The chain export formatters in kca-core used identity checks
(e.g. , ) to determine whether to
exclude the leaf certificate from the chain. This caused duplicates
when the chain was built from separately-parsed certificate objects
that were cryptographically identical (same DER/fingerprint) but
different Python instances.
Changed → for value equality across all affected formats:
- _pem_chain() : PEM chain export
- PKCS#7 chain : serialization_certificates
- PKCS#12 chain : serialize_key_and_certificates
- OpenVPN : issuer detection
- JWK chain : x5c certificate list
Also added a regression test (test_chain_exports_exclude_equivalent_leaf)
that reproduces the exact issue: a leaf certificate re-parsed from its
DER form is treated as a distinct object, so the old -based checks
kept both copies in the output. The new -based checks correctly
deduplicate, retain the issuer, and handle OpenVPN's CA selection.
woggioni
c263f967dc