odoo/odoo · error · InvalidRegistrationResponse

Certificate missing extension {ExtensionOID.BASIC_CONSTRAINT

Error message

Certificate missing extension {ExtensionOID.BASIC_CONSTRAINTS} (TPM)

What it means

Error "Certificate missing extension {ExtensionOID.BASIC_CONSTRAINTS} (TPM)" thrown in odoo/odoo.

Source

Thrown at addons/auth_passkey/_vendor/webauthn/registration/formats/tpm.py:290

    except ExtensionNotFound:
        raise InvalidRegistrationResponse(
            f"Certificate missing extension {ExtensionOID.EXTENDED_KEY_USAGE} (TPM)"
        )

    ext_key_usage_oid = ext_extended_key_usage[0].dotted_string

    if ext_key_usage_oid != "2.23.133.8.3":
        raise InvalidRegistrationResponse(
            f'Certificate Extended Key Usage OID "{ext_key_usage_oid}" was not "2.23.133.8.3" (TPM)'
        )

    try:
        # Ignore mypy because we're casting to a known type
        ext_basic_constraints: BasicConstraints = cert_extensions.get_extension_for_oid(
            ExtensionOID.BASIC_CONSTRAINTS
        ).value  # type: ignore[assignment]
    except ExtensionNotFound:
        raise InvalidRegistrationResponse(
            f"Certificate missing extension {ExtensionOID.BASIC_CONSTRAINTS} (TPM)"
        )

    # The Basic Constraints extension MUST have the CA component set to false.
    if ext_basic_constraints.ca is not False:
        raise InvalidRegistrationResponse("Certificate Basic Constraints CA was not False (TPM)")

    # If aikCert contains an extension with OID 1.3.6.1.4.1.45724.1.1.4
    # (id-fido-gen-ce-aaguid) verify that the value of this extension matches the
    # aaguid in authenticatorData.
    # TODO: Implement this later if we can find a TPM that returns something here
    # try:
    #     fido_gen_ce_aaguid = cert_extensions.get_extension_for_oid(
    #         ObjectIdentifier("1.3.6.1.4.1.45724.1.1.4")
    #     )
    # except ExtensionNotFound:
    #     pass

View on GitHub (pinned to 1e661df964)

Solutions

  1. The attestation certificate is missing the Basic Constraints extension. Use a compliant TPM AIK certificate.

When it happens

Trigger: Thrown at addons/auth_passkey/_vendor/webauthn/registration/formats/tpm.py:290 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

AI-assisted analysis of odoo/odoo@1e661df964 (2026-08-15). Data as JSON: /api/errors/12d27d22d81a3cb6. Report an issue: GitHub.