Merge branch 'main' into package-min-age

packages/safe-chain/src/registryProxy/certUtils.js

@@ -48,6 +48,16 @@ export function generateCertForHost(hostname) {
       digitalSignature: true,
       keyEncipherment: true,
     },
+    {
+      /*
+        extKeyUsage serverAuth is required for TLS server authentication.
+        This is especially important for Python venv environments, which use their own
+        certificate validation logic and will reject certificates lacking the serverAuth EKU.
+        Adding serverAuth does not impact other usages
+      */
+      name: "extKeyUsage",
+      serverAuth: true,
+    },
   ]);
   cert.sign(ca.privateKey, forge.md.sha256.create());