It appears that self-signed certificate generation does not set the x509 version and thus the certificate is defaulting to x509 version 1 (see "Notes").

This is a problem because some TLS client libraries do not accept x509 version 1 due to how outdated it is. For example, RusTLS, a TLS client and server library for Rust, only accepts x509 version 3.

This is causing our SQL client library, SQLx, to fail to connect to MariaDB on the verylatest tag, even with server certificate verification disabled, because it still needs to parse the certificate to complete the handshake.

Fixing this should be as simple as adding X509_set_version(x509, X509_VERSION_3); to vio_gencert().