Validate a server's certificate in Python 3 using only the standard library + certifi

_ssl_util.py

import datetime
from enum import Enum
import socket
import ssl

import certifi


class CertificateStatus(Enum):
    UNKNOWN = -1
    CONNECTION_ERROR = 100
    VALID = 200
    INVALID = 500


def get_cert(host_ip, sni_name, port=443):
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
    context.load_verify_locations(certifi.where())

    status = CertificateStatus.UNKNOWN
    peer_cert = None

    try:
        with socket.create_connection((host_ip, port), timeout=5) as sock:
            with context.wrap_socket(sock, server_hostname=sni_name) as ssock:
                peer_cert = ssock.getpeercert()
                status = CertificateStatus.VALID
    except ssl.SSLError:
        status = CertificateStatus.INVALID
    except Exception:
        status = CertificateStatus.CONNECTION_ERROR

    return status, peer_cert


def get_cert_ttl_days(cert):    
    exp_date = datetime.datetime.strptime(cert['notAfter'], '%b %d %H:%M:%S %Y GMT')    

    cur_date = datetime.datetime.utcnow()
    days_to_expire = int((exp_date - cur_date).days)

    return days_to_expire