Python SSL Socket Client Authentification

Question

I'm trying to set up a server and client in python where the server authenticates clients using SSL with certificates. There are a lot of examples of SSL certificates online, but everything I've found has the server providing a certificate to the client and the client checking it. I need the server to ensure that the client has the authority to connect to the server. I understand how to generate and send certificates and the basics of how they work. I would type out my code, but my client/server without SSL is working fine and I've been referencing this for SSL. The client/server example at the bottom of that page summarizes my understanding of SSL certs in python.

I realize this isn't much to go on, but if someone could explain the basic modifications to that example to have the server authenticate the client instead of the other way around, that would be awesome. Alternatively, a link to an example or even just some socket methods to investigate would be very helpful. Let me know if more information is needed. I don't mean to be vague and promise I've spent all morning looking for info myself :).

Edit: I'm trying to stick to the basic ssl library. Aka "import ssl".

jlujan · Accepted Answer · 2012-12-31 20:34:50Z

3

You would use SSLSocket.getpeercert to get the certificate. The client would need to specify a key and certificate when wrapping the socket just like the server side. On the server side, you will also need to pass ca_certs="path_to_ca_cert_file" and probably also want to specify cert_reqs=CERT_REQUIRED (see. args for ssl.wrap_socket.

In addition to this, it sounds like you might be looking to do certificate based client authentication/authorization? This is a simple matter of using getpeercert to get the client certificate and accessing fields within the certificate to use in a normal authentication path (i.e. Common Name == User Id)

edited Dec 31, 2012 at 20:34

answered Dec 31, 2012 at 20:23

jlujan

1,1887 silver badges10 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mihai8 · Accepted Answer · 2012-12-31 18:50:56Z

0

Not really sure what your question refers, however you can see SSL in Python, other resource for SSL in Python, Validating SSL, get SSL Certificate information and you probably found other good links.

answered Dec 31, 2012 at 18:50

Mihai8

3,1471 gold badge23 silver badges33 bronze badges

1 Comment

user1777820 Over a year ago

It's my understanding that the code in the example I linked has the server send the client its certificate. The client then checks the cert against its chain of certs to maker sure the server is ok to connect to. I need to do the opposite. I need the client to send the server its cert, have the server check the client's cert against its list of allowed, and finally complete the handshake with the client. I'll keep reading...maybe I don't understand as much as I thought. Thanks for the links.

Collectives™ on Stack Overflow

Python SSL Socket Client Authentification

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related