Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork32k
Open
Description
Bug report
Bug description:
Version info:
- Python 3.12
- Ubuntu 24.04
- amd64
Here is the certificate chain that the server presents:
server cert:
Certificate: Data: Version: 3 (0x2) Serial Number: 6b:ea:ea:44:21:43:12:26:e8:56:88:da:e8:fe:19:94:36:6b:24:5d Signature Algorithm: sha256WithRSAEncryption Issuer: CN = self-signed-certificates-operator Validity Not Before: Apr 7 07:45:31 2025 GMT Not After : Jul 6 07:45:31 2025 GMT Subject: CN = 10.43.45.0, x500UniqueIdentifier = 5af5937b-7f98-4b6d-b53d-ff63e7778f5b Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:c5:66:62:74:48:ef:9c:91:b9:e1:64:31:41:56: 0d:b4:a6:6c:38:e3:a5:be:6f:49:4f:fc:54:00:f6: 6b:90:92:01:4f:53:07:dc:23:b3:7e:e9:00:6e:ad: a3:d1:64:d8:be:af:39:ae:76:c9:eb:83:25:2f:95: 27:3f:39:13:49:eb:5d:2c:9b:2a:d4:fe:84:a9:ad: 21:5f:12:d5:05:e9:74:f0:04:c9:2d:4c:24:f6:24: 64:6a:f8:70:ad:54:47:b0:70:50:18:8f:5a:01:fd: 1c:6f:27:cb:20:a8:31:c4:6e:8f:07:a1:34:b7:03: bd:6c:44:90:b0:13:dd:ba:44:7a:b9:fa:6d:ee:f9: 92:4b:0d:1d:39:58:ce:c8:16:03:2b:fd:f9:20:88: 64:d3:3e:3c:19:5b:a5:56:a2:a8:3d:74:94:f9:1a: 41:5f:36:dd:6a:af:fe:a1:47:7b:74:19:a2:a1:df: bd:11:e7:4c:5d:9b:7c:71:68:91:dd:32:6c:2f:df: cb:bc:2a:0a:eb:f8:5a:13:ca:dd:32:ec:50:d3:6c: 8b:22:5a:97:a8:7e:93:46:81:18:ce:8f:6b:64:c9: 50:19:bc:dc:82:89:29:5d:c5:bc:5e:b2:a9:3b:76: 44:6d:17:f1:47:0e:aa:99:47:f8:7c:5f:65:ad:94: d1:43 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: 04:14:85:B0:CB:F4:5B:0F:01:70:4B:C7:EB:38:FD:80:F0:70:3C:EC:00:6E X509v3 Subject Key Identifier: EF:41:F8:D9:34:A7:6C:86:85:35:65:0C:4A:C6:7B:D0:D1:7D:16:2C X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Alternative Name: IP Address:10.43.45.0 Signature Algorithm: sha256WithRSAEncryption Signature Value: 42:d9:22:4a:b6:49:f3:c4:c3:38:eb:d5:0f:f6:f4:cd:95:17: 9f:4b:79:9b:e8:1c:5b:28:ec:7f:75:76:eb:48:75:0f:f2:81: e8:1d:2f:84:7d:6b:ae:a2:17:e2:af:a2:06:3e:97:39:fa:51: 55:07:12:64:c8:a6:fb:bc:d2:46:50:18:8a:e1:81:d9:04:f7: f7:05:a6:f9:3e:38:13:b1:b0:32:e9:80:81:f3:0a:a6:9d:30: 3a:6a:78:d8:f0:9d:99:f4:0f:c6:83:05:64:0c:cd:12:9d:fb: 2d:54:59:d8:fc:27:a3:e6:15:ab:09:b4:c9:2a:5b:64:a4:a4: