Ka Iwe-ẹri TLS Peer Nipasẹ HTTP Proxy ninu Python

ssl.get_server_certificate ko ṣe ìdúnàdúrà pẹlu HTTP proxy. Kọ́kọ́ dá ọ̀nà abẹ́lẹ̀ naa, lẹhinna ṣe TLS pẹlu orukọ host ibi-afẹde ki o si gba iwe-ẹri peer.

Fun HTTP proxy ti ko nilo ìjẹ́rìí, nipa lílo host ati port ti oludije lati akojọ HTTP proxy:

from contextlib import closing
import http.client
import ssl

hostname = "example.com"
context = ssl.create_default_context()

with closing(http.client.HTTPConnection(
    "proxy.example.net", 8080, timeout=10
)) as connection:
    connection.set_tunnel(hostname, 443)
    connection.connect()

    with context.wrap_socket(
        connection.sock, server_hostname=hostname
    ) as tls:
        certificate_der = tls.getpeercert(binary_form=True)

certificate_pem = ssl.DER_cert_to_PEM_cert(certificate_der)

HTTPConnection n ṣakoso ìbéèrè CONNECT ati ìdáhùn rẹ. Lẹhinna SSL context yoo ṣe ayẹwo ẹwọn ati idanimọ ibi-afẹde ṣaaju ki iwe-ẹri naa to pada. Ko si HTTP GET si ibi-afẹde ti o nilo fun ìfọwọ́kàn yìí.

Ti agbegbe ba nlo CA aladani ti a fọwọsi, gbé CA yẹn sinu context dipo pipa ìjẹ́rìí. ẹwọn ti a kọ silẹ yoo jẹ ki ìfọwọ́kàn ti a fihan kuna.

getpeercert n da iwe-ẹri ewe peer pada, kii ṣe ẹwọn pipe ti a gbe jade laifọwọyi. Pẹlu idilọwọ TLS ti o gbẹkẹle, iwe-ẹri peer le jẹ iwe-ẹri ti alarinrin ṣe fun orukọ host yii. Pa iyatọ yẹn mọ nigbati o ba fi wé iwe-ẹri ti a ṣe akiyesi nipasẹ ọ̀nà miiran.