Authority Key Identifier creation with a certificate is wrong.

[infinityat0]

The code inside X509ExtensionUtils to create the authorityKeyIdentifier is incorrect. It takes in the signing CA cert and adds the GeneralName as the issuer of the CA whereas it should be the subject of the CA.

Here's the spec: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1

The authority key identifier extension provides a means of
identifying the public key corresponding to the private key used to
sign a certificate.

The authority key identifier in this case is identifying the signer of the CA and not the CA.

https://github.com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/cert/X509ExtensionUtils.java#L42

    public AuthorityKeyIdentifier createAuthorityKeyIdentifier(
        X509CertificateHolder certHolder)
    {
        GeneralName             genName = new GeneralName(certHolder.getIssuer());

        return new AuthorityKeyIdentifier(
                getSubjectKeyIdentifier(certHolder), new GeneralNames(genName), certHolder.getSerialNumber());
    }