Add test cases for v1 certificates with v3 extensions

[jvdprng]

This PR adds test cases for v1 certificates that contain v3 extensions, which violates RFC 5280 Section 4.1.2.1. The following test cases are added:

• v1_cert_without_extensions, should accept. Note that this is similar to v1_cert in webpki, where the same cert is rejected as per CABF requirements.
• v1_cert_with_subject_key_identifier - Tests SubjectKeyIdentifier extension, should reject.
• v1_cert_with_basic_constraints - Tests BasicConstraints extension, should reject.
• v1_cert_with_key_usage - Tests KeyUsage extension, should reject.
• v1_cert_with_extended_key_usage - Tests ExtendedKeyUsage extension, should reject.
• v1_cert_with_subject_alternative_name - Tests SubjectAlternativeName extension, should reject.
• v1_cert_with_authority_key_identifier - Tests AuthorityKeyIdentifier extension, should reject.

Note that these test cases require a modification to the behavior of the no_extensions flag by allowing the caller to define additional extensions that will be added after the extensions are removed. Since the flag is only used in one existing test case that does not define additional extensions (v1_cert in webpki) this change is backwards compatible.

🤖 Generated with Claude Code

[jvdprng]

Since the bot cannot run when the PR comes from a fork, here is a copy from our fork for informational purposes:

New testcases

There are new testcases in this change.

openssl-3.5.4

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-without-extensions	SUCCESS	SUCCESS	None
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE	Using cert extension requires at least X509v3

pyca-cryptography-46.0.3

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE	validation failed: certificate must be an X509v3 certificate (encountered processing <Certificate(subject=<Name(CN=example.com)>, ...)>)
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE	validation failed: certificate must be an X509v3 certificate (encountered processing <Certificate(subject=<Name(CN=example.com)>, ...)>)
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE	validation failed: certificate must be an X509v3 certificate (encountered processing <Certificate(subject=<Name(CN=example.com)>, ...)>)
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE	validation failed: certificate must be an X509v3 certificate (encountered processing <Certificate(subject=<Name(CN=example.com)>, ...)>)
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE	validation failed: certificate must be an X509v3 certificate (encountered processing <Certificate(subject=<Name(CN=example.com)>, ...)>)
rfc5280::v1-cert-without-extensions	SUCCESS	FAILURE	validation failed: certificate must be an X509v3 certificate (encountered processing <Certificate(subject=<Name(CN=example.com)>, ...)>)
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE	validation failed: certificate must be an X509v3 certificate (encountered processing <Certificate(subject=<Name(CN=example.com)>, ...)>)

rust-webpki

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-without-extensions	SUCCESS	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE	leaf cert: X.509 parse failed

openssl-3.6.0

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-without-extensions	SUCCESS	SUCCESS	None
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE	Using cert extension requires at least X509v3

gnutls-certtool-3.8.3

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE
rfc5280::v1-cert-without-extensions	SUCCESS	SUCCESS	Chain verification output: Verified. The certificate is trusted.
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE

certvalidator-0.11.1

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	SUCCESS	None
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	SUCCESS	None
rfc5280::v1-cert-with-key-usage	FAILURE	SUCCESS	None
rfc5280::v1-cert-with-extended-key-usage	FAILURE	SUCCESS	None
rfc5280::v1-cert-with-basic-constraints	FAILURE	SUCCESS	None
rfc5280::v1-cert-without-extensions	SUCCESS	SUCCESS	None
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	SUCCESS	None

gocryptox509-go1.25.4

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE
rfc5280::v1-cert-without-extensions	SUCCESS	FAILURE	validation: x509: certificate relies on legacy Common Name field, use SANs instead
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE

openssl-3.2.6

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-without-extensions	SUCCESS	SUCCESS	None
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE	Using cert extension requires at least X509v3

openssl-3.0.18

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-without-extensions	SUCCESS	SUCCESS	None
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE	Using cert extension requires at least X509v3

openssl-3.4.3

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-without-extensions	SUCCESS	SUCCESS	None
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE	Using cert extension requires at least X509v3

rustls-webpki

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-without-extensions	SUCCESS	FAILURE	leaf cert: X.509 parse failed
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE	leaf cert: X.509 parse failed

openssl-3.3.5

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-extended-key-usage	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-with-basic-constraints	FAILURE	FAILURE	Using cert extension requires at least X509v3
rfc5280::v1-cert-without-extensions	SUCCESS	SUCCESS	None
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	FAILURE	Using cert extension requires at least X509v3

openssl-1.1

Testcase	Expected Result	Actual Result	Context
rfc5280::v1-cert-with-authority-key-identifier	FAILURE	SUCCESS	None
rfc5280::v1-cert-with-subject-key-identifier	FAILURE	SUCCESS	None
rfc5280::v1-cert-with-key-usage	FAILURE	SUCCESS	None
rfc5280::v1-cert-with-extended-key-usage	FAILURE	SUCCESS	None
rfc5280::v1-cert-with-basic-constraints	FAILURE	SUCCESS	None
rfc5280::v1-cert-without-extensions	SUCCESS	SUCCESS	None
rfc5280::v1-cert-with-subject-alternative-name	FAILURE	SUCCESS	None

[alex]

Curious what @woodruffw thinks, but I'm not sure it's valuable to have N tests of different extensions with v1. They're all testing the same fundamental behavior.

[jvdprng]

The results of the tests indeed suggest that testing different extensions does not add a lot of value. Is there any extension that would be a good representative, or would you prefer a test with all extensions instead?

[woodruffw]

Yeah, I think I agree with @alex about the limited coverage impact here. I think v1_cert_with_subject_alternative_name would be a good representative of this general class!

[jvdprng]

Removed all other tests in e03f33a