diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml
index 655af05..3578da3 100644
--- a/.github/workflows/ios.yml
+++ b/.github/workflows/ios.yml
@@ -37,7 +37,9 @@ jobs:
         run: |
           set -o pipefail
           mkdir -p build
-          python3 -u tools/tls_fixture.py > build/tls-fixture.log 2>&1 &
+          python3 -m venv build/test-tools
+          build/test-tools/bin/pip install cryptography==46.0.3
+          build/test-tools/bin/python -u tools/tls_fixture.py > build/tls-fixture.log 2>&1 &
           TLS_PID=$!
           trap 'kill "$TLS_PID" 2>/dev/null || true' EXIT
           for attempt in {1..30}; do
diff --git a/tools/tls_fixture.py b/tools/tls_fixture.py
index 5e6050c..4849c52 100644
--- a/tools/tls_fixture.py
+++ b/tools/tls_fixture.py
@@ -13,6 +13,9 @@ import subprocess
 import threading
 import time
 import zlib
+import datetime
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
 
 root = pathlib.Path(__file__).resolve().parents[1]
 work = root / "build/tls"
@@ -167,9 +170,21 @@ for name, days in (("valid", "1825"), ("expired", "-1")):
     key, csr, cert = (work / (name + suffix) for suffix in (".key", ".csr", ".pem"))
     subprocess.run(["openssl", "req", "-new", "-newkey", "rsa:2048", "-nodes", "-config", str(config),
                     "-keyout", str(key), "-out", str(csr)], check=True, capture_output=True, timeout=15)
-    subprocess.run(["openssl", "x509", "-req", "-in", str(csr), "-signkey", str(key), "-sha256",
-                    "-days", days, "-extfile", str(config), "-extensions", "ext", "-out", str(cert)],
-                   check=True, capture_output=True, timeout=15)
+    if name == "expired":
+        private_key = serialization.load_pem_private_key(key.read_bytes(), password=None)
+        template = x509.load_pem_x509_certificate((work / "valid.pem").read_bytes())
+        now = datetime.datetime.now(datetime.timezone.utc)
+        builder = (x509.CertificateBuilder().subject_name(template.subject).issuer_name(template.issuer)
+                   .public_key(private_key.public_key()).serial_number(x509.random_serial_number())
+                   .not_valid_before(now - datetime.timedelta(days=2))
+                   .not_valid_after(now - datetime.timedelta(days=1)))
+        for extension in template.extensions:
+            builder = builder.add_extension(extension.value, extension.critical)
+        cert.write_bytes(builder.sign(private_key, hashes.SHA256()).public_bytes(serialization.Encoding.PEM))
+    else:
+        subprocess.run(["openssl", "x509", "-req", "-in", str(csr), "-signkey", str(key), "-sha256",
+                        "-days", days, "-extfile", str(config), "-extensions", "ext", "-out", str(cert)],
+                       check=True, capture_output=True, timeout=15)
     context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
     context.minimum_version = ssl.TLSVersion.TLSv1_2
     context.load_cert_chain(cert, key)