test/with_dummyserver/test_https.py: adding intermediate CA client certificate tests
MODIFY
dummyserver/handlers.py
dummyserver/handlers.py
@@ -106,6 +106,12 @@ class TestingApp(RequestHandler):
"Render simple message"
return Response("Dummy server!")
+ def certificate(self, request):
+ """Return the requester's certificate."""
+ cert = request.get_ssl_certificate()
+ serial = cert['serialNumber'].strip() if cert is not None else None
+ return Response(str(serial))
+
def source_address(self, request):
"""Return the requester's IP address."""
return Response(request.remote_ip)

MODIFY
dummyserver/server.py
dummyserver/server.py
@@ -16,6 +16,11 @@ import socket
import warnings
from datetime import datetime
+try:
+ from ssl import CERT_OPTIONAL
+except:
+ CERT_OPTIONAL = None
+
from urllib3.exceptions import HTTPWarning
from tornado.platform.auto import set_close_exec
@@ -30,6 +35,16 @@ CERTS_PATH = os.path.join(os.path.dirname(__file__), 'certs')
DEFAULT_CERTS = {
'certfile': os.path.join(CERTS_PATH, 'server.crt'),
'keyfile': os.path.join(CERTS_PATH, 'server.key'),
+ 'cert_reqs': CERT_OPTIONAL,
+ 'ca_certs': os.path.join(CERTS_PATH, 'cacert.pem'),
+}
+DEFAULT_CLIENT_CERTS = {
+ 'certfile': os.path.join(CERTS_PATH, 'client_intermediate.pem'),
+ 'keyfile': os.path.join(CERTS_PATH, 'client_intermediate.key'),
+}
+DEFAULT_CLIENT_NO_INTERMEDIATE_CERTS = {
+ 'certfile': os.path.join(CERTS_PATH, 'client_no_intermediate.pem'),
+ 'keyfile': os.path.join(CERTS_PATH, 'client_intermediate.key'),
}
NO_SAN_CERTS = {
'certfile': os.path.join(CERTS_PATH, 'server.no_san.crt'),

MODIFY
test/with_dummyserver/test_https.py
test/with_dummyserver/test_https.py
@@ -12,6 +12,8 @@ from dummyserver.testcase import (
HTTPSDummyServerTestCase, IPV6HTTPSDummyServerTestCase
)
from dummyserver.server import (DEFAULT_CA, DEFAULT_CA_BAD, DEFAULT_CERTS,
+ DEFAULT_CLIENT_CERTS,
+ DEFAULT_CLIENT_NO_INTERMEDIATE_CERTS,
NO_SAN_CERTS, NO_SAN_CA, DEFAULT_CA_DIR,
IPV6_ADDR_CERTS, IPV6_ADDR_CA, HAS_IPV6,
IP_SAN_CERTS)
@@ -67,6 +69,29 @@ class TestHTTPS(HTTPSDummyServerTestCase):
r = self._pool.request('GET', '/')
self.assertEqual(r.status, 200, r.data)
+ def test_client_intermediate(self):
+ client_cert, client_key = DEFAULT_CLIENT_CERTS['certfile'], \
+ DEFAULT_CLIENT_CERTS['keyfile']
+ serial = b'16180339887498948482045868343656381177203091798' + \
+ b'05762862135448622705260\\'
+ https_pool = HTTPSConnectionPool(self.host, self.port,
+ key_file=client_key,
+ cert_file=client_cert)
+ r = https_pool.request('GET', '/certificate')
+ self.assertEqual(r.data, serial, r.data)
+
+ def test_client_no_intermediate(self):
+ client_cert, client_key = \
+ DEFAULT_CLIENT_NO_INTERMEDIATE_CERTS['certfile'], \
+ DEFAULT_CLIENT_NO_INTERMEDIATE_CERTS['keyfile']
+ https_pool = HTTPSConnectionPool(self.host, self.port,
+ cert_file=client_cert,
+ key_file=client_key)
+ try:
+ https_pool.request('GET', '/certificate')
+ except SSLError as e:
+ self.assertTrue('alert unknown ca' in str(e))
+
def test_verified(self):
https_pool = HTTPSConnectionPool(self.host, self.port,
cert_reqs='CERT_REQUIRED',

test/with_dummyserver/test_https.py: adding intermediate CA client certificate tests