SSLContext.get_ca_certs() and self-signed certs

[tiran]

BPO	20000
Nosy	@loewis, @pitrou, @tiran

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2013-12-16.18:53:50.956>
labels = ['extension-modules', 'type-bug', '3.7']
title = 'SSLContext.get_ca_certs() and self-signed certs'
updated_at = <Date 2016-09-08.22:47:29.968>
user = 'https://github.com/tiran'

bugs.python.org fields:

activity = <Date 2016-09-08.22:47:29.968>
actor = 'christian.heimes'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Extension Modules']
creation = <Date 2013-12-16.18:53:50.956>
creator = 'christian.heimes'
dependencies = []
files = []
hgrepos = []
issue_num = 20000
keywords = []
message_count = 5.0
messages = ['206347', '206352', '206417', '206423', '207163']
nosy_count = 4.0
nosy_names = ['loewis', 'pitrou', 'christian.heimes', 'Arfrever']
pr_nums = []
priority = 'normal'
resolution = None
stage = 'test needed'
status = 'pending'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue20000'
versions = ['Python 3.7']

[tiran]

The new method SSLContext.get_ca_certs() returns all certificates in the context's trusted X509_STORE. I recently found out that it is possible to put a self-signed certificate into the store and use it successfully with verify_mode CERT_REQUIRED. get_ca_certs() doesn't return the cert although it is used to successfully validate a remote cert.

I propose to modify and rename the function and to add a "check_ca" to the dict that is returned by getpeercert().

[tiran]

Example:

$ openssl s_server -cert Lib/test/ssl_cert.pem -key Lib/test/ssl_key.pem

$ ./python
>>> import ssl
>>> ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv3)
>>> ctx.verify_mode = ssl.CERT_REQUIRED
>>> ctx.check_hostname = True
>>> ctx.load_verify_locations("Lib/test/ssl_cert.pem")
>>> s = ssl.create_connection(("localhost", 4433))
>>> with ctx.wrap_socket(s, server_hostname="localhost") as ssock:
...     peer = ssock.getpeercert()
... 
>>> peer
{'notAfter': 'Oct  5 23:01:56 2020 GMT', 'version': 3, 'serialNumber': 'D7C7381919AFC24E', 'subjectAltName': (('DNS', 'localhost'),), 'issuer': ((('countryName', 'XY'),), (('localityName', 'Castle Anthrax'),), (('organizationName', 'Python Software Foundation'),), (('commonName', 'localhost'),)), 'subject': ((('countryName', 'XY'),), (('localityName', 'Castle Anthrax'),), (('organizationName', 'Python Software Foundation'),), (('commonName', 'localhost'),)), 'notBefore': 'Oct  8 23:01:56 2010 GMT'}
>>> ctx.get_ca_certs()
[]

[pitrou]

get_ca_certs() doesn't return the cert although it is used to
successfully validate a remote cert.

Interesting. Is it because of the way you implemented get_ca_certs()?

I propose to modify and rename the function and to add a "check_ca" to
the dict that is returned by getpeercert().

Can you explain? What does "check_ca" mean?

[tiran]

Interesting. Is it because of the way you implemented get_ca_certs()?

Yes, it's the line

http://hg.python.org/cpython/file/b78de8029606/Modules/_ssl.c#l3103

that skips all certs that are not recognized as CA certs. I wasn't aware
that OpenSSL supports self-signed certs that way.

Can you explain? What does "check_ca" mean?

The return value of X509_check_ca().

http://git.openssl.org/gitweb/?p=openssl.git;a=blob;f=crypto/x509v3/v3_purp.c;h=6c40c7dfc318e4b46fc20d38581ad3656e344b5e;hb=HEAD#l517

[loewis]

BTW, congrats to issue 20,000.