python sockets ssl ssl-certificate self-signed

Python SSL socket: Accept self-signed certificates

I am traying to build a simple client-server application using pythons ssl socket module. When running the example code provided here the client side fails, returning that the certificate verification failed because of a self-signed certificate. I provide the self-signed root CA certificate with context.load_verify_locations("/home/vincent/work/CA/2/AllIO_Dev_CA_2.crt"). On the server side the certificate file also contains the servers certificate as well as the CAs self signed certificate as specified here in the correct order (1st server certificate, 2nd CA certificate). In an approach to fix the error outside of python I also added my self-signed root CA certificate to the os list of trusted CA certificates.

What do I have to do to allow for connections with a self-signed certificate? As this is just for a proof of concept buying a trusted certificate is not an option at this point of time.

server.py

import socket, ssl

def deal_with_client(connstream):
    data = connstream.recv(1024)
    # empty data means the client is finished with us
    while data:
        if not do_something(connstream, data):
            # we'll assume do_something returns False
            # when we're finished with client
            break
        data = connstream.recv(1024)
    # finished with client

context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
context.load_cert_chain(certfile="/home/vincent/work/CA/2/Dev_Server_2_Chain.crt",
                        keyfile="/home/vincent/work/CA/2/Dev_Server_2.pem")

bindsocket = socket.socket()
bindsocket.bind(('vm-kubuntu-23', 10023))
bindsocket.listen(5)
while True:
    newsocket, fromaddr = bindsocket.accept()
    connstream = context.wrap_socket(newsocket, server_side=True)
    try:
        deal_with_client(connstream)
    finally:
        connstream.shutdown(socket.SHUT_RDWR)
        connstream.close()

client.py

import socket, ssl
import yaml

context = ssl.create_default_context()
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context.load_verify_locations("/home/vincent/work/CA/2/Dev_CA_2.crt")
print(context.get_ca_certs())
conn = context.wrap_socket(socket.socket(socket.AF_INET),
                           server_hostname="vm-kubuntu-23")
conn.connect(("vm-kubuntu-23", 10023))
cert = conn.getpeercert()
pprint.pprint(cert)
conn.sendall("Test Message 101r\n")

python3 client.py 
[{'subject': ((('commonName', 'vm-kubuntu-23'),),), 'issuer': ((('commonName', 'vm-kubuntu-23'),),), 'version': 3, 'serialNumber': '3C337F71CFD1EA6D', 'notBefore': 'Nov  3 18:27:00 2023 GMT', 'notAfter': 'Nov  3 18:27:00 2033 GMT'}]
Traceback (most recent call last):
  File "/home/vincent/work/switchFrontpanel/application/networkDemo/client2.py", line 12, in <module>
    conn.connect(("vm-kubuntu-23", 10023))
  File "/usr/lib/python3.11/ssl.py", line 1379, in connect
    self._real_connect(addr, False)
  File "/usr/lib/python3.11/ssl.py", line 1370, in _real_connect
    self.do_handshake()
  File "/usr/lib/python3.11/ssl.py", line 1346, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1002)

Dev_CA_2.crt

Dev_Server_2_Chain.crt

Remark: As these certificates are purely for testing purposes and are going to be disposed afterwards I don't mind sharing them.

Solution

Dev_Server_2_Chain.crt ...

Both the server certificate and the CA certificate have the same subject of "vm-kubuntu-23". This will confuse the certificate validation process, leading to the error you see. Instead CA and server should have different subjects.