Re: [pve-devel] [PATCH pve-cluster v2 1/3] fix #6701: Add keyUsage extension to root CA

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

On Tue, Mar 17, 2026 at 01:58:33PM +0100, Maximiliano Sandoval wrote:
> Arthur Bied-Charreton <a.bied-charreton@proxmox.com> writes:
> 
> > Add the keyUsage[1] extension to the PVE root CA to comply with RFC
> > 5280, which Python decided to enforce as of 3.13 by adding the
> > VERIFY_X509_STRICT flag, which breaks some clients like Ansible.
> 
> If there is a v2, it would be good to mention that this flag
> (ssl.VERIFY_X509_STRICT) comes from python's [ssl] module. And that the
> change of behavior in 3.13 is documented at [create_default_context].
> 
> [ssl] https://docs.python.org/3/library/ssl.html
> [create_default_context] https://docs.python.org/3/library/ssl.html#ssl.create_default_context
> 
I saw this right after sending the v3 :/ Good point! Maybe this could be
fixed up when applying if nothing else comes up?
> >
> > The authorityKeyIdentifier[2] and subjectKeyIdentifier[3] extensions are
> > required by RFC 5280 as well, however OpenSSL adds them in by default
> > based on /etc/ssl/openssl.cnf, so there is no need for explicitly
> > passing them.
> >
> > Test script:
> > ```
> > import socket, ssl
> >
> > ctx = ssl.create_default_context(cafile="/etc/pve/pve-root-ca.pem")
> > ctx.wrap_socket(socket.create_connection(("localhost", 8006)),
> > server_hostname="localhost")
> > print("success")
> > ```
> >
> > [1] https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3
> > [2] https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.1
> > [3] https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.2
> >
> > Suggested-by: Stoiko Ivanov <s.ivanov@proxmox.com>
> > Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
> > ---
> >  src/PVE/Cluster/Setup.pm | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/src/PVE/Cluster/Setup.pm b/src/PVE/Cluster/Setup.pm
> > index 75d3507..4f528ba 100644
> > --- a/src/PVE/Cluster/Setup.pm
> > +++ b/src/PVE/Cluster/Setup.pm
> > @@ -439,6 +439,8 @@ sub gen_pveca_cert {
> >              '-new',
> >              '-x509',
> >              '-nodes',
> > +            '-addext',
> > +            'keyUsage=critical,keyCertSign,cRLSign',
> >              '-key',
> >              $pveca_key_fn,
> >              '-out',
> 
> -- 
> Maximiliano