如何验证python中的X509证书,包括CRL检查？

pip install cryptography

from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.serialization import pkcs12
from cryptography.x509.oid import NameOID

# 加载证书
cert_data = b'...'  # 证书数据
cert = x509.load_pem_x509_certificate(cert_data, default_backend())

# 加载私钥
key_data = b'...'  # 私钥数据
key = serialization.load_pem_private_key(key_data, password=None, backend=default_backend())

# 加载CRL
crl_data = b'...'  # CRL数据
crl = x509.load_pem_x509_crl(crl_data, default_backend())

# 验证证书
store = x509.Store()
store.add_crl(crl)
try:
    cert.public_key().verify(
        cert.signature,
        cert.tbs_certificate_bytes,
        padding.PKCS1v15(),
        cert.signature_hash_algorithm
    )
    store_context = x509.StoreContext(store, cert)
    store_context.verify_certificate()
    print('证书验证成功')
except Exception as e:
    print('证书验证失败:', e)

# 验证私钥和证书是否匹配
try:
    if key.public_key().public_numbers() == cert.public_key().public_numbers():
        print('私钥和证书匹配')
    else:
        print('私钥和证书不匹配')
except Exception as e:
    print('私钥和证书验证失败:', e)