Unusual self-signed certificate creation and verification

cert.pem

-----BEGIN CERTIFICATE-----
MIIDZjCCAk6gAwIBAgIUVH0iZ4zKue6OdcaHZ8ul+Hc6gtcwDQYJKoZIhvcNAQEL
BQAwSjEjMCEGA1UEAwwaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDMxFjAUBgNV
BAoMDUxldCdzIEVuY3J5cHQxCzAJBgNVBAYTAlVTMB4XDTE4MTEwNTE5Mzg0MFoX
DTE5MDIwMzE5Mzg0MFowGzEZMBcGA1UEAwwQZXhhbXBsZS5pbnZhbGlsZDCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5kmB+Gm1mNLylGBf4BcakMU5bb
9/rNwTX0jXmFKOrRkbXbkea8RKPjlv+oQrZ8zMu8bgmTyJvk0esSbedGbq2tzDfi
Q4fz9dPu+Y4oXnXz0G/zzNibQiXnJJ+AnO5u4BmLHcg/eQQyBQm+tsxDlpd+A9WG
wejFUE2XkBG/3yQgPRCzO5w6LopbDX+sP1nDoFME4m0lCmB++w0BQBxlYHT3pMZP
dDx7VlychO6UFXz4PPPKnwT2rz1orqNdQ9OohP7ONxPh7QwPD+fKnt7ufyCl+VSg
ng267PBddmO/O8JNNWGZuW8xqdP7Wwvd2w++NSr7yvcV3YfxhPIgbJ2IhvECAwEA
AaNzMHEwLQYDVR0RBCYwJIIPZXhhbXBsZS5pbnZhbGlkghEqLmV4YW1wbGUuaW52
YWxpZDAfBgNVHQ4EGAQWqEpqYwR93brm0Tm3pkVldmVm86jsoTAfBgNVHSMEGDAW
gBTEp7Gkeyxx+tvhS5B1/8QVYIWJEDANBgkqhkiG9w0BAQsFAAOCAQEAO8lCWaOu
4esGpKx3HVxNDLRQbjBqFjB3SviF3rrHfgBTNXYO+aGS/LIYL7R6hMeiWh3hir+/
37VxDIh/tv3ochiT73zTlMNUwFc3967KS7buPKuq4BA6NEXBHfJLm1KRJBVS6YyG
EogJgRc+Bso791d2so6YLS9Fh8QetkCJDAHq0X4pyTcq9xn07P+HIBZAPRxhI+NW
fS6V9EWwB0zBfg+DUZUbixvwcvSn93ho9WyIe5/zVm8RcCyjpImglqh7SVNmZGUO
HgiMhZau8W3nLkMxuTZrkQp7970ItP6R6UCJOHB5qmYEJO0H6D1Dzy5yqMb4xSlK
yEuy7co9BA7Cng==
-----END CERTIFICATE-----

create-cert.py

import datetime
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.x509.oid import NameOID

key = rsa.generate_private_key(65537, 2048, default_backend())

subject = x509.Name([
    x509.NameAttribute(NameOID.COMMON_NAME, 'example.invalild')
])
issuer = x509.Name([
    x509.NameAttribute(NameOID.COMMON_NAME, 'Let\'s Encrypt Authority X3'),
    x509.NameAttribute(NameOID.ORGANIZATION_NAME, 'Let\'s Encrypt'),
    x509.NameAttribute(NameOID.COUNTRY_NAME, 'US')
])

now = datetime.datetime.utcnow()
builder = x509.CertificateBuilder()
builder = builder.subject_name(subject)
builder = builder.issuer_name(issuer)
builder = builder.public_key(key.public_key())
builder = builder.serial_number(x509.random_serial_number())
builder = builder.not_valid_before(now)
builder = builder.not_valid_after(now + datetime.timedelta(days=90))
builder = builder.add_extension(
    x509.SubjectAlternativeName([
        x509.DNSName('example.invalid'),
        x509.DNSName('*.example.invalid')
    ]),
    critical=False
)
builder = builder.add_extension(
    x509.SubjectKeyIdentifier(
        digest=b'\xa8\x4a\x6a\x63\x04\x7d\xdd\xba\xe6\xd1\x39\xb7\xa6\x45\x65vef\xf3\xa8\xec\xa1'
    ),
    critical=False
)
builder = builder.add_extension(
    x509.AuthorityKeyIdentifier(
        key_identifier=b'\xc4\xa7\xb1\xa4\x7b\x2c\x71\xfa\xdb\xe1\x4b\x90\x75\xff\xc4\x15\x60\x85\x89\x10',
        authority_cert_issuer=None,
        authority_cert_serial_number=None
    ),
    critical=False
)
cert = builder.sign(key, hashes.SHA256(), default_backend())
with open('/tmp/cert.pem', 'wb') as f:
    f.write(cert.public_bytes(serialization.Encoding.PEM))

verify-cert.py

from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import padding

with open('/tmp/cert.pem', 'rb') as f:
    cert = x509.load_pem_x509_certificate(f.read(), default_backend())

public_key = cert.public_key()

public_key.verify(
    cert.signature,
    cert.tbs_certificate_bytes,
    padding.PKCS1v15(),
    cert.signature_hash_algorithm
)