OpenSSL 4 removed built-in logic for SKID and AKID

The openssl command used to have built-in logic to automaticaly add
subjectKeyIdentifier and authorityKeyIdentifier to created certificates.
This logic vanished in OpenSSL 4.0 and the extensions are missing.

Python 3.13+ uses VERIFY_X509_STRICT to verify the certificate. Missing
those attributes is an error.

Expected Result

A certificated with SKID and AKID.

Actual Result

No SKID and AKID.

Reproduction Steps

$ openssl version
OpenSSL 4.0.2 25 Aug 2026 (Library: OpenSSL 4.0.2 25 Aug 2026)
for cert in expired mtls valid/server ; do make -C  tests/certs/$cert clean all; done
pytest -v tests/test_requests.py

And then somewhere appears

 error = SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1082)'))
 _pool = <urllib3.connectionpool.HTTPSConnectionPool object at 0x7f0a6d92a2c0>
 _stacktrace = <traceback object at 0x7f0a6dfa7a80>
....
 FAILED tests/test_requests.py::TestPreparingURLs::test_different_connection_pool_for_tls_settings_verify_bundle_unexpired_cert

I prepared https://github.com/sebastianas/requests/commit/339333739074118a93a9f496981b394e94bc1690 as a fix but can't open a pull request.

Sebastian

Start with the Makefiles and certificate fixtures under tests/certs/expired, tests/certs/mtls, and tests/certs/valid/server, then reproduce the issue with the listed make and pytest commands. Done means the generated certificates contain subjectKeyIdentifier and authorityKeyIdentifier and the affected tests pass under OpenSSL 4.0.2.