Fix expired self-signed cert validation: remove bypass, enable X509_STRICT|POLICY_CHECK, extract numeric error codes from pyOpenSSL

server/packages/kca-core/tests/test_core.py

@@ -5,6 +5,7 @@ import base64
 import time
 import unittest
 from datetime import datetime, timedelta, timezone
+from unittest.mock import ANY, patch
 
 from cryptography import x509
 from cryptography.hazmat.primitives import serialization
@@ -243,6 +244,8 @@ class CertificateTest(unittest.TestCase):
         spec["key_usage"] = {"critical": True, "usages": ["digital_signature", "key_encipherment"]}
         spec["extended_key_usage"] = {"critical": False, "usages": ["serverAuth"]}
         spec["subject_alt_name"] = {"critical": False, "entries": [{"type": "dns", "value": "example.com"}]}
+        spec["subject_key_identifier"] = {"critical": False}
+        spec["authority_key_identifier"] = {"critical": False}
         leaf = certificates.build_signed(
             subject=_name("example.com"),
             public_key=leaf_key.public_key(),
@@ -260,6 +263,56 @@ class CertificateTest(unittest.TestCase):
         self.assertEqual(parsed.serial_number, 2)
         self.assertEqual(certificates.find_issuer(parsed, [ca]), ca)
         self.assertEqual(certificates.validation_errors(parsed, [parsed, ca]), [])
+        self.assertEqual(
+            certificates.validation_errors(parsed, [parsed]),
+            [{"code": 20, "message": "unable to get local issuer certificate"}],
+        )
+
+    def test_self_signed_validation(self) -> None:
+        key = keys.generate_key("ec", curve="secp256r1")
+        now = datetime.now(timezone.utc)
+        valid = certificates.build_self_signed(
+            subject=_name("Valid Root CA"),
+            private_key=key,
+            serial=6,
+            not_before=now - timedelta(days=1),
+            not_after=now + timedelta(days=30),
+            extension_spec=_ca_spec(),
+        )
+        expired = certificates.build_self_signed(
+            subject=_name("Expired Root CA"),
+            private_key=key,
+            serial=7,
+            not_before=now - timedelta(days=30),
+            not_after=now - timedelta(days=1),
+            extension_spec=_ca_spec(),
+        )
+
+        self.assertEqual(certificates.validation_errors(valid, [valid]), [])
+        self.assertEqual(
+            certificates.validation_errors(expired, [expired]),
+            [{"code": 10, "message": "certificate has expired"}],
+        )
+
+    def test_validation_sets_strict_flags(self) -> None:
+        from OpenSSL import crypto
+
+        key = keys.generate_key("ec", curve="secp256r1")
+        now = datetime.now(timezone.utc)
+        cert = certificates.build_self_signed(
+            subject=_name("Strict Root CA"),
+            private_key=key,
+            serial=8,
+            not_before=now - timedelta(days=1),
+            not_after=now + timedelta(days=30),
+            extension_spec=_ca_spec(),
+        )
+        flags = crypto.X509StoreFlags.X509_STRICT | crypto.X509StoreFlags.POLICY_CHECK
+
+        with patch.object(crypto.X509Store, "set_flags", autospec=True) as set_flags:
+            self.assertEqual(certificates.validation_errors(cert, [cert]), [])
+
+        set_flags.assert_called_once_with(ANY, flags)
 
     def test_renew_spec(self) -> None:
         key = keys.generate_key("rsa", 2048)