.hostname in dns_names):
                    return preverifyOK
            if (peerCertSubj.commonName == self.hostname):
                return preverifyOK
            else:
                log.error("Peer    certificate    CN    %r    doesn't    match    the    expected    CN    %r", peerCertSubj.commonName, self.hostname)
                return False
        elif (peerCertDN == self.certDN):
            return preverifyOK
        else:
            log.error("Peer    certificate    DN    %r    doesn't    match    the    expected    DN    %r", peerCertDN, self.certDN)
            return False
    else:
        return preverifyOK
