HTTPS certificate verification using corporate Certification Authority in Python

Question

I need to make a HTTPS call to a server with a certificate signed by our corporate authority. How do I configure python to trust this certificate authority?

possible duplicate of [HTTPS connection Python](http://stackoverflow.com/questions/2146383/https-connection-python) — Anurag Uniyal, May 03 '12 at 22:45
possible duplicate of [Validate SSL certificates with Python](http://stackoverflow.com/questions/1087227/validate-ssl-certificates-with-python) — systempuntoout, May 03 '12 at 22:45
This isn't how to make https/ssl but how to add a trusted authority — Brig, May 07 '12 at 02:19

score 0 · Answer 1 · edited May 23 '17 at 11:53

By default (assuming you're using httplib.HTTPSConnection), you don't have to do anything, this httplib doesn't do any certificate verification (the same applies to urllib).

Of course, this is not a good this and you should verify the server certificate. There are various solutions to this (see this question).

In short, you may have to extend httplib.HTTPConnection to turn the socket into an SSL socket via ssl.wrap_socket manually, so as to be able to insert the verification callbacks (you'll need to verify both the host name and the certificates).

Alternatively, if you're not constrained to httplib, using PycURL would certainly make this cleaner. You can configure CA_INFO (or CA_PATH) to point to your internal CA certificate. In addition, it usually doesn't come with a pre-defined list of CAs, but you can get one from here (converted from the Mozilla list) and add these certificates to the list of CAs you trust if you need it.

score 0 · Answer 2 · answered Oct 25 '12 at 16:13

If you're looking for sample code to solve this, here it is in PycURL:

import pycurl
curl = pycurl.Curl()
curl.setopt(pycurl.URL, "https://your-secure-website.com/")
curl.setopt(pycurl.SSL_VERIFYPEER, 1)
curl.setopt(pycurl.SSL_VERIFYHOST, 2)
curl.setopt(pycurl.CAINFO, "/path/to/your-corporate-certificate-chain.crt")
curl.perform()

Make sure to place the your-corporate-certificate-chain.crt file in an accessible location and use the pycurl.CAINFO option to point to it.

HTTPS certificate verification using corporate Certification Authority in Python

2 Answers2