Karanta takardar shaidar abokin TLS ta hanyar wakilin HTTP a Python

ssl.get_server_certificate ba ya yin shawarwari da wakilin HTTP. Da farko ka kafa tunnel ɗin, sannan ka yi TLS da sunan mai masaukin manufa kuma ka sami takardar shaidar abokin.

Don wakilin HTTP mara tabbaci, ta amfani da mai masauki da tashar ɗan takara daga jerin wakilan HTTP:

from contextlib import closing
import http.client
import ssl

hostname = "example.com"
context = ssl.create_default_context()

with closing(http.client.HTTPConnection(
    "proxy.example.net", 8080, timeout=10
)) as connection:
    connection.set_tunnel(hostname, 443)
    connection.connect()

    with context.wrap_socket(
        connection.sock, server_hostname=hostname
    ) as tls:
        certificate_der = tls.getpeercert(binary_form=True)

certificate_pem = ssl.DER_cert_to_PEM_cert(certificate_der)

HTTPConnection yana kula da buƙatar CONNECT da amsarta. Sannan mahallin SSL yana tabbatar da sarƙa da asalin manufa kafin a mayar da takardar shaidar. Ba a buƙatar HTTP GET zuwa manufa don wannan musayar hannu.

Idan yanayin yana amfani da CA mai zaman kansa da aka amince da ita, loda wannan CA a cikin mahallin maimakon kashe tabbaci. Sarƙar da aka ƙi tana sa musayar hannun da aka nuna ta kasa.

getpeercert yana mayar da takardar shaidar ganye ta abokin, ba cikakkiyar sarƙa da aka fitar da ita kai tsaye ba. Tare da amintaccen kutse na TLS, takardar shaidar abokin na iya zama takardar da mai shiga tsakani ya ƙirƙira don wannan sunan mai masauki. Ka kiyaye wannan bambanci yayin kwatanta ta da takardar shaidar da aka gani ta wata hanya.