Files
ss-tools/backend/tests/integration
busya 03e9fbba6a fix: TLS Custom CA integration tests — all 175 pass
ROOT CAUSE: OpenSSL 3.x requires AuthorityKeyIdentifier (AKI) extension
on certificates for capath-based chain building. The ca_chain fixture
generated certs without AKI/SKI extensions — causing ssl.create_default_context()
to fail with 'Missing Authority Key Identifier'.

FIXES (2 files):
1. conftest.py: Added SubjectKeyIdentifier and AuthorityKeyIdentifier
   extensions to all generated certificates in _gen_cert_pem()
2. test_superset_tls_custom_ca.py:
   - Added superset_container param to test_certifi_bundle_notrust
   - Added httpx.ConnectError to caught exceptions (httpx wraps SSLError)
   - Fixed get_dashboards() return type assertion (tuple vs dict)

RESULTS: 175/175 integration tests passing (was 167), +8 TLS tests
- openssl capath OK, certifi fails, certifi bundle no-trust
- httpx capath works, httpx certifi fails, verify_false works
- AsyncAPIClient verify_ssl=True authenticates over HTTPS
- SupersetClient full auth + API calls over TLS
2026-06-16 11:42:40 +03:00
..