René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"make_ssl_certs fails with \"no issuer certificate\" with recent openssl","articleBody":"# Bug report\n\n### Bug description:\n\nRunning `python3 ./make_ssl_certs.py` in `Lib/test/certdata` with openssl 3.2.2 fails:\n\n```\ncreating cert for localhost\nIgnoring -days without -x509; not generating a certificate\n..+.+..+......+......+.+...+.........+..++++++++++++++++++++++++++++++++++++++++++*...+......+...+...+.....+.........+......+.........+.+..+.+..............+.......+........+......+.++++++++++++++++++++++++++++++++++++++++++*..+.........+..+......+...+...................+...+...+......+...+......+..+...+.........+.+......+.....+.+........+......+..........+..................+..+......+.......+...+...+......+........+...+...+.......+...+...................................+....+...+.....+....+.....+.+..............+...+...+.......+.....+......+...................+...+..+......+.......+........+.+...+............+.....+.+.....+..........+..+.+..+..................+.......+..+.+......+........+..................+...............+...+.+..............+....+...+.....+.......+...........+.......+........+......+...............+...............+.+........+.+......+...+...............+..............................+++++\n........+......+....................+....+..+...+....+..+......++++++++++++++++++++++++++++++++++++++++++*.+.....+.++++++++++++++++++++++++++++++++++++++++++*....+............+...+....+........+..........+........+....+...+...+......+...+........+...+...................+..+.........+.+.....+...+...+.....................................+........+.........+....+..+....+......+...+.....+.+......+........+..............................+......+....+++++\n-----\nError adding request extensions from section req_x509_extensions_full\n80D2CF679F7F0000:error:11000079:X509 V3 routines:v2i_AUTHORITY_KEYID:no issuer certificate:crypto/x509/v3_akid.c:156:\n80D2CF679F7F0000:error:11000080:X509 V3 routines:X509V3_EXT_nconf_int:error in extension:crypto/x509/v3_conf.c:48:section=req_x509_extensions_full, name=authorityKeyIdentifier, value=keyid:always,issuer:always\nTraceback (most recent call last):\n  File \"/home/adamw/local/cpython/Lib/test/certdata/./make_ssl_certs.py\", line 252, in \u003cmodule\u003e\n    cert, key = make_cert_key('localhost', sign=True)\n                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/adamw/local/cpython/Lib/test/certdata/./make_ssl_certs.py\", line 149, in make_cert_key\n    check_call(['openssl'] + args)\n  File \"/usr/lib64/python3.12/subprocess.py\", line 413, in check_call\n    raise CalledProcessError(retcode, cmd)\nsubprocess.CalledProcessError: Command '['openssl', 'req', '-new', '-nodes', '-days', '7000', '-newkey', 'rsa:3072', '-keyout', '/tmp/tmp0z74w6gi', '-extensions', 'req_x509_extensions_full', '-config', '/tmp/tmpx9yl3uel', '-out', '/tmp/tmp2k3xk1tq']' returned non-zero exit status 1.\n```\n\nPer [this openssl issue](https://github.com/openssl/openssl/issues/22966), this is because we're including an SKID and AKID when producing a CSR - the `openssl req -new` command in `make_cert_key`, when run with `sign=True`, creates a CSR. This was never valid, and the fact that it used to succeed was apparently a bug in openssl.\n\nHowever, I'm not totally sure how to fix this so there's no SKID or AKID in the CSR, but there *is* one in the final certificate, when created a signed certificate (as, presumably, is our intent here).\n\n### CPython versions tested on:\n\n3.12\n\n### Operating systems tested on:\n\nLinux\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-120764\n* gh-125045\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/AdamWill","@type":"Person","name":"AdamWill"},"datePublished":"2024-06-19T21:00:47.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/120762/cpython/issues/120762"}