docs: def validate(message, ssldir=None, **config):
      """
      Validate the signature on the given message.
  
      Four things must be true for the signature to be valid:
  
        1) The X.509 cert must be signed by our CA
        2) The cert must not be in our CRL.
        3) We must be able to verify the signature using the RSA public key
           contained in the X.509 cert.
        4) The topic of the message and the CN on the cert must appear in the
           :ref:`conf-routing-policy` dict.
  
      Args:
          message (dict): A signed message in need of validation. A signed message
              contains the 'signature' and 'certificate' keys.
          ssldir (str): The path to the directory containing PEM-encoded X.509
              key pairs.
  
      Returns:
          bool: True of the message passes validation, False otherwise.
      """
      for field in ['signature', 'certificate']:
          if field not in message:
              _log.warn('No %s field found.', field)
              return False
          if not isinstance(message[field], six.text_type):
              _log.error('msg[%r] is not a unicode string' % field)
              try:
                  # Make an effort to decode it, it's very likely utf-8 since that's what
                  # is hardcoded throughout fedmsg. Worst case scenario is it'll cause a
                  # validation error when there shouldn't be one.
                  message[field] = message[field].decode('utf-8')
              except UnicodeError as e:
                  _log.error("Unable to decode the message '%s' field: %s", field, str(e))
                  return False
  
      signature = base64.b64decode(message['signature'])
      certificate = base64.b64decode(message['certificate'])
      message = fedmsg.crypto.strip_credentials(message)
  
      # Unfortunately we can't change this defaulting to Fedora behavior until
      # fedmsg-2.0
      ca_location = config.get('ca_cert_location', 'https://fedoraproject.org/fedmsg/ca.crt')
      crl_location = config.get('crl_location', 'https://fedoraproject.org/fedmsg/crl.pem')
      try:
          ca_certificate, crl = utils.load_certificates(ca_location, crl_location)
          _validate_signing_cert(ca_certificate, certificate, crl)
      except (IOError, RequestException, X509StoreContextError) as e:
          # Maybe the CA/CRL is expired or just rotated, so invalidate the cache and try again
          try:
              ca_certificate, crl = utils.load_certificates(
                  ca_location, crl_location, invalidate_cache=True)
              _validate_signing_cert(ca_certificate, certificate, crl)
          except (IOError, RequestException, X509StoreContextError) as e:
              _log.error(str(e))
              return False
  
      # Validate the signature of the message itself
      try:
          crypto_certificate = x509.load_pem_x509_certificate(certificate, default_backend())
          crypto_certificate.public_key().verify(
              signature,
              fedmsg.encoding.dumps(message).encode('utf-8'),
              asymmetric.padding.PKCS1v15(),
              hashes.SHA1(),
          )
      except InvalidSignature as e:
          _log.error('message [{m}] has an invalid signature: {e}'.format(
              m=message, e=str(e)))
          return False
  
      # Step 4, check that the certificate is permitted to emit messages for the
      # topic.
      common_name = crypto_certificate.subject.get_attributes_for_oid(x509.oid.NameOID.COMMON_NAME)
      common_name = common_name[0]
      routing_policy = config.get('routing_policy', {})
      nitpicky = config.get('routing_nitpicky', False)
      return utils.validate_policy(
          message.get('topic'), common_name.value, routing_policy, nitpicky=nitpicky)