Authority Key Identifier not generated for server certificate

Description

I BELIEVE this is a bug, but I am by no means an expert in SSL/TLS. I have always put the Proxyman CA cert into certifi for python and it has worked fine in docker containers. However as of python 3.13, it fails.

I believe this is due to the change in 3.13 to be more strict about ssl.

The create_default_context() API now includes VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT in its default flags.

https://docs.python.org/3/whatsnew/3.13.html

Steps to Reproduce

1. install python 3.13
2. pip install httpx
3. cat ca-proxy-certificate.pem >> $(python -m certifi)
4. all_proxy=host.docker.internal:9090 python -c "import httpx; httpx.get('https://www.google.com').status_code"

I believe this check I ginned up with gpt is correct and also shows the issue, using openssl to show that the chain doesn't validate:

openssl s_client -proxy host.docker.internal:9090 -connect example.com:443 -showcerts < /dev/null \
| sed -ne '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' \
| openssl verify     -x509_strict     -show_chain -CAfile /tmp/debug/ca-proxy-certificate.pem

depth=1 C = US, L = Wilmington, O = Proxyman LLC, CN = "Proxyman CA (17 Dec 2024, nh-m3.local)", OU = https://proxyman.io, ST = Delaware
verify return:1
depth=0 C = US, L = Los Angeles, O = Internet\C2\A0Corporation\C2\A0for\C2\A0Assigned\C2\A0Names\C2\A0and\C2\A0Numbers, CN = www.example.org, ST = California
verify return:1
DONE
C = US, L = Los Angeles, O = Internet\C2\A0Corporation\C2\A0for\C2\A0Assigned\C2\A0Names\C2\A0and\C2\A0Numbers, CN = www.example.org, ST = California
error 85 at 0 depth lookup: Missing Authority Key Identifier
error stdin: verification failed

I also believe this is because the AKI in the server cert generated by proxyman is 0 rather than matching the CA.

            X509v3 Authority Key Identifier:
                0.

Current Behavior

httpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1018)

(shows in proxyman as a 'ssh handshake failed')

Expected Behavior

should just be a 200

Environment

The example is python 3.13 in docker of course. Any linux python should be the same. Mac python may be somehow magical with the mac keystore, I don't know.