control: tags -1 + patch control: forwarded -1 https://github.com/psf/requests/issues/7617
Attaching the patch. Sebastian
>From 1e33543106fe2f141d2a98e881b2c2b5b26b8aab Mon Sep 17 00:00:00 2001 From: Sebastian Andrzej Siewior <[email protected]> Date: Mon, 31 Aug 2026 22:56:26 +0200 Subject: [PATCH] tests: Add SKID and AKID The openssl command used to have built-in logic to automaticaly add subjectKeyIdentifier and authorityKeyIdentifier to created certificates. This logic vanished in OpenSSL 4.0 and the extensions are missing. Python 3.13+ uses VERIFY_X509_STRICT to verify the certificate. Missing those attributes is an error. Add the Authority Key Identifier and Subject Key Identifier to the new creates certificates. Signed-off-by: Sebastian Andrzej Siewior <[email protected]> --- tests/certs/expired/ca/ca.cnf | 1 + tests/certs/expired/server/cert.cnf | 1 + tests/certs/valid/server/cert.cnf | 2 ++ 3 files changed, 4 insertions(+) diff --git a/tests/certs/expired/ca/ca.cnf b/tests/certs/expired/ca/ca.cnf index 09fcb6de1cfd..a6c05b97efce 100644 --- a/tests/certs/expired/ca/ca.cnf +++ b/tests/certs/expired/ca/ca.cnf @@ -15,3 +15,4 @@ CN = Self-Signed Root CA # common name / your cert name [v3_ca] basicConstraints = critical, CA:true keyUsage = critical, cRLSign, digitalSignature, keyCertSign +subjectKeyIdentifier = hash diff --git a/tests/certs/expired/server/cert.cnf b/tests/certs/expired/server/cert.cnf index a773fc679f22..ec0634e0775f 100644 --- a/tests/certs/expired/server/cert.cnf +++ b/tests/certs/expired/server/cert.cnf @@ -16,6 +16,7 @@ basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names +subjectKeyIdentifier = hash [alt_names] DNS.1 = *.localhost diff --git a/tests/certs/valid/server/cert.cnf b/tests/certs/valid/server/cert.cnf index f9a01cd8b4ba..1ddf9e133ea3 100644 --- a/tests/certs/valid/server/cert.cnf +++ b/tests/certs/valid/server/cert.cnf @@ -23,6 +23,8 @@ basicConstraints = critical, CA:FALSE keyUsage = critical, digitalSignature, keyEncipherment extendedKeyUsage = critical, serverAuth subjectAltName = critical, @alt_names +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid, issuer [alt_names] DNS.1 = *.localhost -- 2.55.0
