X509Extension changed in pyopenssl 26.4.0

Verified example for pyopenssl 26.4.0

import datetime
import warnings

from cryptography import x509
from cryptography.hazmat.primitives import hashes
from cryptography.x509.oid import NameOID
from OpenSSL import crypto

# X509Extension is flagged as deprecated in newer pyOpenSSL releases, but it is
# still the pyOpenSSL-native way to add extensions. Suppress the warning noise.
warnings.filterwarnings("ignore", category=DeprecationWarning)


def _ext_value_str(ext):
    value = ext.value
    if isinstance(value, x509.BasicConstraints):
        s = "CA:TRUE" if value.ca else "CA:FALSE"
        if value.path_length is not None:
            s += f", pathlen:{value.path_length}"
        return s
    return str(value)


def main():
    # Generate a 2048-bit RSA key
    key = crypto.PKey()
    key.generate_key(crypto.TYPE_RSA, 2048)
    crypto_key = key.to_cryptography_key()

    # Build the certificate
    subject = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "test.local")])
    now = datetime.datetime.now(datetime.timezone.utc)
    builder = (
        x509.CertificateBuilder()  # X.509 v3
        .serial_number(1000)
        .subject_name(subject)
        .issuer_name(subject)  # self-signed
        .not_valid_before(now)
        .not_valid_after(now + datetime.timedelta(seconds=365 * 24 * 60 * 60))
        .public_key(crypto_key.public_key())
    )

    # Attach basicConstraints extension marking the cert as a CA
    builder = builder.add_extension(
        x509.BasicConstraints(ca=True, path_length=None), critical=True
    )

    # Self-sign
    cert = builder.sign(crypto_key, hashes.SHA256())

    # Print extension info
    extensions = list(cert.extensions)
    count = len(extensions)
    print("Extension count:", count)
    for i in range(count):
        ext = extensions[i]
        short_name = ext.oid._name
        if isinstance(short_name, bytes):
            short_name = short_name.decode("ascii")
        print(f"Extension {i}: {short_name} = {_ext_value_str(ext)}")


if __name__ == "__main__":
    main()