python - 简单的 HTTPS python 服务器检测是否通过 ca-cert 连接的天气？

Question

首先我创建了一个 ca-cert key 对

openssl req -new -x509 -keyout private_key.pem -out public_cert.pem -days 365 -nodes
Generating a RSA private key
..+++++
.................................+++++
writing new private key to 'private_key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:.
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:.
Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
Organizational Unit Name (eg, section) []:.
Common Name (e.g. server FQDN or YOUR name) []:35.222.65.55 <----------------------- this ip should be server ip very important
Email Address []:

现在我用 python 代码运行一个服务器

# libraries needed: 
from http.server import HTTPServer, SimpleHTTPRequestHandler
import ssl , socket

# address set
server_ip = '0.0.0.0'
server_port = 3389

# configuring HTTP -> HTTPS
httpd = HTTPServer((server_ip, server_port), SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket(httpd.socket, certfile='./public_cert.pem',keyfile='./private_key.pem', server_side=True)
httpd.serve_forever()

现在，当使用 SSL 时，此服务器可以同时连接到安全 ca-cert 和 ingore-ca-cert 服务器连接

也就是说curl --cacert public_cert.pem --cert-type PEM https://35.222.65.55:3389和curl -k https://35.222.65.55:3389会工作

如何从服务器端检测请求是否为 ingnore-ca-cert？

Answer 1

how to not allow insecure connection from server side ?

服务器端无法控制在客户端完成的证书验证。服务器不知道客户端是否验证了证书。交换的数据中没有任何内容表明客户端是在执行 curl -k 还是在没有此选项的情况下执行 curl。因此，无法阻止验证损坏或禁用的客户端连接到服务器。