OpenSSL 4 removed built-in logic for SKID and AKID
@LeonxLJX is already working on this.
Since Sep 4, 2026.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 48/100
Research direction
Start with the Makefiles and certificate fixtures under tests/certs/expired, tests/certs/mtls, and tests/certs/valid/server, then reproduce the issue with the listed make and pytest commands. Done means the generated certificates contain subjectKeyIdentifier and authorityKeyIdentifier and the affected tests pass under OpenSSL 4.0.2.
Written by the indexing model from the issue text.
Description
The openssl command used to have built-in logic to automaticaly add
subjectKeyIdentifier and authorityKeyIdentifier to created certificates.
This logic vanished in OpenSSL 4.0 and the extensions are missing.
Python 3.13+ uses VERIFY_X509_STRICT to verify the certificate. Missing
those attributes is an error.
Expected Result
A certificated with SKID and AKID.
Actual Result
No SKID and AKID.
Reproduction Steps
$ openssl version
OpenSSL 4.0.2 25 Aug 2026 (Library: OpenSSL 4.0.2 25 Aug 2026)
for cert in expired mtls valid/server ; do make -C tests/certs/$cert clean all; done
pytest -v tests/test_requests.py
And then somewhere appears
error = SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1082)'))
_pool = <urllib3.connectionpool.HTTPSConnectionPool object at 0x7f0a6d92a2c0>
_stacktrace = <traceback object at 0x7f0a6dfa7a80>
....
FAILED tests/test_requests.py::TestPreparingURLs::test_different_connection_pool_for_tls_settings_verify_bundle_unexpired_cert
I prepared https://github.com/sebastianas/requests/commit/339333739074118a93a9f496981b394e94bc1690 as a fix but can't open a pull request.
Sebastian
- Dominant language
- Python
- Stars
- 54.7k
- Forks
- 10.8k
- Avg merge
- 18m
- Merged PRs (30d)
- 1
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from psf/requests
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
`iter_lines(decode_unicode=True, delimiter=<str>)` raises `TypeError` when `Response.encoding` is `None`May be free again A pull request for this issue was closed without being merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
get_encoding_from_headers treats any content type containing 'text' as text/* (ISO-8859-1)Possibly taken @suyashgitt claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Invalid `params` type (e.g. int) raises misleading "TypeError: Cannot mix str and non-str arguments"Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Similar issues
-
plot_graph crashes when a mesh node has no m2m edgePossibly taken @tygvi claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
mllam/neural-lam#883 · 1 comment ·
Maintainers usually reply within 2 days
-
enhancement possible-duplicate
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
AOSSIE-Org/PictoPy#1715 · 2 comments ·
Maintainers usually reply within 6 days
-
SQLite connector omits generated columns from the catalog, and drops relationships sourced on themOpen
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
NVIDIA/auto-ontology#511 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
ethereum/execution-specs#3996 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
cpp-best-practices/project_validator#267 ·
Maintainers usually reply within 1 day