vee1e/mitmproxy
1
0
Fork 0
mirror of https://github.com/vee1e/mitmproxy.git synced 2026-09-01 18:27:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix certificates generated by dummy_cert on clients that require AuthorityKeyIdentifier (#6410)

Browse source 
* fix certificates generated by dummy_cert on clients that require AuthorityKeyIdentifier

* add changelog item
This commit is contained in:
Mike Maxim 2023-10-18 15:32:47 -04:00 • committed by GitHub
parent bacbaadb01
commit c3d2a9dac4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
CHANGELOG.md
View file

@ -6,6 +6,8 @@
([#6389](https://github.com/mitmproxy/mitmproxy/pull/6389), @mhils)
* Add a contentview for DNS-over-HTTPS.
([#6389](https://github.com/mitmproxy/mitmproxy/pull/6389), @mhils)
* Fix certificate generation to work with strict mode OpenSSL 3.x clients
([#6410](https://github.com/mitmproxy/mitmproxy/pull/6410), @mmaxim)
## 27 September 2023: mitmproxy 10.1.1

13
mitmproxy/certs.py
View file

@ -278,6 +278,19 @@ def dummy_cert(
builder = builder.add_extension(
x509.SubjectAlternativeName(ss), critical=not is_valid_commonname
)
# we just use the same key as the CA for these certs, so put that in the SKI extension
builder = builder.add_extension(
x509.SubjectKeyIdentifier.from_public_key(privkey.public_key()),
critical=False,
)
# add authority key identifier for the cacert issuing cert for greater acceptance by
# client TLS libraries (such as OpenSSL 3.x)
builder = builder.add_extension(
x509.AuthorityKeyIdentifier.from_issuer_public_key(cacert.public_key()),
critical=False,
)
cert = builder.sign(private_key=privkey, algorithm=hashes.SHA256()) # type: ignore
return Cert(cert)