Akhri shahaadada TLS peer iyada oo loo marayo HTTP proxy Python

ssl.get_server_certificate lama wada hadlo HTTP proxy. Marka hore dhis tunnel-ka, ka dib samee TLS magaca host-ka loo socdo oo hel shahaadada peer.

HTTP proxy aan xaqiijin u baahnayn, adoo isticmaalaya host iyo port-ka musharrax ka mid ah liiska HTTP proxy:

from contextlib import closing
import http.client
import ssl

hostname = "example.com"
context = ssl.create_default_context()

with closing(http.client.HTTPConnection(
    "proxy.example.net", 8080, timeout=10
)) as connection:
    connection.set_tunnel(hostname, 443)
    connection.connect()

    with context.wrap_socket(
        connection.sock, server_hostname=hostname
    ) as tls:
        certificate_der = tls.getpeercert(binary_form=True)

certificate_pem = ssl.DER_cert_to_PEM_cert(certificate_der)

HTTPConnection waxay maamushaa codsiga CONNECT iyo jawaabtiisa. Ka dib SSL context waxay xaqiijisaa silsiladda iyo aqoonsiga loo socdo ka hor inta shahaadada la soo celin. HTTP GET loo socdo looma baahna gacan-qabsigaas.

Haddii deegaanku isticmaalo CA gaar ah oo la ansixiyay, ku shub CA-daas context-ka halkii aad damin lahayd xaqiijinta. Silsilad la diiday waxay fashilkaa gacan-qabsiga la muujiyay.

getpeercert waxay soo celisaa shahaadada caleenta peer, ma aha silsilad buuxda oo si otomaatig ah loo dhoofiyay. Marka TLS la dhexgalo si la aamini karo, shahaadada peer waxay noqon kartaa shahaadada dhexdhexaadiyaha u sameeyay magaca host-kan. Ilaali farqigaas marka aad la barbardhigo shahaado laga arkay waddo kale.