allow me to set basicConstraints so I can set certificate chains

[glyph]

https://www.openssl.org/docs/apps/x509v3_config.html#Basic_Constraints_

I was trying to write a test case that verified a certificate chain "for real" and I noticed that there doesn't seem to be a way to set basicConstraints so that OpenSSL thinks an intermediate certificate is a valid CA.

[exarkun]

You can do this with X509.add_extensions.

[glyph]

Do I have to synthesize my own ASN.1 string? I kinda want to use the "nice" way that OpenSSL lets you say, for example, "CA:true".

[exarkun]

X509Extension("basicConstraints", True, "CA:true")

[glyph]

Aha, I had found https://pythonhosted.org/pyOpenSSL/api/crypto.html#x509extension-objects but glossed over https://pythonhosted.org/pyOpenSSL/api/crypto.html#OpenSSL.crypto.X509Extension which is where the crucial "typename" string is documented. Thanks!