5

Per default, Python's httplib.HTTPSConnection is using the system's trust store to validate a HTTPS certificate. (How) is it possible to set a different CA list to do the validation, replacing the default one?

I tried to set the SSLContext used by httplib (see below), but this only adds the certs from the given file; it does not stop the validator from loading more certs from the system's store if needed.

c = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
c.load_verify_locations(cafile='mozillacerts.pem', capath=None)

conn = httplib.HTTPSConnection(domain, port, context=c)

To be clear: I want the validation to fail if it is not possible to validate the trust path with the certs in the given file.

(I am using Python 2.7.11 on Debian 8 for this.)

0

2 Answers 2

1

As it seems this is not really possible, we 'solved' the problem by using Python-requests, since it allows us to set the CA bundle.

requests.get('https://' + domain, verify='mozillacerts.pem')

See also: Requests documentation: SSL Cert Verification

-1

Stefan, I do see two problems with your attempt: You should use ssl.PROTOCOL_SSLv23 and not the TLSv1 which is already outdated. Do not be confused by the name of the variable, read the linked documentation to understand that's the right value to use.

You don't need to override the default certificate store, instead just generate proper SSL certificates that are recognised by default.

You can get free SSL certificates from https://letsencrypt.org -- I can assure you that they are recognised by default by all browsers, Python and JAVA applications too.

No need to play with the certificate stores, which is something risky and that depends on each platforms. Not to add that it has a high change of breaking even on minor updates.

1
  • Hi sorin, thanks for your answer! First, thanks for the remark about the protocol constant, I was indeed misled by its name here. Second, I am aware of Let's Encrypt, but I need to simulate the behaviour of a specific browser and therefore need to control which CAs are used. It has nothing to do with getting a site I admin to validate or so.
    – Stefan
    May 31, 2016 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.