woggioni
c263f967dc
The chain export formatters in kca-core used identity checks (e.g. , ) to determine whether to exclude the leaf certificate from the chain. This caused duplicates when the chain was built from separately-parsed certificate objects that were cryptographically identical (same DER/fingerprint) but different Python instances. Changed → for value equality across all affected formats: - _pem_chain() : PEM chain export - PKCS#7 chain : serialization_certificates - PKCS#12 chain : serialize_key_and_certificates - OpenVPN : issuer detection - JWK chain : x5c certificate list Also added a regression test (test_chain_exports_exclude_equivalent_leaf) that reproduces the exact issue: a leaf certificate re-parsed from its DER form is treated as a distinct object, so the old -based checks kept both copies in the output. The new -based checks correctly deduplicate, retain the issuer, and handle OpenVPN's CA selection.
kca-core
Pure, I/O-free PKI domain logic for KCA. It knows how to generate and parse keys, build distinguished names, encode X.509 extensions, issue certificates, create CSRs and CRLs, apply templates, and convert every supported import and export format. It has no kaya, database or filesystem dependencies and is unit-tested in isolation.