def test_verify_crl_unreachable(cert_builder, private_key):
    """Unreachable CRL distribution point results in error."""
    ldap_uri = "http://invalid.example.org/crl/foobar.crl"
    with requests_mock.Mocker() as m:
        m.get(ldap_uri, exc=requests.exceptions.Timeout)
        crl_dp = x509.DistributionPoint(
            [UniformResourceIdentifier(ldap_uri)],
            relative_name=None,
            reasons=None,
            crl_issuer=None,
        )
        cert = cert_builder.add_extension(
            x509.CRLDistributionPoints([crl_dp]), critical=False
        ).sign(private_key, hashes.SHA256(), default_backend())

        with mktempfile() as cert_tmp:
            with open(cert_tmp, "wb") as f:
                f.write(cert.public_bytes(serialization.Encoding.PEM))

            with pytest.raises(Exception, match="Unable to retrieve CRL:"):
                crl_verify(cert, cert_tmp)
Unreachable CRL distribution point results in error.
lemur/tests/test_verify.py