0

I have a website that is hosted behind company's network. You could only connect to it using the client.crt and client.key. This client.crt is signed by a self signed ca.crt which is referenced in the apache config file.

I installed the server certificate (servercrt.crt) on my machine and can make a curl request with no issues:

curl https://my_url.com:53234 --cert path/to/client.crt --key path/to/client.key

I also imported the client.crt in the browser. When navigate to the url the browser asks to select the client certificate. Once selected the right client certificate, it opens up the page without issues.

However, I have problems with python. When I try to connect using python:

import requests
clientcertfile = './client.crt'
clientcertkeyfile = './client.key'
servercert = './servercert.pem'
requests.get(url='https://my_url.com:53234, cert= (clientcertfile, clientcertkeyfile), verify = servercert)

I get the following error:

SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)')

But, I can connect to this url when set the verify=False which I don't want. The requests package just displays a warning that its better not to set the verify=False option.

I have looked at here, here and here but no joy.

Any ideas?

Shery
  • 1,808
  • 5
  • 27
  • 51
  • 1
    The problem is not the client certificate but the verification of the server certificate. With curl you *added* the server certificate to the existing ones, with the browser too. With python you instead rely exclusively on the server certificate, so this could be one problem. The other might be that the server certificate has not basic constraints CA:true, which is needed though when used as a trust anchor in Python/OpenSSL. Check with `openssl x509 -in servercert.pem -text`. – Steffen Ullrich Jun 30 '21 at 12:49

1 Answers1

0

Apparently, I was using the wrong ca.crt for the server. Once I replaced it with the right certificate. It fixed the issue.

@Steffen's comment helped solved the issue.

Shery
  • 1,808
  • 5
  • 27
  • 51