We noticed that the GCP Cloud NGFW Enterprise endpoints issue impersonation certificates without AKID extension. This violates
https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1
While Cloud NGFW is claimed to be powered by Palo Alto networks (https://www.paloaltonetworks.com/blog/2024/04/google-cloud-ngfw-enterprise/), we see the Palo Alto Firewall exhibit the RFC compliant behaviour.
What does this break?
Python 3.13, https://docs.python.org/3/library/ssl.html#ssl.create_default_context. Although we can work around this problem by disabling strict checks, it would be prudent for GCP to address this gap on priority in the interest of a long term solution.
Steps to reproduce:
Python 3.13.15 (main, Aug 6 2026, 11:06:22) [GCC 13.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
>>> import socket
>>> hostname = "api.github.com"
>>> port = 44
>>> port = 443
>>> context = ssl.create_default_context()
>>> try:
... with socket.create_connection((hostname, port), timeout=10) as sock:
... with context.wrap_socket(sock, server_hostname=hostname) as ssock:
... print("SSL handshake succeeded")
... print("TLS version:", ssock.version())
... print("Cipher:", ssock.cipher())
... cert = ssock.getpeercert()
... print("Peer cert subject:", cert.get("subject"))
... print("Peer cert issuer:", cert.get("issuer"))
... except ssl.SSLCertVerificationError as e:
... print("CERT VERIFICATION FAILED:", e)
... except ssl.SSLError as e:
... print("SSL ERROR:", e)
... except Exception as e:
... print("OTHER ERROR (may be network/proxy, not TLS):", type(e).__name__, e)
...
CERT VERIFICATION FAILED: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)
>>> context.verify_flags &= ~ssl.VERIFY_X509_STRICT
>>> try:
... with socket.create_connection((hostname, port), timeout=10) as sock:
... with context.wrap_socket(sock, server_hostname=hostname) as ssock:
... print("SSL handshake succeeded")
... print("TLS version:", ssock.version())
... print("Cipher:", ssock.cipher())
... cert = ssock.getpeercert()
... print("Peer cert subject:", cert.get("subject"))
... print("Peer cert issuer:", cert.get("issuer"))
... except ssl.SSLCertVerificationError as e:
... print("CERT VERIFICATION FAILED:", e)
... except ssl.SSLError as e:
... print("SSL ERROR:", e)
... except Exception as e:
... print("OTHER ERROR (may be network/proxy, not TLS):", type(e).__name__, e)
...
SSL handshake succeeded
TLS version: TLSv1.3
Cipher: ('TLS_AES_256_GCM_SHA384', 'TLSv1.3', 256)
Peer cert subject: ((('commonName', '*.github.com'),),)
Peer cert issuer: ((('commonName', 'Google Cloud Firewall Intermediate CA ID# [removed by moderator] 35431'),),)
