PEM Certificate & TLS Verification against REST api

Question

I have been provided with a pem certificate to authenticate with a third party. Authenticating using certificates is a new concept for me.

Inside are two certificates and a private key.

The issuer has advised they do not support SSL verification but use TLS(1.1/1.2).

I have run a script as below:

import requests as req
import json

url = 'https://url.com/call'
certificate_file = "C:/certs/cert.pem"

headers = {"Content-Type": "application/json"}
 
req_body ={
    "network":{
                "network_id": 12345
    },
    "branch":{
                "branch_id": 12345,
    },
  "export_period":{
        "start_date_time": "16-11-2021 00:00:00",
        "end_date_time": "17-11-2021 00:00:00"
    }
}
 
jsonObject = json.dumps(req_body)
response = req.post(url,headers=headers,params=jsonObject,verify=certificate_file)

I'm getting the following error:

SSLError: HTTPSConnectionPool(host='url.com, port=443): Max retries exceeded with url: /call?%7B%22network%22:%20%7B%22network_id%22:%2012345%7D,%20%22branch%22:%20%7B%22branch_id%22:%2012345%7D,%20%22export_period%22:%20%7B%22start_date_time%22:%20%2216-11-2021%2000:00:00%22,%20%22end_date_time%22:%20%2217-11-2021%2000:00:00%22%7D%7D (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)')))

Would appreciate guidance, my gut says I should be doing something specific for TLS hence the SSL error.

I don't think you need to do anything with TLS, this is usually picked up as the connection will be made. Instead it seems to be somewhere in either the certificate (not being correct or self-signed and not verified) or you are missing an intermediate certificate in the chain. Alternatively your list of CA (Certificate Authorities) might be incomplete. I have never used this in python but apparently there are ways to update this (see: https://stackoverflow.com/questions/51925384/unable-to-get-local-issuer-certificate-when-using-requests-in-python) — JustLudo, Nov 23 '21 at 15:48
Also, not using SSL verification would be pretty risky. If indeed that is the "solution" then you'd be done by just stating "verify=False" in your post. — JustLudo, Nov 23 '21 at 15:49
Please could you show the subject and issuer hash of both of your certificates: `openssl x509 -in -noout -subject_hash` and similarly with `-issuer_hash`. This will help to show how they are related. — alani, Nov 29 '21 at 09:57

Gary Archer · Accepted Answer · 2021-11-25T14:00:19.670

The issuer is using an up to date version of HTTPS - SSL is the commonly used term but TLS is the more correct one. Sounds like their setup is correct - meaning you need to call it with a trusted client certificate, as part of an HTTPS request.

I would recommend doing it with the curl tool first so that you can verify that the API works as expected.

curl -s -X GET "https://api.example.com/test" \
--cert ./certs/example.client.pem \
--key ./certs/example.client.key \
--cacert ./certs/ca.pem \
-H "Content-Type: application/json"

Split the certs into separate files as above. Sounds like one of them is a root certificate authority that you need to tell the client tech stack to trust - for curl this is done using the cacert parameter as above.

Once this is working you can follow the same approach in the Python requests library. I believe this uses cert and verify parameters like this. So it looks like your code is not far off.

result = requests.get(
    'https://api.example.com',
    cert=('example.pem', 'example.key'),
    verify='ca.pem')

MORE ABOUT MUTUAL TLS

Out of interest, if you ever want to demystify Mutual TLS and understand more, have a look at these advanced Curity resources:

These include an OpenSSL Script you can run, to see what the separated certificate files should look like.

Thanks very much for this - will give a go & report back. – TJB Nov 27 '21 at 21:58 — TJB, Nov 27 '21 at 21:58

score 0 · Answer 2 · answered Nov 24 '21 at 09:25

The issuer has advised they do not support SSL verification

To me this sounds pretty risky, but if that is indeed the case a simple

verify=False

should do the trick. Note: this disables the verification of the SSL certs for this call entirely.

Furthermore, in case you still want the SSL certs in there (copy-pasted from my comment):

I don't think you need to do anything with TLS, this is usually picked up as the connection will be made. Instead it seems to be somewhere in either the certificate (not being correct or self-signed and not verified) or you are missing an intermediate certificate in the chain. Alternatively your list of CA (Certificate Authorities) might be incomplete. I have never used this in python but apparently there are ways to update this using certifi . Documentation on this can be found in this relevant SO question.

Not sure veryify-false will cut it? I still need to auth with a certificate. — TJB, Nov 27 '21 at 21:58

score 0 · Answer 3 · answered Nov 30 '21 at 03:58

0

I found a similar question with answers. It looks like it is possible that the the system security library is failing to find the certificate in the chain because "only the certificates chains that are stored in cacert.pem are considered valid."

answered Nov 30 '21 at 03:58

Reese Krome

173
6

PEM Certificate & TLS Verification against REST api

3 Answers3