I am a client to a secured HTTPS server who has issued to me a password protected .pfx certificate to identify me to its system every-time. Using browser where I have installed the certificate (apparently only IE6 and previous versions works) i am able to log in and upload a file which i need to do on a daily basis. Right now am trying to write a Python script to do the same task and I am not sure if it is doable this way.
I am trying to use python mechanize library to connect to the server.
Using OpenSSL I have broken down the .pfx file into .key and .cer PEM files.
And I am using them as certificate for my python script.
Here is my code snippet
br = mechanize.Browser()
br.add_client_certificate(host,"I:/Key.key","I:/certificate.crt:")
whatever I tried it throws various SSL exception .. namely
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_PrivateKey_file
Can anyone please tell me what possibly I could be doing wrong or if at all this is not the right approach.
I was able to get rid of errors by ways described in this link.
It didn't solve my purpose though because the server I was trying to connect is a IIS based server and it only accepts .pfx certificates.
Related
I am using requests library to complete communication with https websites. This works great, my only problem is that wireshark no longer captures plain text information in the "Decrypted SSL Data" tab as it does after following this instructional :
https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/
Setup enviromental variable that allows chrome and firefox to store ssl keys in file, wireshark uses this file in real time.
Is their a way I can modify a simple https request script such as this :
import requests
resp = requests.get("https://www.google.com", allow_redirects=True)
to also store the ssl key into file as chrome and firefox do?
From what I understand about OpenSSL implementations that would do similar, you'd have to find the master secret and session key in memory - is this doable when running from cmd or practical?
This appears to be possible now with Requests.
I have set SSLKEYLOGFILE=secrets.log and then ran a request via requests.get() and secrets.log is now populated with TLS secrets. I am using requests v2.25.1 and urllib3 v1.26.3.
Apparently, it took a while for OpenSSL to provide APIs necessary to extract keying information, and then time for bindings to be created in pyOpenSSL to utilize those APIs and then for that to bubble up to urllib3.
See this issue for more details: https://github.com/psf/requests/issues/3674
openssl s_client -connect www.google.com:443 -showcerts
you will see all certs that google site uses.
I'm having problem developing a "provider" in APNS. My server is trying to send messages using apns-client, it seems there are no problems occuring while sending messages, but the device isn't receiving any messages at all.
Recently I've changed the *.pem file to a new one. Messages were properly received while using the previous *.pem file, so I'm sure that there are no problems at server connections and sending script (written in Python). The reason is, probably, because the old *.pem file is valid but the new *.pem file is not.
I strongly desire to have an "error" response from the APNS server if the *.pem file is invalid, but it seems that the APNS server or apns-client library isn't returning any error signals even if *.pem file is invalid. I've proved this fact by adding one hundred 'a's to the line before before -----END RSA PRIVATE KEY----- in *.pem, and running the same python script. Yes, it still didn't receive any error messages.
Since APNS server is returning no error messages, it's nearly impossible to check if the *.pem file is valid... Aren't there any methods to check if the *.pem file is valid?
Here's some troubleshooting info suggested by Apple:
Problems Connecting to the Push Service
One possibility is that your server is unable to connect to the push
service. This can mean that you don't have the certificate chain
needed for TLS/SSL to validate the connection to the service. In
addition to the SSL identity (certificate and associated private key)
created by Member Center, you should also install the Entrust CA
(2048) root certificate on your provider. This allows TLS/SSL to
verify the full APNs server cert chain. If you need to get this root
certificate, you can download it from Entrust's site. Also verify that
these identities are installed in the correct location for your
provider and that your provider has permission to read them.
You can test the TLS/SSL handshake using the OpenSSL s_client command,
like this:
$ openssl s_client -connect gateway.sandbox.push.apple.com:2195 -cert
YourSSLCertAndPrivateKey.pem -debug -showcerts -CAfile
server-ca-cert.pem
where server-ca-cert.pem is the Entrust CA (2048) root certificate.
Be sure the SSL identity and the hostname are the correct ones for the
push environment you're testing. You can configure your App ID in
Member Center separately for the sandbox and production environment,
and you will be issued a separate identity for each environment.
Using the sandbox SSL identity to try to connect to the production
environment will return an error like this:
CRITICAL | 14:48:40.304061 | Exception creating ssl connection to
Apple: [Errno 1] _ssl.c:480: error:14094414:SSL
routines:SSL3_READ_BYTES:sslv3 alert certificate revoked
To test you PRODUCTION cert, open Terminal and do this:
openssl s_client -connect gateway.push.apple.com:2195 -cert PushProdCer.pem -key PushProdKey.pem
I am not familiar with the python-client you are using but surely there is a way to simply attempt opening a connection with Apple's PNS servers and detecting whether that connection failed or not. If the connection fails, then something is wrong with the PEM file - either the format or the certificate values themselves.
If you want to get an error message that's a little more explicative than "pass or fail," I recommend you look into 3rd party shell scripts that can return some basic information about the PEM file. This thread contains a few sample scripts.
Of course, you can also check for some basic format validations that are widely available. I provided one such example here but there are others.
Hi I am new to SSL and I am trying to connect to an IIS ASP.NET web server which has issued to me a unique .pfx certificate to verify me to the server.
Using a browser where I have installed the certificate I am able to connect the site where I have to upload a file on a daily basis.
I am trying to write a python script to do the same task. I have tried to use the Python Mechanize library.
While adding certificate I converted the .pfx file to .key and .cer PEM file so that it could be attached to add_client_certificate method, but later, I found out that IIS server accepts only .pfx certificate and there is no way to attach a .pfx certificate directly to the Mechanize browser instance.
Is there a way or another library where I can do this task?
You can use requests library
import requests
requests.get("https://your_server", cert=('client01.cer', 'client01.key'))
I'm trying to access a server via SOAP with Python and I'm running into errors that tell me that I need to use the correct certificate - but I'm sure that I'm doing that.
I have some instructions that I'm following for going through this exercise - I need to connect over a WSDL link using HTTPS and invoke one Method on the server. I converted the key that I received, using OpenSLL, to key.pm and cert.pem; I also tried SUDS and some other workarounds. With everything I try, though, the service tells me that I need to use the correct certificate.
I know that the certificates are actually correct because I installed a SOAP client for Firefox and when I connect to the server using thesame certificates and the same arguments, I get valid data instead of the error message. Because of this, I think there's something wrong with how SUDS communicates about certificates. I tried the workarounds from a "SUDS over HTTPS with cert" question, but those aren't working for me.
Is there a way around this, or is there another Python SOAP client that works with certificates correctly (even if I have to manually create the XML for the request)?
I need to visit a site (https://*) that requires me to install two certificates in Firefox before I can visit it successfully. One I can export as a .p12 file (Client Certificate), and one is a .crt file (CA Certificate). If I try accessing this site without these certificates, I get a "failed handshake error".
How do I visit this site in Python? I was thinking of using mechanize. Thanks.
I'd suggest you use webdriver to automate Firefox. It has a Python interface too.