eb:ce:0c:ff:be:8a:4f:80:7c:1c:51:ae:0e:85:4a:c4:98:a4: 37:fa:5e:79:d9:dc:7a:44:33:16:af:42:a4:eb:14:43:40:c6: c4:38:19:15:ab:d2:c6:dc:85:47:4c:9d:bc:f2:9e:32:2b:2e: 08:19:23:4d:38:f0:93:38:b8:57:64:d4:cc:df:7f:f3:ae:68: 6a:11:19:a9:6a:b0:e0:91:21:3a:9b:dc:fc:17:c3:da:44:d2: ff:b6:aa:c9:99:60:b7:93:06:cd:8f:6d:93:f6:40:cc:5e:fc: 8d:c3:e6:33:e5:26:8a:95:ac:06:7d:c1:d1:14:a3:ba:7a:f2: ee:47:e0:05-----BEGIN CERTIFICATE-----MIIDYTCCAkmgAwIBAgIUa+rqRCFDEiboVoja6P4ZlDZrJF0wDQYJKoZIhvcNAQELBQAwLDEqMCgGA1UEAwwhc2VsZi1zaWduZWQtY2VydGlmaWNhdGVzLW9wZXJhdG9yMB4XDTI1MDQwNzA3NDUzMVoXDTI1MDcwNjA3NDUzMVowRDETMBEGA1UEAwwKMTAuNDMuNDUuMDEtMCsGA1UELQwkNWFmNTkzN2ItN2Y5OC00YjZkLWI1M2QtZmY2M2U3Nzc4ZjViMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxWZidEjvnJG54WQxQVYNtKZsOOOlvm9JT/xUAPZrkJIBT1MH3COzfukAbq2j0WTYvq85rnbJ64MlL5UnPzkTSetdLJsq1P6Eqa0hXxLVBel08ATJLUwk9iRkavhwrVRHsHBQGI9aAf0cbyfLIKgxxG6PB6E0twO9bESQsBPdukR6ufpt7vmSSw0dOVjOyBYDK/35IIhk0z48GVulVqKoPXSU+RpBXzbdaq/+oUd7dBmiod+9EedMXZt8cWiR3TJsL9/LvCoK6/haE8rdMuxQ02yLIlqXqH6TRoEYzo9rZMlQGbzcgokpXcW8XrKpO3ZEbRfxRw6qmUf4fF9lrZTRQwIDAQABo2MwYTAhBgNVHSMEGjAYgBYEFIWwy/RbDwFwS8frOP2A8HA87ABuMB0GA1UdDgQWBBTvQfjZNKdshoU1ZQxKxnvQ0X0WLDAMBgNVHRMBAf8EAjAAMA8GA1UdEQQIMAaHBAorLQAwDQYJKoZIhvcNAQELBQADggEBAELZIkq2SfPEwzjr1Q/29M2VF59LeZvoHFso7H91dutIdQ/ygegdL4R9a66iF+KvogY+lzn6UVUHEmTIpvu80kZQGIrhgdkE9/cFpvk+OBOxsDLpgIHzCqadMDpqeNjwnZn0D8aDBWQMzRKd+y1UWdj8J6PmFasJtMkqW2SkpOvODP++ik+AfBxRrg6FSsSYpDf6XnnZ3HpEMxavQqTrFENAxsQ4GRWr0sbchUdMnbzynjIrLggZI0048JM4uFdk1Mzff/OuaGoRGalqsOCRITqb3PwXw9pE0v+2qsmZYLeTBs2PbZP2QMxe/I3D5jPlJoqVrAZ9wdEUo7p68u5H4AU=-----END CERTIFICATE-----
the CA cert
Certificate: Data: Version: 3 (0x2) Serial Number: 67:09:35:a9:66:2e:59:97:de:c4:f6:8f:ad:fa:bc:c7:db:f8:5e:f4 Signature Algorithm: sha256WithRSAEncryption Issuer: CN = self-signed-certificates-operator Validity Not Before: Apr 7 07:44:16 2025 GMT Not After : Apr 7 07:44:16 2026 GMT Subject: CN = self-signed-certificates-operator Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:af:53:7b:47:82:16:39:10:60:df:0b:dc:09:59: a7:b5:4f:21:a5:ea:9a:e4:6c:dd:0c:23:88:23:48: b6:3c:be:55:48:4e:e1:9f:ca:7d:ef:da:b8:20:8c: 35:74:d4:74:c9:89:09:8f:fe:79:ac:a5:73:96:07: 