Python Context.check_privatekey方法代码示例

# 需要导入模块: from OpenSSL.SSL import Context [as 别名]
# 或者: from OpenSSL.SSL.Context import check_privatekey [as 别名]
    def getServerContext(self):
        """
        Generate a new L{OpenSSL.SSL.Context} object configured to use a
        certificate signed by C{self.ca} and only accept connections from peers
        which are also using a certificate signed by C{self.ca}.
        """
        # Generate a new key for the server and have the CA sign a certificate
        # for it.
        key = KeyPair.generate(size=512)
        req = key.certificateRequest(DN(commonName='localhost'))
        certData = self.ca.signCertificateRequest(req, lambda dn: True, 1)
        cert = PrivateCertificate.load(certData, key)

        # Use the new key/certificate
        context = Context(TLSv1_METHOD)
        context.use_privatekey(key.original)
        context.use_certificate(cert.original)
        context.check_privatekey()

        # Allow peer certificates signed by the CA
        store = context.get_cert_store()
        store.add_cert(self.ca.original)

        # Verify the peer certificate and require that they have one.
        def verify(conn, cert, errno, depth, preverify_ok):
            return preverify_ok
        context.set_verify(VERIFY_PEER | VERIFY_FAIL_IF_NO_PEER_CERT, verify)
        return context

# 需要导入模块: from OpenSSL.SSL import Context [as 别名]
# 或者: from OpenSSL.SSL.Context import check_privatekey [as 别名]
  def getContext(self):
    ctx = Context(TLSv1_METHOD)
    store = ctx.get_cert_store()
    data = open("ssl-keys/ca.crt").read()
    x509 = load_certificate(FILETYPE_PEM, data)
    store.add_cert(x509)

    ctx.use_privatekey_file('ssl-keys/server.key.insecure', FILETYPE_PEM)
    ctx.use_certificate_file('ssl-keys/server.crt', FILETYPE_PEM)

    # throws an error if private and public key not match
    ctx.check_privatekey()

    ctx.set_verify(VERIFY_PEER | VERIFY_FAIL_IF_NO_PEER_CERT, self.verifyHostname)
    ctx.set_options(OP_NO_SSLv3)

    return ctx

# 需要导入模块: from OpenSSL.SSL import Context [as 别名]
# 或者: from OpenSSL.SSL.Context import check_privatekey [as 别名]
 def _client(self, sock):
     """
     Create a new client-side SSL L{Connection} object wrapped around
     C{sock}.
     """
     # Now create the client side Connection.  Similar boilerplate to the
     # above.
     client_ctx = Context(TLSv1_METHOD)
     client_ctx.set_options(OP_NO_SSLv2 | OP_NO_SSLv3 | OP_SINGLE_DH_USE )
     client_ctx.set_verify(VERIFY_PEER|VERIFY_FAIL_IF_NO_PEER_CERT|VERIFY_CLIENT_ONCE, verify_cb)
     client_store = client_ctx.get_cert_store()
     client_ctx.use_privatekey(load_privatekey(FILETYPE_PEM, client_key_pem))
     client_ctx.use_certificate(load_certificate(FILETYPE_PEM, client_cert_pem))
     client_ctx.check_privatekey()
     client_store.add_cert(load_certificate(FILETYPE_PEM, root_cert_pem))
     client_conn = Connection(client_ctx, sock)
     client_conn.set_connect_state()
     return client_conn

# 需要导入模块: from OpenSSL.SSL import Context [as 别名]
# 或者: from OpenSSL.SSL.Context import check_privatekey [as 别名]
 def _server(self, sock):
     """
     Create a new server-side SSL L{Connection} object wrapped around
     C{sock}.
     """
     # Create the server side Connection.  This is mostly setup boilerplate
     # - use TLSv1, use a particular certificate, etc.
     server_ctx = Context(TLSv1_METHOD)
     server_ctx.set_options(OP_NO_SSLv2 | OP_NO_SSLv3 | OP_SINGLE_DH_USE )
     server_ctx.set_verify(VERIFY_PEER|VERIFY_FAIL_IF_NO_PEER_CERT|VERIFY_CLIENT_ONCE, verify_cb)
     server_store = server_ctx.get_cert_store()
     server_ctx.use_privatekey(load_privatekey(FILETYPE_PEM, server_key_pem))
     server_ctx.use_certificate(load_certificate(FILETYPE_PEM, server_cert_pem))
     server_ctx.check_privatekey()
     server_store.add_cert(load_certificate(FILETYPE_PEM, root_cert_pem))
     # Here the Connection is actually created.  If None is passed as the 2nd
     # parameter, it indicates a memory BIO should be created.
     server_conn = Connection(server_ctx, sock)
     server_conn.set_accept_state()
     return server_conn