Read a TLS Peer Certificate Through an HTTP Proxy in Python

Use Python’s HTTPConnection tunnel support before wrapping the socket with a validating SSL context.

ssl.get_server_certificate does not negotiate an HTTP proxy. Establish the tunnel first, then perform TLS with the destination hostname and obtain the peer certificate.

For an unauthenticated HTTP proxy, using the host and port of a candidate from the HTTP proxy list:

from contextlib import closing
import http.client
import ssl

hostname = "example.com"
context = ssl.create_default_context()

with closing(http.client.HTTPConnection(
    "proxy.example.net", 8080, timeout=10
)) as connection:
    connection.set_tunnel(hostname, 443)
    connection.connect()

    with context.wrap_socket(
        connection.sock, server_hostname=hostname
    ) as tls:
        certificate_der = tls.getpeercert(binary_form=True)

certificate_pem = ssl.DER_cert_to_PEM_cert(certificate_der)

HTTPConnection handles the CONNECT request and its response. The SSL context then verifies the chain and destination identity before the certificate is returned. No HTTP GET to the destination is required for this handshake.

If the environment uses an approved private CA, load that CA into the context instead of disabling verification. A rejected chain makes the shown handshake fail.

getpeercert returns the peer’s leaf certificate, not an automatically exported complete chain. With trusted TLS interception, the peer certificate can be the intermediary’s generated certificate for this hostname. Preserve that distinction when comparing it with a certificate observed through another route.

Аффингæй хæстæг статьялтæ