python中的ssl证书身份验证

Question

I have been given the following code that should perform an ssl handshake and certificate authentication:

1   s = socket.socket()
2   print "connecting..."
3   logging.debug("Connecting")
4   # Connect with SSL mutual authentication
5   # We only trust our server's CA, and it only trusts user certificates signed by it
6   c = ssl.wrap_socket(s, cert_reqs=ssl.CERT_REQUIRED,
7                       ssl_version=ssl.PROTOCOL_SSLv3, ca_certs='ca.crt',
8                       certfile='user.crt', keyfile='user.key')
9   c.connect((constants.server_addr, constants.port))

I have 2 questions about this:

1. where do we specify the server/port to which we are connecting? are these arguments to socket.socket() ?
2. I have a .p12 from which I extracted a cert and a key in pem format(see this question ), and I assume that these correspond to user.crt and user.key (line 8), respectively. However, while I assume that ca.crt (line 7) is retrived from the certificate authority, how to I retrieve it?

If any part of the above code or my assumptions about it are incorrect, please let me know. Thanks!

Answer 1

1. Server address and port are specified as part of the socket address in line 9, specified as the parameter to connect .

2. Generally, you've acquired the CA certificate via some out-of-band method, then saved it locally. Linux systems generally have a bundle of certificates for well-known, trusted CAs available under /etc/ssl/certs or similar.