Python SSL Socket Client Authentification
Question: I'm trying to set up a server and client in python where the server
authenticates clients using SSL with certificates. There are a lot of examples
of SSL certificates online, but everything I've found has the server providing
a certificate to the client and the client checking it. I need the server to
ensure that the client has the authority to connect to the server. I
understand how to generate and send certificates and the basics of how they
work. I would type out my code, but my client/server without SSL is working
fine and I've been referencing
[this](http://docs.python.org/2/library/ssl.html) for SSL. The client/server
example at the bottom of that page summarizes my understanding of SSL certs in
python.

I realize this isn't much to go on, but if someone could explain the basic
modifications to that example to have the server authenticate the client
instead of the other way around, that would be awesome. Alternatively, a link
to an example or even just some socket methods to investigate would be very
helpful. Let me know if more information is needed. I don't mean to be vague
and promise I've spent all morning looking for info myself :).

Edit: I'm trying to stick to the basic ssl library. Aka "import ssl".


Answer: You would use
[SSLSocket.getpeercert](http://docs.python.org/2/library/ssl.html#ssl.SSLSocket.getpeercert)
to get the certificate. The client would need to specify a key and certificate
when wrapping the socket just like the server side. On the server side, you
will also need to pass ca_certs="path_to_ca_cert_file" and probably also want
to specify cert_reqs=CERT_REQUIRED (see. args for
[ssl.wrap_socket](http://docs.python.org/2/library/ssl.html#ssl.wrap_socket).

In addition to this, it sounds like you might be looking to do certificate
based client authentication/authorization? This is a simple matter of using
getpeercert to get the client certificate and accessing fields within the
certificate to use in a normal authentication path (i.e. Common Name == User
Id)

