Bizarre `OverflowError: cannot convert float infinity to integer` on `cryptography>=45.0.5` (OpenSSL >= 3.5.1), Windows CPython >= 3.13.1, if CPU supports AVX512-IFMA

[sparrowt]

Problem

Sometimes (but not always) when running the test code below on python 3.14 on Windows it fails with this very odd error:

Traceback (most recent call last):
  File "C:\path\to\test_weirdness.py", line 136, in <module>
    foo_int_ca = create_intermediate_certificate(
        subject_name=x509.Name.from_rfc4514_string(
            'C=GB,ST=England,O=Foo Ltd,CN=Foo Ltd Intermediate CA'),
        issuer=foo_ca)
  File "C:\path\to\test_weirdness.py", line 65, in create_intermediate_certificate
    builder = prepare_certificate(subject_name, issuer.cert.subject, 730, public_key)
  File "C:\path\to\test_weirdness.py", line 21, in prepare_certificate
    builder = builder.not_valid_before(today - datetime.timedelta(days=math.floor(float(valid_days) * 0.3)))
                                                                       ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
OverflowError: cannot convert float infinity to integer

despite valid_days being 730 where of course we expect this simple maths to work just fine:

Python 3.14.2 (tags/v3.14.2:df79316, Dec  5 2025, 17:18:21) [MSC v.1944 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import math
>>> valid_days = 730
>>> math.floor(float(valid_days) * 0.3)
219

This only seems to happen with certain cryptography versions, which is why I'm filing it here, despite the error occurring in a bit of basic python maths in a very strange way.

Environment

> python.exe -VV
Python 3.14.2 (tags/v3.14.2:df79316, Dec  5 2025, 17:18:21) [MSC v.1944 64 bit (AMD64)]

This repros on cryptography versions:

• 46.0.5 and all versions back to and including 46.0.0
• 45.0.7 (EDIT: and back to 45.0.5 but not before)

But cryptography==44.0.3 does not repro after many attempts.

Repro code

EDIT: see this comment for a slightly smaller repro script which loops until it breaks.

Original repro code

import datetime
import math
from collections import namedtuple

from cryptography import x509
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import rsa

CertKeyPair = namedtuple('CertKeyPair', ['cert', 'key'])
CertificateDetails = namedtuple('CertificateDetails', 'pem thumbprint')


def prepare_certificate(subject_name: x509.Name, issuer_name: x509.Name, valid_days: int, public_key) -> x509.CertificateBuilder:
    builder = x509.CertificateBuilder()
    builder = builder.subject_name(subject_name)
    builder = builder.issuer_name(issuer_name)
    today = datetime.datetime.today()

    # NOTE: this is the line which (sometimes) fails with `OverflowError: cannot convert float infinity to integer`
    # despite `valid_days` being a normal integer (e.g. 730 or 365) as confirmed in pdb
    builder = builder.not_valid_before(today - datetime.timedelta(days=math.floor(float(valid_days) * 0.3)))
    builder = builder.not_valid_after(today + datetime.timedelta(days=math.ceil(float(valid_days) * 0.7)))
    builder = builder.serial_number(x509.random_serial_number())
    builder = builder.public_key(public_key)

    return builder


def create_ca_certificate(subject_name: x509.Name) -> CertKeyPair:
    private_key = rsa.generate_private_key(
        public_exponent=65537,
        key_size=2048,
    )
    public_key = private_key.public_key()
    builder = prepare_certificate(subject_name, subject_name, 3650, public_key)
    builder = builder.add_extension(
        x509.BasicConstraints(ca=True, path_length=None), critical=True,
    )
    builder = builder.add_extension(
        x509.KeyUsage(
            digital_signature=True,
            content_commitment=False,
            key_encipherment=False,
            data_encipherment=False,
            key_agreement=False,
            key_cert_sign=True,
            crl_sign=True,
            encipher_only=False,
            decipher_only=False
        ), critical=True,
    )
    subject_key_id = x509.SubjectKeyIdentifier.from_public_key(public_key)
    builder = builder.add_extension(subject_key_id, critical=False)
    builder = builder.add_extension(x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(subject_key_id), critical=False)
    certificate = builder.sign(private_key=private_key, algorithm=hashes.SHA256())
    return CertKeyPair(cert=certificate, key=private_key)


