From b3a767f336e20600f30c9ff78385a58352ff6ee3 Mon Sep 17 00:00:00 2001
From: Illia Volochii <illia.volochii@gmail.com>
Date: Wed, 27 Mar 2024 16:32:24 +0200
Subject: [PATCH] Add AKI to child CA certificates (#642)

---
 newsfragments/642.bugfix.rst |  1 +
 src/trustme/__init__.py      | 15 ++++++++++++---
 tests/test_trustme.py        |  5 +++++
 3 files changed, 18 insertions(+), 3 deletions(-)
 create mode 100644 newsfragments/642.bugfix.rst

diff --git a/newsfragments/642.bugfix.rst b/newsfragments/642.bugfix.rst
new file mode 100644
index 0000000..9d75e7a
--- /dev/null
+++ b/newsfragments/642.bugfix.rst
@@ -0,0 +1 @@
+Add the Authority Key Identifier extension to child CA certificates.
diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py
index 5fb24fb..d126180 100644
--- a/src/trustme/__init__.py
+++ b/src/trustme/__init__.py
@@ -246,18 +246,27 @@ def __init__(
         )
         issuer = name
         sign_key = self._private_key
+        aki: Optional[x509.AuthorityKeyIdentifier]
         if parent_cert is not None:
             sign_key = parent_cert._private_key
             parent_certificate = parent_cert._certificate
             issuer = parent_certificate.subject
-
-        self._certificate = (
+            ski_ext = parent_certificate.extensions.get_extension_for_class(
+                x509.SubjectKeyIdentifier)
+            aki = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski_ext.value)
+        else:
+            aki = None
+        cert_builder = (
             _cert_builder_common(name, issuer, self._private_key.public_key())
             .add_extension(
                 x509.BasicConstraints(ca=True, path_length=path_length),
                 critical=True,
             )
-            .add_extension(
+        )
+        if aki:
+            cert_builder = cert_builder.add_extension(aki, critical=False)
+        self._certificate = (
+            cert_builder.add_extension(
                 x509.KeyUsage(
                     digital_signature=True,  # OCSP
                     content_commitment=False,
diff --git a/tests/test_trustme.py b/tests/test_trustme.py
index 1d901ad..581716e 100644
--- a/tests/test_trustme.py
+++ b/tests/test_trustme.py
@@ -200,6 +200,11 @@ def test_intermediate() -> None:
     assert_is_ca(child_ca_cert)
     assert child_ca_cert.issuer == ca_cert.subject
     assert _path_length(child_ca_cert) == 8
+    aki = child_ca_cert.extensions.get_extension_for_class(x509.AuthorityKeyIdentifier)
+    assert aki.critical is False
+    expected_aki_key_id = ca_cert.extensions.get_extension_for_class(
+        x509.SubjectKeyIdentifier).value.digest
+    assert aki.value.key_identifier == expected_aki_key_id
 
     child_server = child_ca.issue_cert("test-host.example.org")
     assert len(child_server.cert_chain_pems) == 2