无法在CherryPy 3.8.0上使用SSL

Question

I am trying to use SSL on CherryPy 3.8.0. My basic example implements a ping response on SSL.

I set the configuration for SSL in this way:

# start Web Service with some configuration
global_conf = {
       "global":    { "server.environment": "production",
                      "engine.autoreload.on": True,
                      "engine.autoreload.frequency": 5,
                      "server.socket_host": "0.0.0.0",
                      "server.socket_port": 443,
                      "cherrypy.server.ssl_module": "builtin",
                      "cherrypy.server.ssl_certificate": "cert.pem",
                      "cherrypy.server.ssl_private_key": "privkey.pem",
                      "environment": "production",
                      "log.error_file": "site.log"}
}
cherrypy.config.update(global_conf)
conf = {
    "/": {
        "request.dispatch": cherrypy.dispatch.MethodDispatcher(),
        "tools.encode.debug": True,
    }
}

However, when I invoke the Web Service I get errors. Httpie, cURL and openssl logs follow.

Httpie log:

> http GET https://<host>:443/ping
http: error: SSLError: [SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)

cURL log:

> curl -v https://<host>:443/ping
* Connected to <host> (<host>) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* Closing connection 0
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

OpenSSL log:

> openssl s_client -host <host> -port 443
CONNECTED(00000003)
140197694400160:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:795:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 295 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

Answer 1

Simple example:

import cherrypy

class RootServer:
    @cherrypy.expose
    def index(self, **keywords):
        return "it works!"

if __name__ == '__main__':
    server_config={
        'server.socket_host': '0.0.0.0',
        'server.socket_port':443,
        'server.ssl_module':'builtin',
        'server.ssl_certificate':'cert.pem',
        'server.ssl_private_key':'privkey.pem'
    }

    cherrypy.config.update(server_config)
    cherrypy.quickstart(RootServer())

works.

Possible issues:

Invalid config

remove cherrypy. prefix from config:

"server.ssl_module": "builtin",
"server.ssl_certificate": "cert.pem",
"server.ssl_private_key": "privkey.pem",

I have exactly the same exception, when I have cherrypy-prefixed configuration. When I fix it, everything works fine.

Python doesn't have SSL support

Try to install pyOpenSSL and replace server.ssl_module to pyopenssl .

Invalid cert

Are You sure Your cert is proper?

Look at http://docs.cherrypy.org/en/latest/deploy.html#ssl-support

Answer 2

As far as I know there were some issues with SSL in different versions of CherryPy. One of issues: Adding support for client certificate verification in SSLAdapter (patch included)