Mutual TLS with self signed certificates, with requests in python

Question

I created both client and server certificates:

# client
openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out ssl/client.crt -keyout ssl/client.key
# server
openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out ssl/server.crt -keyout ssl/server 

Then with python I have the following:

import requests

response = requests.get(
    "https://localhost:8080/",
    verify="ssl/server.crt",
    cert=("ssl/client.crt", "ssl/client.key")
)

I also have a gunicorn server running with the server self signed certificate.

The code snippet is throwing me the following error:

requests.exceptions.SSLError: HTTPSConnectionPool(host='localhost', port=8080): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:2633)')))

It is a self signed certificate so I am not sure what CA is it expecting.

Answer 1

tlsv1 alert unknown ca

The server is sending a TLS alert back since it cannot validate your client certificate - the certificate authority (ca) which signed the certificate is unknown to the server. You either need to disable client certificate validation in your server or (better) make the server trust your client certificate.

It is a self signed certificate so I am not sure what CA is it expecting.

A self-signed certificate is signed by itself, ie the CA is the certificate itself.

Answer 2

It looks like the server isn't able to validate your client certificate. If you're just using a pair of self-signed certificates for the client and server, then the server needs to also use the client's certificate as its CA, since it will attempt to validate it was signed by the CA - which in this case is the client.

I recently wrote a blog on deploying mTLS with self-signed certificates which might help you as it contains more details, specifically with how to configure the client and server. Check it out here: https://otterize.com/blog/so-you-want-to-deploy-mtls