ssl certificate authentication in python

Question

I have been given the following code that should perform an ssl handshake and certificate authentication:

1   s = socket.socket()
2   print "connecting..."
3   logging.debug("Connecting")
4   # Connect with SSL mutual authentication
5   # We only trust our server's CA, and it only trusts user certificates signed by it
6   c = ssl.wrap_socket(s, cert_reqs=ssl.CERT_REQUIRED,
7                       ssl_version=ssl.PROTOCOL_SSLv3, ca_certs='ca.crt',
8                       certfile='user.crt', keyfile='user.key')
9   c.connect((constants.server_addr, constants.port))

I have 2 questions about this:

where do we specify the server/port to which we are connecting? are these arguments to socket.socket()?
I have a .p12 from which I extracted a cert and a key in pem format(see this question), and I assume that these correspond to user.crt and user.key (line 8), respectively. However, while I assume that ca.crt (line 7) is retrived from the certificate authority, how to I retrieve it?

If any part of the above code or my assumptions about it are incorrect, please let me know. Thanks!

Actually -- PKCS#12 files (your .p12 file) can, and typically do, contain the relevant CA certificate as well. — Charles Duffy
– Charles Duffy, Commented May 17, 2012 at 16:19
@CharlesDuffy, your own PKCS#12 file is likely to contain your own certificate's chain, but not the servers (unless they are the same, which isn't necessarily the case). — Bruno
– Bruno, Commented May 17, 2012 at 16:50
@CharlesDuffy how would I retrieve the CA cert from the p12? — ewok
– ewok, Commented May 17, 2012 at 17:06
@Bruno Fair enough -- I was presuming a private (ie. corporate) CA used for both ends here. — Charles Duffy
– Charles Duffy, Commented May 17, 2012 at 20:10
@ewok see man pkcs12 -- particularly -cacerts in conjunction with -out. That said, Bruno's warning applies -- the client and server certificates may or may not be signed by the same CA. — Charles Duffy
– Charles Duffy, Commented May 17, 2012 at 20:11

Mattie B · Accepted Answer · 2012-05-17 16:17:13Z

2

Server address and port are specified as part of the socket address in line 9, specified as the parameter to connect.
Generally, you've acquired the CA certificate via some out-of-band method, then saved it locally. Linux systems generally have a bundle of certificates for well-known, trusted CAs available under /etc/ssl/certs or similar.

answered May 17, 2012 at 16:17

Mattie B

21.5k7 gold badges39 silver badges57 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

ewok Over a year ago

the code is being run on Windows. any idea where it would be stored there? would it be retrievable through security exceptions saved in firefox?

Mattie B Over a year ago

You can export the CA certificates from Firefox, sure, if you know which CA signed the server's certificate. Use PEM format for use with the ssl library (see docs.python.org/library/ssl.html#certificates). But if the server was not signed by one of those CAs, you will want to ask the organization that runs the server about getting a certificate.

Collectives™ on Stack Overflow

ssl certificate authentication in python

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related