# Buggy code
def dummy_cert(privkey, cacert, commonname, sans):
    """
    Generates a dummy certificate.

    privkey: CA private key
    cacert: CA certificate
    commonname: Common name for the generated certificate.
    sans: A list of Subject Alternate Names.

    Returns cert if operation succeeded, None if not.
    """
    ss = []
    for i in sans:
        try:
            ipaddress.ip_address(i.decode("ascii"))
        except ValueError:
            ss.append(b"DNS: %s" % i)
        else:
            ss.append(b"IP: %s" % i)
    ss = b", ".join(ss)

    cert = OpenSSL.crypto.X509()
    cert.gmtime_adj_notBefore(-3600 * 48)
    cert.gmtime_adj_notAfter(DEFAULT_EXP)
    cert.set_issuer(cacert.get_subject())
    if commonname is not None:
        cert.get_subject().CN = commonname
    cert.set_serial_number(int(time.time() * 10000))
    if ss:
        cert.set_version(2)
        cert.add_extensions(
            [OpenSSL.crypto.X509Extension(b"subjectAltName", False, ss)]
        )
    cert.set_pubkey(cacert.get_pubkey())
    cert.sign(privkey, "sha256")
    return SSLCert(cert)


# Traceback (OpenSSL.crypto.Error)
[1026/094737:ERROR:ssl_client_socket_openssl.cc(1149)] handshake failed; returned -1, SSL error code 1, net_error -100
Traceback (most recent call last):
File "c:\users\user\git\mitmproxy\mitmproxy\proxy\server.py", line 115, in handle
root_layer()
File "c:\users\user\git\mitmproxy\mitmproxy\proxy\modes\http_proxy.py", line 9, in __call__
layer()
File "c:\users\user\git\mitmproxy\mitmproxy\proxy\protocol\tls.py", line 379, in __call__
layer()
File "c:\users\user\git\mitmproxy\mitmproxy\proxy\protocol\http1.py", line 72, in __call__
layer()
File "c:\users\user\git\mitmproxy\mitmproxy\proxy\protocol\http.py", line 173, in __call__
self.handle_regular_mode_connect(request)
File "c:\users\user\git\mitmproxy\mitmproxy\proxy\protocol\http.py", line 270, in handle_regular_mode_connect
layer()
File "c:\users\user\git\mitmproxy\mitmproxy\proxy\protocol\tls.py", line 374, in __call__
self._establish_tls_with_client()
File "c:\users\user\git\mitmproxy\mitmproxy\proxy\protocol\tls.py", line 463, in _establish_tls_with_client
cert, key, chain_file = self._find_cert()
File "c:\users\user\git\mitmproxy\mitmproxy\proxy\protocol\tls.py", line 580, in _find_cert
return self.config.certstore.get_cert(host, list(sans))
File "c:\users\user\git\mitmproxy\mitmproxy\certs.py", line 349, in get_cert
sans),
File "c:\users\user\git\mitmproxy\mitmproxy\certs.py", line 106, in dummy_cert
cert.get_subject().CN = commonname
File "c:\users\user\git\mitmproxy\venv\lib\site-packages\OpenSSL\crypto.py", line 532, in __setattr__
_raise_current_error()
File "c:\users\user\git\mitmproxy\venv\lib\site-packages\OpenSSL\_util.py", line 48, in exception_from_error_queue
raise exception_type(errors)
OpenSSL.crypto.Error: [('asn1 encoding routines', 'ASN1_mbstring_ncopy', 'string too long')]

mitmproxy has crashed!
Please lodge a bug report at: https://github.com/mitmproxy/mitmproxy

# Fixed code
def dummy_cert(privkey, cacert, commonname, sans):
    """
    Generates a dummy certificate.

    privkey: CA private key
    cacert: CA certificate
    commonname: Common name for the generated certificate.
    sans: A list of Subject Alternate Names.

    Returns cert if operation succeeded, None if not.
    """
    ss = []
    for i in sans:
        try:
            ipaddress.ip_address(i.decode("ascii"))
        except ValueError:
            ss.append(b"DNS: %s" % i)
        else:
            ss.append(b"IP: %s" % i)
    ss = b", ".join(ss)

    cert = OpenSSL.crypto.X509()
    cert.gmtime_adj_notBefore(-3600 * 48)
    cert.gmtime_adj_notAfter(DEFAULT_EXP)
    cert.set_issuer(cacert.get_subject())
    if commonname is not None and len(commonname) < 64:
        cert.get_subject().CN = commonname
    cert.set_serial_number(int(time.time() * 10000))
    if ss:
        cert.set_version(2)
        cert.add_extensions(
            [OpenSSL.crypto.X509Extension(b"subjectAltName", False, ss)]
        )
    cert.set_pubkey(cacert.get_pubkey())
    cert.sign(privkey, "sha256")
    return SSLCert(cert)