ssl - 不能在带有自签名证书的 python2 ssl 包装器中使用 SSLv23 以外的任何协议(protocol)

Question

我使用 open ssl 生成了我的自签名证书

openssl req -new -x509 -days 365 -nodes -out cert.pem -keyout cert.pem

我正在使用 python2，这是我的服务器代码:

import socket, ssl 

bindsocket = socket.socket()
bindsocket.bind(('localhost', 10023))
bindsocket.listen(5)

while True:
    newsocket, fromaddr = bindsocket.accept()
    connstream = ssl.wrap_socket(newsocket,
                                 server_side=True,
                                 certfile="cert.pem",
                                 ssl_version=ssl.PROTOCOL_SSLv23)
    try:
        data = connstream.read()
        print data
    finally:
        connstream.write('hi this is server')
        connstream.shutdown(socket.SHUT_RDWR)
        connstream.close()

此代码运行良好，我的客户端可以成功获得“您好，这是服务器”。但是，当我将 ssl_version 从 ssl.PROTOCOL_SSLv23 更改为 ssl.PROTOCOL_TLSv1 或 ssl.PROTOCOL_SSLv3 时，会出现错误:

ssl.SSLError: [Errno 1] _ssl.c:504: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

如果我将 ssl_versiton 更改为 ssl.PROTOCOL_SSLv2:

ssl.SSLError: [Errno 1] _ssl.c:504: error:1406B0CB:SSL routines:GET_CLIENT_MASTER_KEY:peer error no cipher

这是我的客户端代码，我希望这可能有助于生成问题:

import socket, ssl 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ssl_sock = ssl.wrap_socket(s,
                           ca_certs="cert.pem",
                           cert_reqs=ssl.CERT_REQUIRED)
ssl_sock.connect(('localhost', 10023))
ssl_sock.write('hi this is client')
data = ssl_sock.read()
print data
ssl_sock.close()

我不明白这些有什么问题。我如何使用 SSLv23 以外的协议(protocol)？

Answer 1

你有没有想过服务器端需要 key 文件而客户端不需要证书文件？

这里稍微修改了你的代码，希望对你有帮助。

#Server side:
import socket, ssl 

bindsocket = socket.socket()
bindsocket.bind(('localhost', 10023))
bindsocket.listen(5)

while True:
    newsocket, fromaddr = bindsocket.accept()
    connstream = ssl.wrap_socket(newsocket,
                                    keyfile='key.pem',
                                 server_side=True,
                                 certfile="cert.crt",
                                 ssl_version=ssl.PROTOCOL_SSLv23)
    try:
        data = connstream.read()
        print data
    finally:
        connstream.write('hi this is server')
        connstream.shutdown(socket.SHUT_RDWR)
        connstream.close()


#Client side:
import socket, ssl 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ssl_sock = ssl.wrap_socket(s,
                           ca_certs="cert.crt",
                           cert_reqs=ssl.CERT_REQUIRED
                           )
ssl_sock.connect(('localhost', 10023))
ssl_sock.write('hi this is client')
data = ssl_sock.read()
print data`enter code here`
ssl_sock.close()