docs: def _m2crypto_validate(message, ssldir=None, **config):
      """ Return true or false if the message is signed appropriately.
  
      Four things must be true:
  
        1) The X509 cert must be signed by our CA
        2) The cert must not be in our CRL.
        3) We must be able to verify the signature using the RSA public key
           contained in the X509 cert.
        4) The topic of the message and the CN on the cert must appear in the
           :ref:`conf-routing-policy` dict.
  
      """
  
      if ssldir is None:
          raise ValueError("You must set the ssldir keyword argument.")
  
      def fail(reason):
          _log.warn("Failed validation.  %s" % reason)
          return False
  
      # Some sanity checking
      for field in ['signature', 'certificate']:
          if field not in message:
              return fail("No %r field found." % field)
          if not isinstance(message[field], six.text_type):
              _log.error('msg[%r] is not a unicode string' % field)
              try:
                  # Make an effort to decode it, it's very likely utf-8 since that's what
                  # is hardcoded throughout fedmsg. Worst case scenario is it'll cause a
                  # validation error when there shouldn't be one.
                  message[field] = message[field].decode('utf-8')
              except UnicodeError as e:
                  _log.error("Unable to decode the message '%s' field: %s", field, str(e))
                  return False
  
      # Peal off the auth datums
      signature = message['signature'].decode('base64')
      certificate = message['certificate'].decode('base64')
      message = fedmsg.crypto.strip_credentials(message)
  
      # Build an X509 object
      cert = M2Crypto.X509.load_cert_string(certificate)
  
      # Validate the cert.  Make sure it is signed by our CA.
      #   validate_certificate will one day be a part of M2Crypto.SSL.Context
      #   https://bugzilla.osafoundation.org/show_bug.cgi?id=11690
  
      ca_location = config.get('ca_cert_location', 'https://fedoraproject.org/fedmsg/ca.crt')
      crl_location = config.get('crl_location', 'https://fedoraproject.org/fedmsg/crl.pem')
      fd, cafile = tempfile.mkstemp()
      try:
          ca_certificate, crl = utils.load_certificates(ca_location, crl_location)
          os.write(fd, ca_certificate.encode('ascii'))
          os.fsync(fd)
          ctx = m2ext.SSL.Context()
          ctx.load_verify_locations(cafile=cafile)
          if not ctx.validate_certificate(cert):
              ca_certificate, crl = utils.load_certificates(
                  ca_location, crl_location, invalidate_cache=True)
              with open(cafile, 'w') as f:
                  f.write(ca_certificate)
              ctx = m2ext.SSL.Context()
              ctx.load_verify_locations(cafile=cafile)
              if not ctx.validate_certificate(cert):
                  return fail("X509 certificate is not valid.")
      except (IOError, RequestException) as e:
          _log.error(str(e))
          return False
      finally:
          os.close(fd)
          os.remove(cafile)
  
      if crl:
          try:
              fd, crlfile = tempfile.mkstemp(text=True)
              os.write(fd, crl.encode('ascii'))
              os.fsync(fd)
              crl = M2Crypto.X509.load_crl(crlfile)
          finally:
              os.close(fd)
              os.remove(crlfile)
          # FIXME -- We need to check that the CRL is signed by our own CA.
          # See https://bugzilla.osafoundation.org/show_bug.cgi?id=12954#c2
          # if not ctx.validate_certificate(crl):
          #    return fail("X509 CRL is not valid.")
  
          # FIXME -- we check the CRL, but by doing string comparison ourselves.
          # This is not what we want to be doing.
          # There is a patch into M2Crypto to handle this for us.  We should use it
          # once its integrated upstream.
          # See https://bugzilla.osafoundation.org/show_bug.cgi?id=12954#c2
          revoked_serials = [long(line.split(': ')[1].strip(), base=16)
                             for line in crl.as_text().split('\n')
                             if 'Serial Number:' in line]
          if cert.get_serial_number() in revoked_serials:
              subject = cert.get_subject()
  
              signer = '(no CN)'
              if subject.nid.get('CN'):
                  entry = subject.get_entries_by_nid(subject.nid['CN'])[0]
                  if entry:
                      signer = entry.get_data().as_text()
  
              return fail("X509 cert %r, %r is in the Revocation List (CRL)" % (
                  signer, cert.get_serial_number()))
  
      # If the cert is good, then test to see if the signature in the messages
      # matches up with the provided cert.
      rsa_public = cert.get_pubkey().get_rsa()
      digest = M2Crypto.EVP.MessageDigest('sha1')
      digest.update(fedmsg.encoding.dumps(message))
      try:
          if not rsa_public.verify(digest.digest(), signature):
              raise M2Crypto.RSA.RSAError("RSA signature failed to validate.")
      except M2Crypto.RSA.RSAError as e:
          return fail(str(e))
  
      # Now we know that the cert is valid.  The message is *authenticated*.
      # * Next step:  Authorization *
  
      # Load our policy from the config dict.
      routing_policy = config.get('routing_policy', {})
  
      # Determine the name of the signer of the message.
      # This will be something like "shell-pkgs01.stg.phx2.fedoraproject.org"
      subject = cert.get_subject()
      signer = subject.get_entries_by_nid(subject.nid['CN'])[0]\
          .get_data().as_text()
  
      return utils.validate_policy(
          message.get('topic'), signer, routing_policy, config.get('routing_nitpicky', False))