PYTHON-5040 Regenerate test TLS certificates for Python 3.13/3.14 compatibility#2846

Draft

blink1073 wants to merge 50 commits into

mongodb:masterfrom

blink1073:PYTHON-5040

Commits on Jun 15, 2026

PYTHON-5040 Regenerate test TLS certificates with Authority Key Identifier
blink1073
committed
PYTHON-5040 Use test/certificates/ certs for SSL test client
blink1073
committed
PYTHON-5040 Export TLS cert paths from integration_tests/run.sh
blink1073
committed
PYTHON-5040 Use test/certificates/ certs for SSL integration test server
blink1073
committed
PYTHON-5040 Use test/certificates/ certs for Evergreen SSL test client
blink1073
committed
PYTHON-5040 Fix KMS mock server TLS for Python 3.13
blink1073
committed
PYTHON-5040 Fix x509 auth username and CRL revocation in test certs
blink1073
committed
PYTHON-5040 Fix CSFLE TLS certs and configure-env for Python 3.13
blink1073
committed
PYTHON-5040 Fix CA keyUsage and remove issuer from leaf cert AKI
blink1073
committed
PYTHON-5040 Remove cRLSign from CA keyUsage to fix macOS CERT_SUSPENDED
blink1073
committed
PYTHON-5040 Use cryptography library to generate certs with AKI but no CA SKI
blink1073
committed
PYTHON-5040 Add OCSPNoCheck to leaf certs and fix CA basicConstraints critical flag
blink1073
committed
PYTHON-5040 Switch AKI to issuer form and add CA keyUsage
blink1073
committed
PYTHON-5040 Use self-generated Drivers Testing CA and separate KMS server cert
blink1073
committed
PYTHON-5040 Disable TLS revocation check on macOS for SSL tests
blink1073
committed
PYTHON-5040 Use keyid-form AKI for Python 3.14 compatibility
blink1073
committed
PYTHON-5040 Fix CSFLE_TLS_CERT_FILE to use server-kms.pem
blink1073
committed
PYTHON-5040 Make CA basicConstraints critical, regenerate certs
blink1073
committed
PYTHON-5040 Add keyUsage to CA cert, regenerate certs
blink1073
committed
PYTHON-5040 Add SKI to KMS leaf certs, remove from CA
blink1073
committed
PYTHON-5040 Use PROTOCOL_TLS_CLIENT in http_post for Python 3.14
blink1073
committed
PYTHON-5040 Update README and add run_server.py comment
blink1073
committed
PYTHON-5040 Fix mypy typing errors in synchro.py and gen-certs.py
blink1073
committed
PYTHON-5040 Clarify comments about macOS SecTrust and cert env vars
blink1073
committed
PYTHON-5040 Only use PROTOCOL_TLS_CLIENT in http_post on macOS
blink1073
committed
PYTHON-5040 Use uv run with PEP 723 inline metadata in gen-certs.py
blink1073
committed
PYTHON-5040 Fix Windows KMS cert failures: issuer-form AKI, win32 guard
blink1073
committed
PYTHON-5040 Define AKI/SKI on first use, pin cryptography>=44.0.0
blink1073
committed
PYTHON-5040 Remove keyUsage from CA cert to fix Windows signature failure
blink1073
committed
PYTHON-5040 Switch to upstream drivers-evergreen-tools now that PR #791 is merged
blink1073
committed
PYTHON-5040 Use create_default_context and clear X509_STRICT flag on macOS
blink1073
committed
PYTHON-5040 Update certificates README for keyUsage removal and VERIFY_X509_STRICT approach
blink1073
committed
PYTHON-5040 Remove --tls-allow-invalid-certificates; update README with strict-mode guidance
blink1073
committed
PYTHON-5040 Rename KMS certs with kms- prefix for clarity
blink1073
committed
PYTHON-5040 Clarify that X509_V_FLAG_X509_STRICT is an OpenSSL flag set by VERIFY_X509_STRICT
blink1073
committed
PYTHON-5040 Add CA SKI, keyid-form AKI for KMS certs, restore macOS tls-allow-invalid-certificates
blink1073
committed
PYTHON-5040 Add keyUsage to CA cert for Python 3.14 strict mode
blink1073
committed
PYTHON-5040 Trim gen-certs.py comments; refer to README for background
blink1073
committed

Commits on Jul 1, 2026

PYTHON-5040 Trim gen-certs.py and README for conciseness
blink1073
committed

Commits on Jul 2, 2026