我使用Python(2.7)SSL模块编写一些服务器代码,如下所示:
ssock = ssl.wrap_socket(sock, ca_certs="all-ca.crt", keyfile="server.key", certfile="server.crt", server_side=True, ssl_version=ssl.PROTOCOL_TLSv1)
全部-约阴极射线管'包含签名CA证书和根CA证书:-----BEGIN CERTIFICATE-----
... (signing CA)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (root CA)...
-----END CERTIFICATE-----
Python SSL模块的文档说明:In general, if you are using SSL3 or TLS1, you don’t need to put the
full chain in your “CA certs” file; you only need the root
certificates, and the remote peer is supposed to furnish the other
certificates necessary to chain from its certificate to a root
certificate.
这是我用C编写SSL服务器的经验,但在这里似乎不起作用。如果我编写的客户机在其wrap\u socket()调用中仅使用根证书:
csock = ssl.wrap_socket(sock, ca_certs="root-ca.crt", cert_reqs=ssl.CERT_REQUIRED, ssl_version=ssl.PROTOCOL_TLSv1)
然后引发异常:ssl.SSLError: [Errno 1] _ssl.c:499: error:14094418:SSL
routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
如果我能通过-约阴极射线管对于client ca\u certs参数,则一切都按预期工作,但这在客户端不方便,而且不应该是必需的。在
有什么方法可以告诉服务器端它需要在协商时向客户机提供中间CA证书吗?在