add_extensions removed in pyopenssl 26.4.0

Verified example for pyopenssl 26.4.0

from datetime import datetime, timedelta, timezone

from cryptography import x509
from cryptography.hazmat.primitives import hashes
from cryptography.x509.oid import NameOID
from OpenSSL import crypto


def format_extension_value(value):
    if isinstance(value, x509.BasicConstraints):
        text = "CA:TRUE" if value.ca else "CA:FALSE"
        if value.path_length is not None:
            text += f", pathlen:{value.path_length}"
        return text
    return str(value)


def main():
    key = crypto.PKey()
    key.generate_key(crypto.TYPE_RSA, 2048)
    private_key = key.to_cryptography_key()

    subject = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "test.local")])
    now = datetime.now(timezone.utc)

    builder = (
        x509.CertificateBuilder()  # X.509 v3 by default
        .serial_number(1)
        .subject_name(subject)
        .issuer_name(subject)
        .public_key(private_key.public_key())
        .not_valid_before(now)
        .not_valid_after(now + timedelta(seconds=365 * 24 * 60 * 60))
        .add_extension(
            x509.BasicConstraints(ca=False, path_length=None),
            critical=True,
        )
    )
    signed = builder.sign(private_key, hashes.SHA256())
    certificate = crypto.X509.from_cryptography(signed)

    print(f"Subject CN: {certificate.get_subject().CN}")
    for extension in signed.extensions:
        name = extension.oid._name
        print(f"{name}: {format_extension_value(extension.value)}")


if __name__ == "__main__":
    main()