0

I am creating a certificate using crypto module and signing it with Intermediate certificate(locally generated CA and Intermediate) . I am wrapping the ssl socket with that cert to build a SSL channel. But it is throwing one error:

Traceback (most recent call last):
  File "spoofTrial.py", line 72, in <module>
    ssl_conn = ssl.wrap_socket(newsocket, server_side=True, certfile=certPATH, keyfile=keyPATH, ssl_version=ssl.PROTOCOL_TLSv1)
  File "/usr/local/lib/python3.5/ssl.py", line 1064, in wrap_socket
    ciphers=ciphers)
  File "/usr/local/lib/python3.5/ssl.py", line 686, in __init__
    self._context.load_cert_chain(certfile, keyfile)
ssl.SSLError: [SSL] PEM lib (_ssl.c:2803)

Find below the client and server code I am trying:

This is the client side script.

from OpenSSL import SSL, crypto
from socket import socket
from pprint import pprint
import random

ca_file='/home/osboxes/certProject/ca-chaincert.pem'
cacert='/root/ca/intermediate/certs/intermediatecert.pem'
cakey='/root/ca/intermediate/private/intermediatekey.pem'
ca_path= None;
def callback(conn, cert, errno, depth, result):
    #*******
    return True

context = SSL.Context(SSL.TLSv1_METHOD) # Use TLS Method
context.set_options(SSL.OP_NO_SSLv2) # Don't accept SSLv2
context.set_verify(SSL.VERIFY_PEER, callback)
context.load_verify_locations(ca_file, ca_path)

sock = socket()
ssl_sock = SSL.Connection(context, sock)
ssl_sock.connect(('#ServerIpAddress', 5000))
ssl_sock.do_handshake()
ssl_sock.send("Hello Server")
print(ssl_sock.recv(10))
cert = ssl_sock.get_peer_certificate()

Also server side script is below:

import ssl
from OpenSSL import crypto
from socket import socket, gethostname
import random

# To Sign a certificate, I have created my own Root CA and Intermediate certificate using Openssl commands.
cacert='/root/ca/intermediate/certs/intermediatecert.pem'
cakey='/root/ca/intermediate/private/intermediatekey.pem'

def newcert(CN,CountryName,State,Locality,Org,Unit):
    global keyPATH
    keyPATH="/root/ca/intermediate/private/"+gethostname()+"_onflykey.PEM"
    global certPATH
    certPATH="/root/ca/intermediate/certs/"+gethostname()+"_onflycert.PEM"
    serial = random.randrange(1, 65545);
    ca_cert = crypto.load_certificate(crypto.FILETYPE_PEM, open(cacert).read())
    ca_key = crypto.load_privatekey(crypto.FILETYPE_PEM, open(cakey).read())
    key = crypto.PKey()
    key.generate_key( crypto.TYPE_RSA, 2048)
    cert=crypto.X509()
    cert.get_subject().CN=gethostname()
    cert.get_subject().C=CountryName
    cert.get_subject().ST=State
    cert.get_subject().L=Locality
    cert.get_subject().O=Org
    cert.get_subject().OU=Unit
    cert.gmtime_adj_notBefore(0)
    cert.gmtime_adj_notAfter(365*24*60*60)
    cert.set_serial_number(serial)
    cert.set_pubkey(key)
    cert.set_issuer(ca_cert.get_subject())
    cert.add_extensions([crypto.X509Extension(b"basicConstraints", True,b"CA:FALSE"), crypto.X509Extension(b"nsCertType", True,b"server")])
    cert.sign(ca_key, "sha256")
    new_key=open(keyPATH,"wb")
    new_key.write(crypto.dump_privatekey(crypto.FILETYPE_PEM, key))
    new_cert=open(certPATH,"wb")
    new_cert.write(crypto.dump_certificate(crypto.FILETYPE_PEM, cert))


serverPort = 5000
if __name__ == '__main__':
 server_socket = socket()
 server_socket.bind(('', serverPort))
 server_socket.listen(5)
 newsocket, fromaddr = server_socket.accept()
 newcert("serverxyz.project.com","VA","Fairfax","XYZ","ABZ Ltd","ABZ Ltd Server")

 ssl_conn = ssl.wrap_socket(newsocket, server_side=True, certfile=certPATH, keyfile=keyPATH, ssl_version=ssl.PROTOCOL_TLSv1)

 print(ssl_conn.read())
 ssl_conn.write('200 OK \r\n\r\n'.encode())
 ssl_conn.close()
 server_socket.close()

Please help me with the same...

  • Chances are high that the given key and cert file either don't exist, have the wrong format, the key does not match the cert or the key needs a password. – Steffen Ullrich Apr 11 '16 at 18:17
  • The key is present in the required location. Also, after creation, I verified it using the openssl command. Also, when it is asking for a passphrase, I am providing that as well... :( Can you tell me on which case, key will not match cert.? – Anamika Kesharwani Apr 11 '16 at 20:44
  • "Can you tell me on which case, key will not match cert." - if you combine the key from one cert with another cert. See https://kb.wisc.edu/middleware/page.php?id=4064 how you can check that the key matches the cert. See also http://stackoverflow.com/questions/30109449/what-does-sslerror-ssl-pem-lib-ssl-c2532-mean-using-the-python-ssl-libr which might be the exact answer to your problem. – Steffen Ullrich Apr 11 '16 at 21:25
  • Thank you for the link. I tried verify the cert and key using the commands. As per the commands provided, key do match with cert. The `modulus' and the `public exponent' portions in the key and the Certificate are matching. I am getting same result for certificate key pair created using openssl commands and for the one's I am creating using Python pyopenssl. – Anamika Kesharwani Apr 12 '16 at 21:45
  • Then I don't know either what the problem might be just based on the few information you provide. I suggest that you provide [a minimal, comlete and working example](http://stackoverflow.com/help/mcve) of what you do so that others can reproduce the problem and help you solve it. – Steffen Ullrich Apr 13 '16 at 04:34
  • I have edited the question with the server and client code. Please let me know your thoughts.. – Anamika Kesharwani Apr 17 '16 at 22:42
  • Your example works fine for me, that is I cannot reproduce the problem. – Steffen Ullrich Apr 18 '16 at 05:20
  • Did you create the Root CA and Intermediate CA at your end using Openssl commands. If it is working with you, that means there is some issue with the intermediate certificates I am using to sign the certificate... Do you think that can be a issue... – Anamika Kesharwani Apr 18 '16 at 16:44
  • If you would publish the certificate and key you use (or create a new one for testing which shows the same behavior) then one could maybe find out more about the problem. – Steffen Ullrich Apr 18 '16 at 16:46
  • I am using Python 3.4. Can you tell me which Python Version did you use to run the snippet I provided. – Anamika Kesharwani Apr 27 '16 at 03:43
  • I did use Python 3.4.3. But according to your trace you are using Python 3.5 and not Python 3.4. – Steffen Ullrich Apr 27 '16 at 04:29
  • Yes. I have used Python 3.5. My mistake I wrote that. Sorry. Still I am getting the Same error. I tried debugging it every other way. – Anamika Kesharwani Apr 27 '16 at 15:00

0 Answers0