0

I am trying to request a page from a server with self signed certificates but I do not want to query via the public domain so I am just trying to fetch the data like this in python3. The certificate has been issues against the domain xyz.test.com that is why I am adding that in headers.

requests.get('https://10.164.0.3:32735/productpage', verify='/cert/path/ca.crt', headers={'Host': 'xyz.test.com'})

But I am facing below error

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 699, in urlopen
    httplib_response = self._make_request(
  File "/usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 382, in _make_request
    self._validate_conn(conn)
  File "/usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 1010, in _validate_conn
    conn.connect()
  File "/usr/local/lib/python3.8/site-packages/urllib3/connection.py", line 411, in connect
    self.sock = ssl_wrap_socket(
  File "/usr/local/lib/python3.8/site-packages/urllib3/util/ssl_.py", line 453, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls)
  File "/usr/local/lib/python3.8/site-packages/urllib3/util/ssl_.py", line 495, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock)
  File "/usr/local/lib/python3.8/ssl.py", line 500, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/local/lib/python3.8/ssl.py", line 1040, in _create
    self.do_handshake()
  File "/usr/local/lib/python3.8/ssl.py", line 1309, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:1131)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/requests/adapters.py", line 439, in send
    resp = conn.urlopen(
  File "/usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 755, in urlopen
    retries = retries.increment(
  File "/usr/local/lib/python3.8/site-packages/urllib3/util/retry.py", line 574, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='10.164.0.3', port=32735): Max retries exceeded with url: /productpage (Caused by SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1131)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.8/site-packages/requests/api.py", line 76, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/requests/api.py", line 61, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/requests/sessions.py", line 542, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python3.8/site-packages/requests/sessions.py", line 655, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='10.164.0.3', port=32735): Max retries exceeded with url: /productpage (Caused by SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1131)')))

my python docker file supports TLS1.3,1.2,1.1 I have checked that using urlopen('https://www.howsmyssl.com/a/check', context=ssl._create_unverified_context()).read()

I have also added below packages to my docker file:

RUN pip3 install ndg-httpsclient
RUN pip3 install pyopenssl
RUN pip3 install pyasn1

Also, curl request for the same works fine from the same pod.

curl "https://xyz.test.com/productpage" --connect-to "xyz.test.com:443:10.164.0.3:32735" --cacert /etc/bookinfo/bookinfo-ca.crt
Yogeshwar Singh
  • 1,245
  • 1
  • 10
  • 22
  • Are you sure you signed your server certificate using the same private key as `/cert/path/ca.crt`? Note that `verify=` should point to the CA certificate; not the leaf certificate. Not clear what you mean by "self signed certificate" from your question. – Selcuk Jul 06 '21 at 03:26
  • @Selcuk yes, the curl works using the same certificates. I doubt, I might be doing something wrong in preparing the request or it maybe some SSL version mismatch which I don't understand. – Yogeshwar Singh Jul 06 '21 at 03:30
  • Does it work when you set `verify` to `False`? – Selcuk Jul 06 '21 at 03:33
  • 1
    No, it does not work even if I set `verify=False` – Yogeshwar Singh Jul 06 '21 at 04:01
  • In short: you need to have a custom DNS resolution like you do with curl. Otherwise the domain in SNI will be the wrong one and the server might pick the wrong certificate and also give you the wrong site. – Steffen Ullrich Jul 06 '21 at 04:50

0 Answers0