56:d3:1b:c0:55:fe:2c:1c:d6:21:a2:cb:33:7f:31: 50:c0:92:5e:cc:fe:50:a7:90:28:7e:89:65:58:60: aa:dc:cb:f2:06:74:86:c1:fc:37:dd:a6:79:bb:3d: d2:06:62:6b:96:d4:e3:ae:9a:8f:ea:65:a5:16:48: 1d:ec:c7:b5:eb:db:b0:5f:36:d1:b6:91:d3:07:3b: d7:53:f5:82:0e:99:e9:6b:7f:19:5f:c0:21:5d:55: 0f:12:2f:06:04:d7:9a:59:6d:fd:eb:59:54:ff:53: ea:b1:6b:ac:2d:f7:98:11:84:5a:4e:76:c3:a5:4c: a3:40:06:48:30:e6:3b:df:61:8b:2b:63:20:55:7c: f3:cd:4f:dd:b2:e7:f6:be:75:6b:60:a8:9f:35:4f: d3:7f:e9:af:8f:5b:21:6c:90:44:2a:a0:15:44:92: 4b:87:0a:5d:05:80:d1:d1:fa:59:f5:cf:25:d2:d0: c7:2e:94:a8:9d:58:6c:b9:38:8a:f8:31:2d:1e:cb: e9:27 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Alternative Name: <EMPTY> X509v3 Subject Key Identifier: 04:14:85:B0:CB:F4:5B:0F:01:70:4B:C7:EB:38:FD:80:F0:70:3C:EC:00:6E X509v3 Authority Key Identifier: 04:14:85:B0:CB:F4:5B:0F:01:70:4B:C7:EB:38:FD:80:F0:70:3C:EC:00:6E X509v3 Key Usage: critical Digital Signature, Key Encipherment, Certificate Sign X509v3 Basic Constraints: critical CA:TRUE Signature Algorithm: sha256WithRSAEncryption Signature Value: 82:5f:7a:46:90:e2:d6:70:6a:8d:56:5a:25:92:6c:32:48:4c: 56:6c:86:8a:23:47:c3:cd:25:86:b5:7f:ba:f8:dc:40:02:65: a1:9c:41:d9:b8:c6:2a:5b:bd:84:18:4b:0d:f8:f8:5b:1a:c5: e1:eb:29:58:b1:ed:1c:4c:6d:1f:78:ab:b7:bb:b4:d0:25:28: 0f:f3:4d:17:f2:60:fd:42:b9:b6:4a:7d:71:48:4d:d6:5f:a2: b1:2c:6b:bf:5b:00:6e:44:f1:8e:c9:a9:98:af:cf:ac:e1:cf: e2:f2:22:fc:0a:73:3a:34:5f:b2:ab:9f:5f:79:11:85:fe:11: e3:ee:62:c7:1f:65:34:51:c6:85:78:6f:24:a6:ed:cb:59:8b: d8:f7:d3:bf:84:f4:a1:4b:33:57:3c:24:b7:df:d1:c8:62:92: dd:f5:d4:8d:06:71:da:4f:26:3e:0b:94:54:0e:16:22:7e:70: 32:0d:7a:3b:1e:b7:ee:d6:8d:79:3e:0e:0f:74:a2:a9:f8:0d: 74:68:c6:f6:79:03:3d:76:15:2e:fa:1a:69:34:4e:21:40:fb: ef:ac:49:43:50:61:9c:c5:c2:b4:8d:16:ba:d1:3c:e3:03:46: da:6e:68:55:a3:67:0e:ab:ce:98:1b:b6:55:a6:b2:c2:0b:35: 36:ad:ce:36-----BEGIN