def create_intermediate_certificate(subject_name: x509.Name, issuer: CertKeyPair) -> CertKeyPair:
    private_key = rsa.generate_private_key(
        public_exponent=65537,
        key_size=2048,
    )
    public_key = private_key.public_key()
    builder = prepare_certificate(subject_name, issuer.cert.subject, 730, public_key)
    builder = builder.add_extension(
        x509.BasicConstraints(ca=True, path_length=1), critical=True,
    )
    builder = builder.add_extension(
        x509.KeyUsage(
            digital_signature=True,
            content_commitment=False,
            key_encipherment=False,
            data_encipherment=False,
            key_agreement=False,
            key_cert_sign=True,
            crl_sign=True,
            encipher_only=False,
            decipher_only=False
        ), critical=True,
    )
    builder = builder.add_extension(x509.SubjectKeyIdentifier.from_public_key(public_key), critical=False)
    builder = builder.add_extension(
        x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(
            issuer.cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier).value
        ), critical=False
    )
    certificate = builder.sign(private_key=private_key, algorithm=hashes.SHA256())
    return CertKeyPair(cert=certificate, key=private_key)


def create_leaf_certificate(subject_name: x509.Name, issuer: CertKeyPair) -> CertKeyPair:
    private_key = rsa.generate_private_key(
        public_exponent=65537,
        key_size=2048,
    )
    public_key = private_key.public_key()
    builder = prepare_certificate(subject_name, issuer.cert.subject, 365, public_key)
    builder = builder.add_extension(
        x509.BasicConstraints(ca=False, path_length=None), critical=True,
    )
    builder = builder.add_extension(
        x509.KeyUsage(
            digital_signature=True,
            content_commitment=True,
            key_encipherment=True,
            data_encipherment=False,
            key_agreement=False,
            key_cert_sign=False,
            crl_sign=False,
            encipher_only=False,
            decipher_only=False
        ), critical=True,
    )
    builder = builder.add_extension(x509.SubjectKeyIdentifier.from_public_key(public_key), critical=False)
    builder = builder.add_extension(
        x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(
            issuer.cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier).value
        ), critical=False
    )
    certificate = builder.sign(private_key=private_key, algorithm=hashes.SHA256())
    return CertKeyPair(cert=certificate, key=private_key)


# Normally it fails in one of `create_intermediate_certificate` or `create_leaf_certificate`
# with an error in `prepare_certificate` like this:
#     builder = builder.not_valid_before(today - datetime.timedelta(days=math.floor(float(valid_days) * 0.3)))
#                                                                        ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
#     OverflowError: cannot convert float infinity to integer
# though sometimes it runs successfully.
# This behaviour started since upgrading to cryptography==46.0.5

foo_ca = create_ca_certificate(
    subject_name=x509.Name.from_rfc4514_string(
        'C=GB,ST=England,O=Foo Ltd,CN=Foo Ltd CA'))
foo_int_ca = create_intermediate_certificate(
    subject_name=x509.Name.from_rfc4514_string(
        'C=GB,ST=England,O=Foo Ltd,CN=Foo Ltd Intermediate CA'),
    issuer=foo_ca)
foo_signing_cert = create_leaf_certificate(
    subject_name=x509.Name.from_rfc4514_string(
        'C=GB,ST=England,O=Foo Ltd,CN=Foo Ltd Signing Certificate'),
    issuer=foo_int_ca)

[alex]

There's a significant amount of code here, issuing multiple certificates. Are you able to produce a minimal reproducer?

I'll note that based on the traceback you shared, it looks like the exception isn't coming from within cryptography at all, which is partially why I think really reducing this example is critical.

[sparrowt]

Yes I fully appreciate the desire for minimal to be smaller - I've already cut a lot out of the original test code where this randomly started failing, but I'll see if I can get something smaller.

I appreciate it's a very odd one - nevertheless there is a strong correlation between upgrading cryptography from 44 to 46 when this started happening, and the fact that the above self-contained code can reliably reproduce the bizarre python behaviour only when cryptography is at version >=45.

I'll see what I can do to narrow it down; I wanted to get this out there to be discoverable in case anyone else hits the same thing.

EDIT: of course we could cut out the whole of create_leaf_certificate it would just reduce the failure rate.

