Add CABF CA EKU test cases

[jvdprng]

This PR adds test cases for CABF Baseline Requirements 7.1.2.10.6 regarding CA Extended Key Usage (EKU) validation.

There are 9 new test cases:

• ca_without_serverauth_issuing_tls: Tests rejection when only clientAuth is present.
• ca_with_precertificate_oid: Tests rejection when only precertificate OID is present.
• ca_with_serverauth_and_precertificate: Tests rejection when serverAuth and precertificate OID are present.
• ca_with_serverauth_issuing_matching: Tests acceptance when serverAuth present.
• ca_with_codesigning_eku: Tests rejection when serverAuth and `` are present.
• ca_with_emailprotection_eku: Tests rejection when serverAuth and emailProtection are present.
• ca_with_timestamping_eku: Tests rejection when serverAuth and timeStamping are present.
• ca_with_ocspsigning_eku: Tests rejection when serverAuth and OCSPSigning are present.
• ca_with_anyeku: Tests rejection when serverAuth and anyExtendedKeyUsage are present.

🤖 Generated with Claude Code

[jvdprng]

Since the bot cannot run when the PR comes from a fork, here is a copy from our fork for informational purposes:

New testcases

There are new testcases in this change.

openssl-3.6.0

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-precertificate-oid	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS	None
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	None
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	None
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	None

openssl-3.2.6

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-precertificate-oid	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS	None
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	None
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	None
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	None

openssl-3.5.4

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-precertificate-oid	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS	None
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	None
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	None
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	None

pyca-cryptography-46.0.3

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	SKIPPED	testcase skipped (explicit unsupported feature)
webpki::eku::ca-with-precertificate-oid	FAILURE	SKIPPED	testcase skipped (explicit unsupported feature)
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SKIPPED	testcase skipped (explicit unsupported feature)
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SKIPPED	testcase skipped (explicit unsupported feature)
webpki::eku::ca-with-anyeku	FAILURE	SKIPPED	testcase skipped (explicit unsupported feature)
webpki::eku::ca-with-codesigning-eku	FAILURE	SKIPPED	testcase skipped (explicit unsupported feature)
webpki::eku::ca-with-timestamping-eku	FAILURE	SKIPPED	testcase skipped (explicit unsupported feature)
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SKIPPED	testcase skipped (explicit unsupported feature)
webpki::eku::ca-with-emailprotection-eku	FAILURE	SKIPPED	testcase skipped (explicit unsupported feature)

rust-webpki

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	FAILURE	UnknownIssuer
webpki::eku::ca-with-precertificate-oid	FAILURE	FAILURE	UnknownIssuer
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS	None
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	None
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	None
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	None

openssl-1.1

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	FAILURE	unsupported certificate purpose
webpki::eku::ca-with-precertificate-oid	FAILURE	FAILURE	unsupported certificate purpose
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS	None
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	None
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	None
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	None

openssl-3.0.18

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-precertificate-oid	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS	None
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	None
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	None
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	None

openssl-3.4.3

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-precertificate-oid	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS	None
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	None
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	None
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	None

gnutls-certtool-3.8.3

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	SKIPPED	custom EKUs not yet supported
webpki::eku::ca-with-precertificate-oid	FAILURE	SKIPPED	custom EKUs not yet supported
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SKIPPED	custom EKUs not yet supported
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SKIPPED	custom EKUs not yet supported
webpki::eku::ca-with-anyeku	FAILURE	SKIPPED	custom EKUs not yet supported
webpki::eku::ca-with-codesigning-eku	FAILURE	SKIPPED	custom EKUs not yet supported
webpki::eku::ca-with-timestamping-eku	FAILURE	SKIPPED	custom EKUs not yet supported
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SKIPPED	custom EKUs not yet supported
webpki::eku::ca-with-emailprotection-eku	FAILURE	SKIPPED	custom EKUs not yet supported

certvalidator-0.11.1

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	SUCCESS	None
webpki::eku::ca-with-precertificate-oid	FAILURE	SUCCESS	None
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS	None
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	None
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	None
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	None

gocryptox509-go1.25.5

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	FAILURE
webpki::eku::ca-with-precertificate-oid	FAILURE	FAILURE
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	validation: chain built
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	validation: chain built
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	validation: chain built
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	validation: chain built
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	validation: chain built
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	validation: chain built

rustls-webpki

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	FAILURE	RequiredEkuNotFoundContext(RequiredEkuNotFoundContext { required: KeyPurposeId(1.3.6.1.5.5.7.3.1), present: [KeyPurposeId(1.3.6.1.5.5.7.3.2)] })
webpki::eku::ca-with-precertificate-oid	FAILURE	FAILURE	RequiredEkuNotFoundContext(RequiredEkuNotFoundContext { required: KeyPurposeId(1.3.6.1.5.5.7.3.1), present: [KeyPurposeId(1.3.6.1.4.1.22137.2.4.4)] })
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS	None
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	None
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	None
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	None

openssl-3.3.5

Testcase	Expected Result	Actual Result	Context
webpki::eku::ca-without-serverauth-issuing-tls	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-precertificate-oid	FAILURE	FAILURE	unsuitable certificate purpose
webpki::eku::ca-with-serverauth-issuing-matching	SUCCESS	SUCCESS	None
webpki::eku::ca-with-serverauth-and-precertificate	FAILURE	SUCCESS	None
webpki::eku::ca-with-anyeku	FAILURE	SUCCESS	None
webpki::eku::ca-with-codesigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-timestamping-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-ocspsigning-eku	FAILURE	SUCCESS	None
webpki::eku::ca-with-emailprotection-eku	FAILURE	SUCCESS	None

[woodruffw]

These tests look right to me, but I'm confused as to why we're skipping them on the PyCA harness. These seem useful to run there 🙂

[jvdprng]

Because these are pedantic EKU tests and PyCA doesn't support those (which is a pre-existing choice)

x509-limbo/harness/pyca-cryptography/main.py

Lines 29 to 31 in 9d59474

	# Our support for custom EKUs is limited, and we (like most impls.) don't
	# handle all EKU conditions under CABF.
	Feature.pedantic_webpki_eku,