CERTIFICATE-----MIIDWDCCAkCgAwIBAgIUZwk1qWYuWZfexPaPrfq8x9v4XvQwDQYJKoZIhvcNAQELBQAwLDEqMCgGA1UEAwwhc2VsZi1zaWduZWQtY2VydGlmaWNhdGVzLW9wZXJhdG9yMB4XDTI1MDQwNzA3NDQxNloXDTI2MDQwNzA3NDQxNlowLDEqMCgGA1UEAwwhc2VsZi1zaWduZWQtY2VydGlmaWNhdGVzLW9wZXJhdG9yMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr1N7R4IWORBg3wvcCVmntU8hpeqa5GzdDCOII0i2PL5VSE7hn8p979q4IIw1dNR0yYkJj/55rKVzlgdW0xvAVf4sHNYhosszfzFQwJJezP5Qp5AofollWGCq3MvyBnSGwfw33aZ5uz3SBmJrltTjrpqP6mWlFkgd7Me169uwXzbRtpHTBzvXU/WCDpnpa38ZX8AhXVUPEi8GBNeaWW3961lU/1PqsWusLfeYEYRaTnbDpUyjQAZIMOY732GLK2MgVXzzzU/dsuf2vnVrYKifNU/Tf+mvj1shbJBEKqAVRJJLhwpdBYDR0fpZ9c8l0tDHLpSonVhsuTiK+DEtHsvpJwIDAQABo3IwcDAJBgNVHREEAjAAMB8GA1UdDgQYBBYEFIWwy/RbDwFwS8frOP2A8HA87ABuMCEGA1UdIwQaMBiAFgQUhbDL9FsPAXBLx+s4/YDwcDzsAG4wDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAIJfekaQ4tZwao1WWiWSbDJITFZshoojR8PNJYa1f7r43EACZaGcQdm4xipbvYQYSw34+FsaxeHrKVix7RxMbR94q7e7tNAlKA/zTRfyYP1CubZKfXFITdZforEsa79bAG5E8Y7JqZivz6zhz+LyIvwKczo0X7Krn195EYX+EePuYscfZTRRxoV4bySm7ctZi9j307+E9KFLM1c8JLff0chikt311I0GcdpPJj4LlFQOFiJ+cDINejset+7WjXk+Dg90oqn4DXRoxvZ5Az12FS76Gmk0TiFA+++sSUNQYZzFwrSNFrrRPOMDRtpuaFWjZw6rzpgbtlWmssILNTatzjY=-----END CERTIFICATE-----
I'm passing the CA cert to urllib / sslcontext using this code:
# Note that ssl.create_default_context() doesn't allow setting the context.protocol in a# way that's the same across Python 3.8 and 3.10 onwards. Whip the context up by hand.context=ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)context.minimum_version=ssl.TLSVersion.TLSv1_3context.set_alpn_protocols(['http/1.1'])context.verify_flags|=ssl.VERIFY_X509_STRICTifpartial_chain:=getattr(ssl,'VERIFY_X509_PARTIAL_CHAIN',None):# Available starting from Python 3.10. The partial chain flag allows trusting an# intermediate CAs in the CA list without the matching root CA.context.verify_flags|=partial_chaincontext.load_verify_locations(cadata=ca)try:withurllib.request.urlopen(# noqa: S310urllib.request.Request(# noqa: S310config.url,data=data,headers={'Content-Type':mime},method='POST', ),context=context,timeout=EXPORT_TIMEOUT, ):passexcepturllib.error.HTTPErrorase:resp=e.fp.read()[:1000]logger.exception(f'Tracing collector rejected our data,{e.code=}{resp=}')exceptOSError:# URLError, TimeoutError, SSLError, socket.error# Exception gets caught herepass
At the same time, cURL is happy with this CA.
Is Python being too strict?
Is it a bug?
Specifically, why validate the alt name in the CA?
CPython versions tested on:
3.12
Operating systems tested on:
Linux