code: def certificate(self):
          
          if not hasattr(self, '_certificate'):
              cert_url = self._get_cert_url()
              # Only load certificates from a certain domain?
              # Without some kind of trusted domain check, any old joe could
              # craft a bounce message and sign it using his own certificate
              # and we would happily load and verify it.
  
              if not cert_url:
                  self._certificate = None
                  return self._certificate
  
              try:
                  import requests
              except ImportError:
                  raise ImproperlyConfigured("requests is required for bounce message verification.")
  
              try:
                  import M2Crypto
              except ImportError:
                  raise ImproperlyConfigured("M2Crypto is required for bounce message verification.")
  
              # We use requests because it verifies the https certificate
              # when retrieving the signing certificate. If https was somehow
              # hijacked then all bets are off.
              response = requests.get(cert_url)
              if response.status_code != 200:
                  logger.warning(u'Could not download certificate from %s: "%s"', cert_url, response.status_code)
                  self._certificate = None
                  return self._certificate
  
              # Handle errors loading the certificate.
              # If the certificate is invalid then return
              # false as we couldn't verify the message.
              try:
                  self._certificate = M2Crypto.X509.load_cert_string(response.content)
              except M2Crypto.X509.X509Error as e:
                  logger.warning(u'Could not load certificate from %s: "%s"', cert_url, e)
                  self._certificate = None
  
          return self._certificate
docs: Retrieves the certificate used to sign the bounce message.
  
          TODO: Cache the certificate based on the cert URL so we don't have to
          retrieve it for each bounce message. *We would need to do it in a
          secure way so that the cert couldn't be overwritten in the cache*