嘗試使用充當 HTTPS 服務器的 python 腳本接收 HTTPS 請求時出錯 - sslv3 警報證書未知

Question

我試圖通過使用充當具有開放端口的服務器的 Python 腳本從站點接收到我的 linux 機器的 HTTPS 請求。

我們正在使用有效的證書和私鑰。

當我運行 python 腳本時，它等待一個請求，然后當我從站點觸發請求時，它給出以下錯誤。

這是錯誤：

Serving HTTPS on 192.168.192.73 port 8445 ...




----------------------------------------
Exception happened during processing of request from ('209.206.57.47', 57282)
Traceback (most recent call last):
  File "/usr/lib64/python2.7/SocketServer.py", line 295, in _handle_request_noblock
    self.process_request(request, client_address)
  File "/usr/lib64/python2.7/SocketServer.py", line 321, in process_request
    self.finish_request(request, client_address)
  File "/usr/lib64/python2.7/SocketServer.py", line 334, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib64/python2.7/SocketServer.py", line 649, in __init__
    self.handle()
  File "/usr/lib64/python2.7/BaseHTTPServer.py", line 340, in handle
    self.handle_one_request()
  File "/usr/lib64/python2.7/BaseHTTPServer.py", line 310, in handle_one_request
    self.raw_requestline = self.rfile.readline(65537)
  File "/usr/lib64/python2.7/socket.py", line 476, in readline
    data = self._sock.recv(self._rbufsize)
Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert certificate unknown'), ('SSL routines', 'ssl23_read', 'ssl handshake failure')]
----------------------------------------
Traceback (most recent call last):
  File "test_miraki_nb.py", line 57, in <module>
    test()
  File "test_miraki_nb.py", line 52, in test
    httpd.serve_forever()
  File "/usr/lib64/python2.7/SocketServer.py", line 238, in serve_forever
    self._handle_request_noblock()
  File "/usr/lib64/python2.7/SocketServer.py", line 298, in _handle_request_noblock
    self.shutdown_request(request)
  File "test_miraki_nb.py", line 25, in shutdown_request
    request.shutdown()
OpenSSL.SSL.Error: [('SSL routines', 'SSL_shutdown', 'shutdown while in init')]

這是腳本：

import socket, sys, os
import logging
import cgi
from SocketServer import BaseServer
from BaseHTTPServer import HTTPServer
from SimpleHTTPServer import SimpleHTTPRequestHandler
from OpenSSL import SSL


class SecureHTTPServer(HTTPServer):
    def __init__(self, server_address, HandlerClass):
        BaseServer.__init__(self, server_address, HandlerClass)
        ctx = SSL.Context(SSL.SSLv23_METHOD)
        #server.pem's location (containing the server private key and
        #the server certificate).
        ctx.use_privatekey_file ("sample.key")
        ctx.use_certificate_file("sample.cer")
        self.socket = SSL.Connection(ctx, socket.socket(self.address_family,
                                                        self.socket_type))
        self.server_bind()
        self.server_activate()

    # python 2.6 vs python 2.7 bug.
    def shutdown_request(self,request):
        request.shutdown()

class SecureHTTPRequestHandler(SimpleHTTPRequestHandler):
    def setup(self):
        self.connection = self.request
        self.rfile = socket._fileobject(self.request, "rb", self.rbufsize)
        self.wfile = socket._fileobject(self.request, "wb", self.wbufsize)

    def do_POST(self):
        self.do_GET()
        form = cgi.FieldStorage(
            fp=self.rfile,
            headers=self.headers,
            environ={'REQUEST_METHOD':'POST',
                     'CONTENT_TYPE':self.headers['Content-Type'],
                     })
        for item in form.list:
            logging.info(item)



def test(HandlerClass = SecureHTTPRequestHandler,
         ServerClass = SecureHTTPServer, port=8445):
    server_address = ('sample.net', port) # (address, port)
    httpd = ServerClass(server_address, HandlerClass)
    sa = httpd.socket.getsockname()
    print "Serving HTTPS on", sa[0], "port", sa[1], "..."
    httpd.serve_forever()


if __name__ == '__main__':
    logging.basicConfig(level=logging.DEBUG)
    test()

Answer 1

Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert certificate unknown'), ('SSL routines', 'ssl23_read', 'ssl handshake failure')]

這意味着客戶端不喜歡您的證書。

我們正在使用有效的證書和私鑰。

從客戶端的角度來看，證書是不可接受的。 它可能是客戶端未明確信任的自簽名證書。 它可能是由公共 CA 頒發的證書，其中中間證書不是由服務器發送的。 它可能是由客戶端不信任的 CA 頒發的證書。 僅從此錯誤和您的代碼中無法提取更多信息。