[alex]

Is it possible you upgraded something besides cryptography at the same time?

[sparrowt]

No other packages were modified - this reproduces in a blank python 3.14.2 venv with the following minimal dependencies:

pip install cryptography==46.0.5 pycparser==3.0 cffi==2.0.0

but does not reproduce in an equivalent env except with older cryptography:

pip install cryptography==44.0.3 pycparser==3.0 cffi==2.0.0

Here is a ~50% smaller version, with a loop-until-it-repros - it turns out it repros (albeit less quickly) with only create_ca_certificate so I deleted both the lef & intermediate methods. See also the "NOTE" comment in create_ca_certificate about an attempt I made to reduce it further, which stopped the repro.

# /// script
# dependencies = [
#     "cffi==2.0.0",
#     "cryptography==45.0.5",
#     "pycparser==3.0",
# ]
# ///

import datetime
import math
from collections import namedtuple

from cryptography import x509, __version__ as cryptography_version
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import rsa

import sys
print(f"Running on python version {sys.version} with cryptography version {cryptography_version}")

CertKeyPair = namedtuple('CertKeyPair', ['cert', 'key'])
CertificateDetails = namedtuple('CertificateDetails', 'pem thumbprint')


def prepare_certificate(subject_name: x509.Name, issuer_name: x509.Name, valid_days: int, public_key) -> x509.CertificateBuilder:
    builder = x509.CertificateBuilder()
    builder = builder.subject_name(subject_name)
    builder = builder.issuer_name(issuer_name)
    today = datetime.datetime.today()

    # NOTE: this is the line which (sometimes) fails with `OverflowError: cannot convert float infinity to integer`
    # despite `valid_days` being a normal integer (e.g. 730 or 365) as confirmed in pdb
    builder = builder.not_valid_before(today - datetime.timedelta(days=math.floor(float(valid_days) * 0.3)))
    builder = builder.not_valid_after(today + datetime.timedelta(days=math.ceil(float(valid_days) * 0.7)))
    builder = builder.serial_number(x509.random_serial_number())
    builder = builder.public_key(public_key)

    return builder


def create_ca_certificate(subject_name: x509.Name) -> CertKeyPair:
    private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
    public_key = private_key.public_key()
    builder = prepare_certificate(subject_name, subject_name, 3650, public_key)

    # NOTE: if we comment out the rest of this method, the bug no longer repros
    # so presumably something below here sets up the problem for the next time we get to `prepare_certificate`

    builder = builder.add_extension(
        x509.BasicConstraints(ca=True, path_length=None), critical=True,
    )
    builder = builder.add_extension(
        x509.KeyUsage(digital_signature=True, content_commitment=False, key_encipherment=False, data_encipherment=False,
                      key_agreement=False, key_cert_sign=True, crl_sign=True, encipher_only=False, decipher_only=False),
        critical=True,
    )
    subject_key_id = x509.SubjectKeyIdentifier.from_public_key(public_key)
    builder = builder.add_extension(subject_key_id, critical=False)
    builder = builder.add_extension(x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(subject_key_id), critical=False)
    certificate = builder.sign(private_key=private_key, algorithm=hashes.SHA256())
    return CertKeyPair(cert=certificate, key=private_key)


attempt = 1
while True:
    try:
        foo_ca = create_ca_certificate(
            subject_name=x509.Name.from_rfc4514_string('C=GB,ST=England,O=Foo Ltd,CN=Foo Ltd CA')
        )
        print(".", end='', flush=True)
        attempt += 1
    except Exception:
        print(f"\n💥 Failed on attempt {attempt}")
        raise
    except KeyboardInterrupt:
        print(f"\n✅ User cancelled after {attempt - 1} successful attempts")
        break

This is what happens when I run it a few times in that fresh minimal venv:

[alex]

How quickly does this generally reproduce for you? I've got >=500 dots without incident on my laptop.

Have you tried adding debug printing to establish what the value of valid_days, float(valid_days), etc. are?

