PYTHON-5040 Regenerate test TLS certificates for Python 3.13/3.14 compatibility - #2846

Draft

blink1073 wants to merge 60 commits into

mongodb:mainfrom

blink1073:PYTHON-5040

Commits on Jun 15, 2026

PYTHON-5040 Regenerate test TLS certificates with Authority Key Identifier
blink1073
committed
06e8463
PYTHON-5040 Use test/certificates/ certs for SSL test client
blink1073
committed
5d18323
PYTHON-5040 Export TLS cert paths from integration_tests/run.sh
blink1073
committed
618acb8
PYTHON-5040 Use test/certificates/ certs for SSL integration test server
blink1073
committed
c3f98f1
PYTHON-5040 Use test/certificates/ certs for Evergreen SSL test client
blink1073
committed
d107450
PYTHON-5040 Fix KMS mock server TLS for Python 3.13
blink1073
committed
d16eb87
PYTHON-5040 Fix x509 auth username and CRL revocation in test certs
blink1073
committed
ca0b746
PYTHON-5040 Fix CSFLE TLS certs and configure-env for Python 3.13
blink1073
committed
afd411c
PYTHON-5040 Fix CA keyUsage and remove issuer from leaf cert AKI
blink1073
committed
7ebc4c0
PYTHON-5040 Remove cRLSign from CA keyUsage to fix macOS CERT_SUSPENDED
blink1073
committed
d113796
PYTHON-5040 Use cryptography library to generate certs with AKI but no CA SKI
blink1073
committed
9e070b4
PYTHON-5040 Add OCSPNoCheck to leaf certs and fix CA basicConstraints critical flag
blink1073
committed
35d9660
PYTHON-5040 Switch AKI to issuer form and add CA keyUsage
blink1073
committed
aa6ecaa
PYTHON-5040 Use self-generated Drivers Testing CA and separate KMS server cert
blink1073
committed
8aed47c
PYTHON-5040 Disable TLS revocation check on macOS for SSL tests
blink1073
committed
a163db5
PYTHON-5040 Use keyid-form AKI for Python 3.14 compatibility
blink1073
committed
b4418cf
PYTHON-5040 Fix CSFLE_TLS_CERT_FILE to use server-kms.pem
blink1073
committed
628d1ce
PYTHON-5040 Make CA basicConstraints critical, regenerate certs
blink1073
committed
f043fbd
PYTHON-5040 Add keyUsage to CA cert, regenerate certs
blink1073
committed
62bc84f
PYTHON-5040 Add SKI to KMS leaf certs, remove from CA
blink1073
committed
0e8e7de
PYTHON-5040 Use PROTOCOL_TLS_CLIENT in http_post for Python 3.14
blink1073
committed
3d56e35
PYTHON-5040 Update README and add run_server.py comment
blink1073
committed
061b94d
PYTHON-5040 Fix mypy typing errors in synchro.py and gen-certs.py
blink1073
committed
7bd8417
PYTHON-5040 Clarify comments about macOS SecTrust and cert env vars
blink1073
committed
977db57
PYTHON-5040 Only use PROTOCOL_TLS_CLIENT in http_post on macOS
blink1073
committed
c8a4a94
PYTHON-5040 Use uv run with PEP 723 inline metadata in gen-certs.py
blink1073
committed
9f61537
PYTHON-5040 Fix Windows KMS cert failures: issuer-form AKI, win32 guard
blink1073
committed
75e49b3
PYTHON-5040 Define AKI/SKI on first use, pin cryptography>=44.0.0
blink1073
committed
75bf0e4
PYTHON-5040 Remove keyUsage from CA cert to fix Windows signature failure
blink1073
committed
febdef9
PYTHON-5040 Switch to upstream drivers-evergreen-tools now that PR #791 is merged
blink1073
committed
b0219c1
PYTHON-5040 Use create_default_context and clear X509_STRICT flag on macOS
blink1073
committed
afc448e
PYTHON-5040 Update certificates README for keyUsage removal and VERIFY_X509_STRICT approach
blink1073
committed
85c1802
PYTHON-5040 Remove --tls-allow-invalid-certificates; update README with strict-mode guidance
blink1073
committed
3d4fdb4
PYTHON-5040 Rename KMS certs with kms- prefix for clarity
blink1073
committed
8442cec
PYTHON-5040 Clarify that X509_V_FLAG_X509_STRICT is an OpenSSL flag set by VERIFY_X509_STRICT
blink1073
committed
3603e52
PYTHON-5040 Add CA SKI, keyid-form AKI for KMS certs, restore macOS tls-allow-invalid-certificates
blink1073
committed
f3f4d8b
PYTHON-5040 Add keyUsage to CA cert for Python 3.14 strict mode
blink1073
committed
f95c1d4
PYTHON-5040 Trim gen-certs.py comments; refer to README for background
blink1073
committed
4abec61

Commits on Jul 1, 2026

PYTHON-5040 Trim gen-certs.py and README for conciseness
blink1073
committed
4d24b1e

Commits on Jul 2, 2026

Commits on Jul 8, 2026

Commits on Jul 9, 2026

Add openssl cli to listed dependencies

blink1073
and
Copilot
authored
f4eb63f
PYTHON-5040 Revert drivers-evergreen-tools checkout to mongodb-labs/master
blink1073
committed
a44fe53
Merge remote-tracking branch 'origin/PYTHON-5040' into PYTHON-5040
blink1073
committed
bdb3d19

Commits on Jul 28, 2026

Merge remote-tracking branch 'upstream/main' into PYTHON-5040
blink1073
committed
07d4bb8
PYTHON-5040 Fix repo_root typo in CONTRIBUTING.md
blink1073
committed
789b8aa
Merge branch 'main' into PYTHON-5040
blink1073
authored
0f5338c
PYTHON-5040 Remove "via" from PR comments/docs
blink1073
committed
aeee11c
PYTHON-5040 Verify trusted-ca.pem extensions; clarify strict-mode wording
blink1073
committed
fbb4cfe