code: def validate_tls_hostname(validation_context, cert, hostname):
      
  
      if not isinstance(validation_context, ValidationContext):
          raise TypeError(pretty_message(
              '''
              validation_context must be an instance of
              certvalidator.context.ValidationContext, not %s
              ''',
              type_name(validation_context)
          ))
  
      if validation_context.is_whitelisted(cert):
          return
  
      if not cert.is_valid_domain_ip(hostname):
          raise InvalidCertificateError(pretty_message(
              '''
              The X.509 certificate provided is not valid for %s. Valid hostnames
              include: %s
              ''',
              hostname,
              ', '.join(cert.valid_domains)
          ))
  
      bad_key_usage = cert.key_usage_value and 'digital_signature' not in cert.key_usage_value.native
      bad_ext_key_usage = cert.extended_key_usage_value and 'server_auth' not in cert.extended_key_usage_value.native
  
      if bad_key_usage or bad_ext_key_usage:
          raise InvalidCertificateError(pretty_message(
              '''
              The X.509 certificate provided is not valid for securing TLS
              connections
              '''
          ))
docs: Validates the end-entity certificate from a
      certvalidator.path.ValidationPath object to ensure that the certificate
      is valid for the hostname provided and that the certificate is valid for
      the purpose of a TLS connection.
  
      THE CERTIFICATE PATH MUST BE VALIDATED SEPARATELY VIA validate_path()!
  
      :param validation_context:
          A certvalidator.context.ValidationContext object to use for
          configuring validation behavior
  
      :param cert:
          An asn1crypto.x509.Certificate object returned from validate_path()
  
      :param hostname:
          A unicode string of the TLS server hostname
  
      :raises:
          certvalidator.errors.InvalidCertificateError - when the certificate is not valid for TLS or the hostname