{"record":{"id":"12d27d22d81a3cb6","repo":"odoo/odoo","slug":"certificate-missing-extension-extensionoid-basic","errorCode":null,"errorMessage":"Certificate missing extension {ExtensionOID.BASIC_CONSTRAINTS} (TPM)","messagePattern":"Certificate missing extension (.+?) \\(TPM\\)","errorType":"exception","errorClass":"InvalidRegistrationResponse","httpStatus":null,"severity":"error","filePath":"addons/auth_passkey/_vendor/webauthn/registration/formats/tpm.py","lineNumber":290,"sourceCode":"    except ExtensionNotFound:\n        raise InvalidRegistrationResponse(\n            f\"Certificate missing extension {ExtensionOID.EXTENDED_KEY_USAGE} (TPM)\"\n        )\n\n    ext_key_usage_oid = ext_extended_key_usage[0].dotted_string\n\n    if ext_key_usage_oid != \"2.23.133.8.3\":\n        raise InvalidRegistrationResponse(\n            f'Certificate Extended Key Usage OID \"{ext_key_usage_oid}\" was not \"2.23.133.8.3\" (TPM)'\n        )\n\n    try:\n        # Ignore mypy because we're casting to a known type\n        ext_basic_constraints: BasicConstraints = cert_extensions.get_extension_for_oid(\n            ExtensionOID.BASIC_CONSTRAINTS\n        ).value  # type: ignore[assignment]\n    except ExtensionNotFound:\n        raise InvalidRegistrationResponse(\n            f\"Certificate missing extension {ExtensionOID.BASIC_CONSTRAINTS} (TPM)\"\n        )\n\n    # The Basic Constraints extension MUST have the CA component set to false.\n    if ext_basic_constraints.ca is not False:\n        raise InvalidRegistrationResponse(\"Certificate Basic Constraints CA was not False (TPM)\")\n\n    # If aikCert contains an extension with OID 1.3.6.1.4.1.45724.1.1.4\n    # (id-fido-gen-ce-aaguid) verify that the value of this extension matches the\n    # aaguid in authenticatorData.\n    # TODO: Implement this later if we can find a TPM that returns something here\n    # try:\n    #     fido_gen_ce_aaguid = cert_extensions.get_extension_for_oid(\n    #         ObjectIdentifier(\"1.3.6.1.4.1.45724.1.1.4\")\n    #     )\n    # except ExtensionNotFound:\n    #     pass\n","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/odoo/odoo/blob/1e661df964b1b264c9cef3ab28430d4785be3fda/addons/auth_passkey/_vendor/webauthn/registration/formats/tpm.py#L272-L308","documentation":"Error \"Certificate missing extension {ExtensionOID.BASIC_CONSTRAINTS} (TPM)\" thrown in odoo/odoo.","triggerScenarios":"Thrown at addons/auth_passkey/_vendor/webauthn/registration/formats/tpm.py:290 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The attestation certificate is missing the Basic Constraints extension. Use a compliant TPM AIK certificate."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1e661df964b1b264c9cef3ab28430d4785be3fda","analyzedAt":"2026-08-15T05:22:16.142Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}