Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

do not include subject key identifier in leaf certificates #6549

Merged
merged 1 commit into from Dec 12, 2023
Merged

do not include subject key identifier in leaf certificates #6549

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Expand Up @@ -7,6 +7,9 @@

## Unreleased: mitmproxy next

* Fix compatibility with Windows Schannel clients, which previously got
confused by CA and leaf certificate sharing the same Subject Key Identifier.
([#6549](https://github.com/mitmproxy/mitmproxy/pull/6549), @driuba and @mhils)
* Fix bug where response flows from HAR files had incorrect `content-length` headers
([#6548](https://github.com/mitmproxy/mitmproxy/pull/6548), @zanieb)
* Improved handling for `--allow-hosts`/`--ignore-hosts` options in WireGuard mode (#5930).
Expand Down
12 changes: 5 additions & 7 deletions mitmproxy/certs.py
View file
Open in desktop
Expand Up @@ -279,17 +279,15 @@ def dummy_cert(
x509.SubjectAlternativeName(ss), critical=not is_valid_commonname
)

# we just use the same key as the CA for these certs, so put that in the SKI extension
builder = builder.add_extension(
x509.SubjectKeyIdentifier.from_public_key(privkey.public_key()),
critical=False,
)
# add authority key identifier for the cacert issuing cert for greater acceptance by
# client TLS libraries (such as OpenSSL 3.x)
# https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1
builder = builder.add_extension(
x509.AuthorityKeyIdentifier.from_issuer_public_key(cacert.public_key()),
critical=False,
)
# If CA and leaf cert have the same Subject Key Identifier, SChannel breaks in funny ways,
# see https://github.com/mitmproxy/mitmproxy/issues/6494.
# https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2 states
# that SKI is optional for the leaf cert, so we skip that.

cert = builder.sign(private_key=privkey, algorithm=hashes.SHA256()) # type: ignore
return Cert(cert)
Expand Down