Details
Critical Description
According to RFC 5280 the serial id of a X509 certificate must be a positive integer.
Unfortunately the self generated certificate generated in function vio_gencert() doesn't set the serial number which leads to a warning in python's cryptographic module:
$ openssl s_client -starttls mysql -connect 127.0.0.1:3306 -showcerts </dev/null 2>/dev/null | openssl x509 -noout -serial
|
serial=00
|
CryptographyDeprecationWarning: Parsed a serial number which wasn't positive (i.e., it was negative or zero), which is disallowed by RFC 5280. Loading this certificate will cause an exception in a future release of cryptography
|
How to fix:
See attached patch.
