Quantcast
Channel: Active questions tagged https - Stack Overflow
Viewing all articles
Browse latest Browse all 1543

How to configure Python ssl server ciphers to match client's

$
0
0

I'm trying to run this simple socket ssl server in python

import socket, sslcontext = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)bindsocket = socket.socket()bindsocket.bind(("", 443))bindsocket.listen(5)while True:    newsocket, fromaddr = bindsocket.accept()    connstream = context.wrap_socket(newsocket, server_side=True)    try:        data = connstream.recv(1024)        if not data:            break    finally:        connstream.shutdown(socket.SHUT_RDWR)        connstream.close()

but when connecting with client

curl -v https://localhost:443/

I'm getting this error

Traceback (most recent call last):  File "/Users/example/server_ssl.py", line 15, in <module>    connstream = context.wrap_socket(newsocket, server_side=True)                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^  File "/Users/example/.pyenv/versions/3.11.9/lib/python3.11/ssl.py", line 517, in wrap_socket    return self.sslsocket_class._create(           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^  File "/Users/example/.pyenv/versions/3.11.9/lib/python3.11/ssl.py", line 1104, in _create    self.do_handshake()  File "/Users/example/.pyenv/versions/3.11.9/lib/python3.11/ssl.py", line 1382, in do_handshake    self._sslobj.do_handshake()ssl.SSLError: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1006)

curl itself shows this error

*   Trying 127.0.0.1:443...* Connected to localhost (127.0.0.1) port 443* ALPN: curl offers h2,http/1.1* TLSv1.3 (OUT), TLS handshake, Client hello (1):*  CAfile: /etc/ssl/cert.pem*  CApath: none* TLSv1.3 (IN), TLS alert, handshake failure (552):* OpenSSL/3.3.1: error:0A000410:SSL routines::ssl/tls alert handshake failure* closing connection #0curl: (35) OpenSSL/3.3.1: error:0A000410:SSL routines::ssl/tls alert handshake failure

How to make sure both client/server use same ciphers?I've tried setting different options for the context, but still getting the same error.

# none of these workscontext.check_hostname = Falsecontext.verify_mode = ssl.CERT_NONEcontext.set_ciphers("ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20")

At this point I don't want to provide any certificates as suggested here, how can I make this code work?


Viewing all articles
Browse latest Browse all 1543

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>