diff --git a/CHANGELOG.md b/CHANGELOG.md
index fdbec23f6..3b121af87 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@
   ([#6389](https://github.com/mitmproxy/mitmproxy/pull/6389), @mhils)
 * Add a contentview for DNS-over-HTTPS.
   ([#6389](https://github.com/mitmproxy/mitmproxy/pull/6389), @mhils)
+* Fix certificate generation to work with strict mode OpenSSL 3.x clients
+  ([#6410](https://github.com/mitmproxy/mitmproxy/pull/6410), @mmaxim)
 
 
 ## 27 September 2023: mitmproxy 10.1.1
diff --git a/mitmproxy/certs.py b/mitmproxy/certs.py
index a260cb981..b533c54f4 100644
--- a/mitmproxy/certs.py
+++ b/mitmproxy/certs.py
@@ -278,6 +278,19 @@ def dummy_cert(
     builder = builder.add_extension(
         x509.SubjectAlternativeName(ss), critical=not is_valid_commonname
     )
+
+    # we just use the same key as the CA for these certs, so put that in the SKI extension
+    builder = builder.add_extension(
+        x509.SubjectKeyIdentifier.from_public_key(privkey.public_key()),
+        critical=False,
+    )
+    # add authority key identifier for the cacert issuing cert for greater acceptance by
+    # client TLS libraries (such as OpenSSL 3.x)
+    builder = builder.add_extension(
+        x509.AuthorityKeyIdentifier.from_issuer_public_key(cacert.public_key()),
+        critical=False,
+    )
+
     cert = builder.sign(private_key=privkey, algorithm=hashes.SHA256())  # type: ignore
     return Cert(cert)