Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Deprecation of client authentication Extended Key Usage in host certificates

Abierto
  • ¿Algo no está bien?
#8,817 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
32/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
authentication, backend

Línea de trabajo

The issue identifies outbound service requests using local host certificates as the affected area, but does not name specific files, tests, or entry points. First trace how services establish outbound TLS connections and review how proxy authentication is configured; determine whether a shifter proxy can be used. Done means affected services can authenticate outbound requests successfully when host certificates lack Client Authentication EKU.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Hi,

We would like to bring attention to upcoming changes regarding Client Authentication Extended Key Usage (EKU) in host certificates. By March 2027, several CAs will not include Client Authentication EKU in any certificate.

Examples of announcements we have found:

This change will affect institutions obtaining host certificates via commercial CAs. Any service that uses its local hostcert.pem as both a server identity and a client identity will fail if that certificate is issued under a commercial CA (we are already experiencing this with host certificates recently renewed at BNL):

$ openssl x509 -in /opt/dirac/etc/grid-security/hostcert.pem -noout -purpose
Certificate purposes:
SSL client : No
SSL client CA : No
SSL server : Yes

Causing issues with all services like

2026-10-02 16:00:23 UTC Framework [139961784121152] WARN: Can't update from server Error while updating from dips://hostname:9135/Configuration/Server: Peer closed connection
2026-10-02 16:00:23 UTC Framework [139961784121152] ERROR: Can't update from any server Reason(s):
    Peer closed connection

and confirmed when using openssl

ssl3_read_bytes:ssl/tls alert unsupported certificate:ssl/record/rec_layer_s3.c:918:SSL alert number 43

Would it be possible to adapt the services to authenticate outbound requests using a shifter proxy to handle this situation?

Lenguaje dominante
Python
Estrellas
126
Forks
191
Merge medio
2 d 14 h
PR fusionados (30 d)
33

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de DIRACGrid/DIRAC

Todos los issues de DIRACGrid/DIRAC

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.