Skip to content

Updated test certificate generation so newly created CA certs include proper X.509 CA key usage extensions, fixing Python/OpenSSL verification failures while preserving existing server cert generation behavior. - #93

Open
MauriceHendrix wants to merge 3 commits into
v1-update_debug_info_hmacfrom
v1-update_certificate_gen
Open

Conversation

@MauriceHendrix

@MauriceHendrix MauriceHendrix commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown

This is necessary for standards-compliant certificate path validation per RFC 5280.

For CA certificates, RFC 5280 expects CA capability to be expressed via:

Basic Constraints: CA:TRUE
Key Usage: includes keyCertSign (and commonly cRLSign)
Your old root cert had CA:TRUE but no CA key-usage extension, which OpenSSL/Python rejects during chain validation. Rust accepted it because its validator is more permissive, but strict RFC-style validators are not. Adding CA key usage makes the cert portable and valid across implementations.

Without it in python I get
Pairing connection failed: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: authority and subject key identifier mismatch (_ssl.c:1032) even with the certificate

the old version:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:ef:f7:12:20:6a:5b:9c:c1:1c:b6:1f:35:18:f3:4d:fb:36:40:c4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd
        Validity
            Not Before: Feb 10 08:27:44 2026 GMT
            Not After : Feb  9 08:27:44 2031 GMT
        Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d7:af:d9:ad:40:88:2f:68:30:64:c6:be:a6:c3:
                    95:15:83:d3:b1:df:97:b4:d6:b0:b3:d6:ba:e5:f4:
                    ca:92:73:d4:9a:2a:d8:c2:09:05:72:a2:da:24:1e:
                    c5:d3:e8:32:89:e0:7f:82:18:30:fe:63:c5:0b:84:
                    44:0d:ec:1f:15:49:f1:81:f2:08:3f:9c:3e:ca:1e:
                    4d:9d:cf:13:6d:f2:49:19:19:60:ca:6a:7c:96:59:
                    d6:b0:ae:c7:a0:70:0a:6f:c1:5d:9e:1d:ae:7f:f7:
                    8b:07:1e:42:42:64:d2:68:44:cb:66:a2:29:99:d2:
                    8f:38:f2:33:88:01:4a:12:a4:ed:5b:23:14:6a:ec:
                    dd:98:96:e2:55:68:c6:24:fd:4d:86:04:e7:f0:a6:
                    38:57:73:2e:f8:91:0a:ea:d6:61:b2:c8:4d:e1:cc:
                    95:20:b5:a4:46:94:3b:2f:a7:77:34:f7:d6:fd:3d:
                    dd:9f:44:09:aa:53:38:e2:8e:26:d0:7e:17:ae:ba:
                    6e:0a:08:bc:28:64:21:af:c2:76:38:89:03:3a:bd:
                    08:cd:63:4e:9d:8c:0a:b2:47:a5:c5:18:7f:2c:ec:
                    45:73:34:54:89:ca:12:59:2b:7d:05:68:06:0f:0d:
                    e5:43:20:95:0a:4d:2a:c9:95:3a:f6:75:d8:c5:e4:
                    6a:7f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FE:CE:37:4D:1C:70:E8:69:C6:77:B5:C5:83:40:DA:5F:BB:D1:86:70
            X509v3 Authority Key Identifier:
                FE:CE:37:4D:1C:70:E8:69:C6:77:B5:C5:83:40:DA:5F:BB:D1:86:70
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        88:dd:98:ca:ea:1b:40:45:00:18:c7:cd:01:21:5e:19:3a:6f:
        cc:3e:d4:31:10:e3:09:d2:0c:b0:70:e7:24:c1:42:02:1d:b9:
        9d:8e:3e:53:d9:77:6c:13:52:fd:11:b6:30:f1:4f:f9:5c:8b:
        73:71:f9:e6:7f:90:3e:ec:f7:f5:52:a9:df:3a:07:82:03:0e:
        ed:97:8c:d7:e7:30:87:0e:6d:25:de:75:e6:39:29:f2:53:54:
        4c:7a:d2:7e:69:74:d3:2d:9c:95:e8:92:71:70:41:6c:79:0b:
        2a:74:1c:31:e8:09:17:1b:3e:02:a8:b0:43:31:bc:22:ea:3f:
        b5:c9:17:e2:6f:5d:66:da:06:46:62:8c:cd:14:a0:eb:c3:ac:
        52:2f:42:85:70:15:82:33:c9:73:6f:a5:b9:a1:cd:cf:fa:80:
        3e:12:81:77:9e:18:32:76:d6:f5:bc:dc:1e:f7:09:2e:6e:b4:
        65:e4:69:05:cd:1a:e7:10:74:c3:46:92:de:35:28:72:c5:1b:
        81:3e:d4:28:2b:07:08:7c:c6:8d:b7:ef:56:e6:a3:30:ad:88:
        e1:db:59:82:19:7d:76:d8:af:24:01:d5:c3:4f:7e:40:61:c0:
        0a:d9:7f:16:a5:3f:45:9c:bd:3d:2e:fe:87:06:97:ac:4a:28:
        7a:65:14:b7

