Function dummy_cert

mitmproxy/certs.py:314–404

Generates a dummy certificate. privkey: CA private key cacert: CA certificate commonname: Common name for the generated certificate. sans: A list of Subject Alternate Names. organization: Organization name for the generated certificate. crl_url: URL of CRL distribution

(
    privkey: rsa.RSAPrivateKey,
    cacert: x509.Certificate,
    commonname: str | None,
    sans: Iterable[x509.GeneralName],
    organization: str | None = None,
    crl_url: str | None = None,
)

def dummy_cert(
    privkey: rsa.RSAPrivateKey,
    cacert: x509.Certificate,
    commonname: str | None,
    sans: Iterable[x509.GeneralName],
    organization: str | None = None,
    crl_url: str | None = None,
) -> Cert:
    """
    Generates a dummy certificate.

    privkey: CA private key
    cacert: CA certificate
    commonname: Common name for the generated certificate.
    sans: A list of Subject Alternate Names.
    organization: Organization name for the generated certificate.
    crl_url: URL of CRL distribution point

    Returns cert if operation succeeded, None if not.
    """
    builder = x509.CertificateBuilder()
    builder = builder.issuer_name(cacert.subject)
    builder = builder.add_extension(
        x509.ExtendedKeyUsage([ExtendedKeyUsageOID.SERVER_AUTH]), critical=False
    )
    builder = builder.public_key(cacert.public_key())

    now = datetime.datetime.now()
    builder = builder.not_valid_before(now + CERT_VALIDITY_OFFSET)
    builder = builder.not_valid_after(now + CERT_VALIDITY_OFFSET + CERT_EXPIRY)

    subject = []
    is_valid_commonname = commonname is not None and len(commonname) < 64
    if is_valid_commonname:
        assert commonname is not None
        subject.append(x509.NameAttribute(NameOID.COMMON_NAME, commonname))
    if organization is not None:
        assert organization is not None
        subject.append(x509.NameAttribute(NameOID.ORGANIZATION_NAME, organization))
    builder = builder.subject_name(x509.Name(subject))
    builder = builder.serial_number(x509.random_serial_number())

    # RFC 5280 §4.2.1.6: subjectAltName is critical if subject is empty.
    builder = builder.add_extension(
        x509.SubjectAlternativeName(_fix_legacy_sans(sans)),
        critical=not is_valid_commonname,
    )

    # https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1
    # Per RFC 5280 §4.2.1.2, the AKI's keyIdentifier in a child certificate
    # MUST be byte-equal to the issuer's stored SubjectKeyIdentifier. If we
    # recompute it from the public key with `from_issuer_public_key()`, we
    # always derive a SHA-1 digest, which mismatches whenever the issuer's
    # SKI was generated by a different method (RFC 7093 truncated
    # SHA-256/384/512, hardware-rooted CAs, or any custom value). This
    # mismatch is rejected by strict TLS chain builders (`X509_V_FLAG_X509_STRICT`,
    # Python `ssl`, Go `crypto/x509`) with "authority and subject key
    # identifier mismatch". Most notably, cert-manager >=1.18 / Go >=1.25