Problem: [CERTIFICATE_VERIFY_FAILED] certificate verify failed: Basic Constraints of CA cert not marked critical Error on Foreman_callback in Ansible
Expected outcome: NO error and ansible run successfully calls back to Foreman
Foreman and Proxy versions: foreman-3.18.1-1.el9.noarch foreman-proxy-3.18.1-1.el9.noarch
Foreman and Proxy plugin versions:
Distribution and version: Rocky 9.7
Other relevant data:
I get the following error after every ansible run with foreman callbacks after an OS upgrade that forced python 3.13.
This error is caused by stricter certificate validation introduced in Python 3.13+ (via OpenSSL and the ssl module’s VERIFY_X509_STRICT flag).
My CA certificate has a Basic Constraints extension that is either missing the critical flag or is not fully compliant with modern RFC 5280 expectations (e.g., CA:TRUE must be marked critical for CAs that issue certificates). Older Python/OpenSSL versions were more lenient; 3.13+ enforces this strictly