The new version:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:cf:40:d1:b9:3a:49:38:21:d8:e0:10:73:a9:92:e5:4c:9a:0c:5d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd
        Validity
            Not Before: Jul 28 17:59:28 2026 GMT
            Not After : Jul 27 17:59:28 2031 GMT
        Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:95:c7:90:92:a9:74:01:95:71:7a:ab:44:fe:92:
                    1d:59:d0:95:af:7f:07:e7:91:7c:71:1c:a9:5a:91:
                    38:38:b3:6e:55:0b:7b:63:a1:9f:1f:e4:c7:be:c3:
                    de:98:91:4f:43:29:0c:cb:0e:21:98:64:89:fa:60:
                    4f:69:a9:30:4f:6b:98:e7:32:77:26:6a:eb:04:1c:
                    e5:0e:8c:b9:4b:51:72:2c:af:a0:5f:5d:8c:07:21:
                    7f:8c:f9:b0:ba:ed:08:0e:4c:e7:37:9b:14:ae:b8:
                    cd:5f:c2:1a:af:5e:ec:e6:fe:62:f3:d5:b6:a9:a5:
                    3a:9e:b4:7b:7f:1f:b8:c4:51:19:f4:66:c1:31:67:
                    aa:8d:4f:12:7f:0c:58:b7:66:45:5e:68:63:b4:32:
                    91:76:25:5d:17:ee:6f:c3:1d:66:e4:7c:36:33:65:
                    ff:de:eb:1e:a6:3e:7f:a2:1b:5a:24:fd:44:1b:f6:
                    4b:d3:1a:a9:56:9c:39:1b:65:de:7c:94:b5:b0:31:
                    1f:c8:3d:6e:c8:6f:51:df:6d:56:37:86:f8:bf:5f:
                    ec:5f:48:cf:d2:6f:9f:ab:ee:c3:cf:79:e3:54:bf:
                    a0:c2:70:1f:62:54:8c:0f:6c:b6:dd:fe:99:01:26:
                    99:cd:e2:7f:30:0d:34:d9:2d:be:19:8d:19:68:62:
                    a9:17
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                4C:6A:42:B1:4E:03:33:9C:DE:7E:08:BE:EF:07:10:1D:9A:B6:4A:08
            X509v3 Authority Key Identifier:
                4C:6A:42:B1:4E:03:33:9C:DE:7E:08:BE:EF:07:10:1D:9A:B6:4A:08
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        1e:76:0e:53:bf:3b:bd:20:5e:7b:b0:36:db:b1:5c:c5:6d:a0:
        bd:73:30:a1:e2:f1:3a:19:e1:93:c0:ad:19:9d:7d:ba:7b:0e:
        b9:18:76:c1:38:1d:ac:96:b0:b3:c4:57:33:60:2f:cc:50:42:
        13:56:95:71:02:53:ef:0e:9c:a3:c3:2b:c9:b0:02:93:72:1f:
        ce:df:aa:f9:b5:26:53:6c:7c:59:7c:79:50:51:45:56:a5:ad:
        0c:58:30:32:61:cc:1c:34:8d:29:1a:64:1e:2e:b3:c1:7a:67:
        21:5f:e9:53:25:05:44:87:61:75:8b:3b:c7:2c:5a:01:5d:05:
        02:52:d4:11:dc:d0:d1:e9:6b:a8:c5:bc:dd:60:b1:68:46:0a:
        f1:93:b3:2e:c8:18:59:60:06:31:e6:bf:0b:cc:a4:2a:e0:c1:
        23:76:cc:83:7b:2f:0d:b4:2a:2c:dd:14:11:85:14:dc:a7:c6:
        44:f1:ed:d4:5d:6a:f4:e5:ce:79:32:98:6c:39:d6:4a:40:28:
        1e:ad:0d:6b:3b:d1:73:ad:52:0d:30:9d:b5:d4:53:43:a8:0d:
        6c:03:09:23:4c:d8:db:b9:24:d0:ba:13:63:6c:8d:39:b3:d2:
        85:9e:12:8a:2a:3b:50:60:d0:9a:3f:a5:6c:20:33:59:28:d3:
        fc:56:27:0c

the difference is in this bit:

                Certificate Sign, CRL Sign

@MauriceHendrix
Updated test certificate generation so newly created CA certs include…
003f722 
… proper X.509 CA key usage extensions, fixing Python/OpenSSL verification failures while preserving existing server cert generation behavior.
@MauriceHendrix

MauriceHendrix commented Jul 29, 2026

Copy link
Copy Markdown
Author

@wcoenraads I also added some info to the readme that I needed to get the server running on my local wslk2 (on windows)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wcoenraads wcoenraads Awaiting requested review from wcoenraads

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MauriceHendrix