]> git.ipfire.org Git - thirdparty/pdns.git/commit
dnsdist: Fix regression tests with Python 3.13
authorRemi Gacogne <remi.gacogne@powerdns.com>
Mon, 30 Dec 2024 14:55:33 +0000 (15:55 +0100)
committerRemi Gacogne <remi.gacogne@powerdns.com>
Mon, 12 May 2025 13:00:28 +0000 (15:00 +0200)
commit6e5fbbd51f1c14b1645d21c2a5d3b35dced73173
tree39d76b7edf9ba82af208cf84d6bf53195e3a0a7c
parent2f07ca53443a47c1f1ec084c19110c24449b9566
dnsdist: Fix regression tests with Python 3.13

The CA certificates that we are generating as par of our regression tests
were lacking the X.509 `Key Usage` extension, causing TLS validation with
Python 3.13 to fail with:

> certificate verify failed: CA cert does not include key usage extension

It appears that Python 3.13 enables `VERIFY_X509_STRICT` by default, which makes OpenSSL stricter, and thus it chokes on our invalid CA.

(cherry picked from commit 98ef889a9232877ac369b67c11922bab92ab84a9)
(cherry picked from commit 5787ffad38d920d972c683e5ef500a595aca4fec)
regression-tests.dnsdist/configCA.conf