[sparrowt]

P.S. this is what I see running the exact same script in a venv with cryptography==44.0.3

6592 and counting with no repro on 44.0.3

[alex]

(tempenv-1ded178615ee0) ~/.v/tempenv-1ded178615ee0 ❯❯❯ python3 t.py 
...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^CTraceback (most recent call last):
  File "/Users/alex_gaynor/.virtualenvs/tempenv-1ded178615ee0/t.py", line 55, in <module>
    foo_ca = create_ca_certificate(
        subject_name=x509.Name.from_rfc4514_string('C=GB,ST=England,O=Foo Ltd,CN=Foo Ltd CA')
    )
  File "/Users/alex_gaynor/.virtualenvs/tempenv-1ded178615ee0/t.py", line 30, in create_ca_certificate
    private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
  File "/Users/alex_gaynor/.virtualenvs/tempenv-1ded178615ee0/lib/python3.14/site-packages/cryptography/hazmat/primitives/asymmetric/rsa.py", line 156, in generate_private_key
    return rust_openssl.rsa.generate_private_key(public_exponent, key_size)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
KeyboardInterrupt
(tempenv-1ded178615ee0) ~/.v/tempenv-1ded178615ee0 ❯❯❯ uv pip freeze
Using Python 3.14.3 environment at: .
cffi==2.0.0
cryptography==46.0.5
pip==25.3
pycparser==3.0

[sparrowt]

How quickly does this generally reproduce for you? I've got >=500 dots without incident on my laptop.

Reliably in less than 1s on cryptography 46.x (several occurrences shown in the screenshot at the bottom of this comment)

Have you tried adding debug printing to establish what the value of valid_days, float(valid_days), etc. are?

I ran it under pdb and confirmed that when it dropped to the debugger on repro, valid_days = 3650 and float and math.floor are working normally as expected, and yet the exception was thrown - I realise how bizarre this is, but I can't chalk this one up to cosmic rays... 😆

[reaperhulk]

I can't replicate this error with Python 3.14 on an M1 mac or on Python 3.13 on Debian 13 on an x86_64 server. Do you have other machines where you can replicate this?

[alex]

Just abstractly, there's two ways I can imagine something like this being caused by cryptography:

1. Memory corruption
2. Some sort of FP register flag modification that doesn't get set correctly

[sparrowt]

Yes it's so bizarre, my initial thought was memory corruption too.

It doesn't reproduce in WSL2 (Ubuntu 22.04) on the same machine, so perhaps some binary extension in the windows wheel is the culprit? e.g. I'm getting (obviously) cryptography-46.0.5-cp311-abi3-win_amd64.whl

[sparrowt]

I've tried the same thing from scratch on the other Windows box which I have access to and - your relief will be audible - it hasn't yet reproduced...

Now I'm starting to go crazy and wondering if my actual CPU is subtly busted 🤯

I appreciate your looking into this, and apologies that it's seeming to be somewhat futile - I'm glad it isn't as bad as I initially feared given it doesn't seem to be reproducible by others, despite its reliable reproduction in a clean venv on one machine (in 100% correlation with the cryptography version...).

Something very weird is going on - there's a reason I started the issue title with the word "Bizarre" (!)

[sparrowt]

It reproduces (on the one original, cursed (?), Windows machine) on all of the following python versions:

Python 3.13.11 (tags/v3.13.11:6278944, Dec  5 2025, 16:26:58) [MSC v.1944 64 bit (AMD64)]
and after upgrading to
Python 3.13.12 (tags/v3.13.12:1cbe481, Feb  3 2026, 18:22:25) [MSC v.1944 64 bit (AMD64)]

Python 3.14.2 (tags/v3.14.2:df79316, Dec  5 2025, 17:18:21) [MSC v.1944 64 bit (AMD64)]
and after upgrading to
Python 3.14.3 (tags/v3.14.3:323c59a, Feb  3 2026, 16:04:56) [MSC v.1944 64 bit (AMD64)]

so it's not (somehow) a corrupted python install, to rule out one thing at least.

[nelhage]

"cursed machine" does seem relatively likely, given all of that.

But if you wanted to dive in more, and you're comfortable with a machine-level debugging (e.g. gdb, although on Windows maybe WinDbg?), you might try setting a breakpoint on the line that raises that error, and poking at register state, and also popping up a few C frames and inspecting the locals in the Python frame's localsplus.

It'd be easiest if you have a build with debug symbols and it reproduces there, of course; doing it without symbols might be doable but a lot more fiddly.