{"record":{"id":"e919860bc589682d","repo":"odoo/odoo","slug":"certificate-missing-extension-ext-1-2-840-113635","errorCode":null,"errorMessage":"Certificate missing extension {ext_1_2_840_113635_100_8_2_oid} (Apple)","messagePattern":"Certificate missing extension (.+?) \\(Apple\\)","errorType":"exception","errorClass":"InvalidRegistrationResponse","httpStatus":null,"severity":"error","filePath":"addons/auth_passkey/_vendor/webauthn/registration/formats/apple.py","lineNumber":89,"sourceCode":"    # Perform SHA-256 hash of nonceToHash to produce nonce.\n    nonce = hashlib.sha256()\n    nonce.update(nonce_to_hash)\n    nonce_bytes = nonce.digest()\n\n    # Verify that nonce equals the value of the extension with\n    # OID 1.2.840.113635.100.8.2 in credCert.\n    attestation_cert_bytes = attestation_statement.x5c[0]\n    attestation_cert = x509.load_der_x509_certificate(attestation_cert_bytes, default_backend())\n    cert_extensions = attestation_cert.extensions\n\n    # Still no documented name for this OID...\n    ext_1_2_840_113635_100_8_2_oid = \"1.2.840.113635.100.8.2\"\n    try:\n        ext_1_2_840_113635_100_8_2: Extension = cert_extensions.get_extension_for_oid(\n            ObjectIdentifier(ext_1_2_840_113635_100_8_2_oid)\n        )\n    except ExtensionNotFound:\n        raise InvalidRegistrationResponse(\n            f\"Certificate missing extension {ext_1_2_840_113635_100_8_2_oid} (Apple)\"\n        )\n\n    # Peel apart the Extension into an UnrecognizedExtension, then the bytes we actually\n    # want\n    ext_value_wrapper: UnrecognizedExtension = ext_1_2_840_113635_100_8_2.value\n    # Ignore the first six ASN.1 structure bytes that define the nonce as an\n    # OCTET STRING. Should trim off '0$\\xa1\"\\x04'\n    ext_value: bytes = ext_value_wrapper.value[6:]\n\n    if ext_value != nonce_bytes:\n        raise InvalidRegistrationResponse(\"Certificate nonce was not expected value (Apple)\")\n\n    # Verify that the credential public key equals the Subject Public Key of credCert.\n    attestation_cert_pub_key = attestation_cert.public_key()\n    attestation_cert_pub_key_bytes = attestation_cert_pub_key.public_bytes(\n        Encoding.DER,\n        PublicFormat.SubjectPublicKeyInfo,","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/odoo/odoo/blob/1e661df964b1b264c9cef3ab28430d4785be3fda/addons/auth_passkey/_vendor/webauthn/registration/formats/apple.py#L71-L107","documentation":"Error \"Certificate missing extension {ext_1_2_840_113635_100_8_2_oid} (Apple)\" thrown in odoo/odoo.","triggerScenarios":"Thrown at addons/auth_passkey/_vendor/webauthn/registration/formats/apple.py:89 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The attestation certificate lacks the required Apple extension. Use an authentic Apple device for registration, or relax attestation requirements."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1e661df964b1b264c9cef3ab28430d4785be3fda","analyzedAt":"2026-08-15T05:22:16.142Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}