PYTHON-5040 Verify trusted-ca.pem extensions; clarify strict-mode wording

Addresses Copilot review feedback:
- gen-certs.py's verify() now checks trusted-ca.pem for critical
  basicConstraints/keyUsage and absence of AKI/SAN, matching the
  checks already done for ca.pem, so a future regen that drops these
  extensions fails loudly instead of silently breaking CA-bundle tests.
- README.md reworded to remove the apparent contradiction between the
  "Certificate details" and "Background" sections about which Python
  version enables X509_STRICT mode vs. which tightens it further.

Author: blink1073

test/certificates/README.md

@@ -24,9 +24,10 @@ No AKI or SKI. Adding AKI triggers SecTrust OCSP checks; our CA has no OCSP resp
 fail with `CSSMERR_TP_CERT_SUSPENDED`. See Background below.
 
 **KMS certs** — presented by KMS mock servers, verified by Python's ssl module (OpenSSL).
-Carry both AKI (keyid form) and SKI. Python 3.13 requires AKI on non-root certs; Python 3.14
-sets `X509_V_FLAG_X509_STRICT` in `ssl.create_default_context()`, which additionally requires SKI
-and critical `keyUsage` on CA certs.
+Carry both AKI (keyid form) and SKI. Python 3.13 enables `X509_V_FLAG_X509_STRICT` in
+`ssl.create_default_context()`, which requires AKI on non-root certs; by Python 3.14 (which bundles
+a newer OpenSSL) the same strict mode additionally requires SKI on non-root certs and critical
+`keyUsage` on CA certs. See Background below for the full version history.
 
 | File | Subject | Signed by | Extensions | Purpose |
 |---|---|---|---|---|

test/certificates/gen-certs.py

@@ -372,6 +372,28 @@ def verify() -> int:
     if errors == prev_errors:
         print("    ca.pem: OK (has basicConstraints critical, keyUsage critical, SKI; no AKI/SAN)")
 
+    # Trusted CA (separate root used only by CA-bundle tests) must have critical basicConstraints
+    # and critical keyUsage; must NOT have AKI or SAN.
+    trusted_ca_text = cert_text(SCRIPT_DIR / "trusted-ca.pem")
+    prev_errors = errors
+    if "Basic Constraints: critical" not in trusted_ca_text:
+        print("    trusted-ca.pem: ERROR — basicConstraints not critical", file=sys.stderr)
+        errors += 1
+    if "Key Usage: critical" not in trusted_ca_text:
+        print("    trusted-ca.pem: ERROR — missing critical keyUsage", file=sys.stderr)
+        errors += 1
+    for ext in ("Authority Key Identifier", "Subject Alternative Name"):
+        if ext in trusted_ca_text:
+            print(
+                f"    trusted-ca.pem: ERROR — has {ext} (unexpected on a bare CA-bundle cert)",
+                file=sys.stderr,
+            )
+            errors += 1
+    if errors == prev_errors:
+        print(
+            "    trusted-ca.pem: OK (has basicConstraints critical, keyUsage critical; no AKI/SAN)"
+        )
+
     # MongoDB certs must NOT have AKI.
     for name in ("server.pem", "client.pem"):
         text = cert_text(SCRIPT_DIR / name)