title: Mutual SSL Authentication - Client and Server sides. Python -> Django/Twisted/Tornado
body: <p>I'm building a python app where a client side will request xml pages from a server (also running python).</p>
  
  <p>I would like to do something on the line of puppet configuration management system. Puppet works as follow:</p>
  
  <blockquote>
    <p>1) If the client runs for the 1st time, it generates a Certificate Signing Request and a private key. The former is an x509 certificate that is self-signed.<br/>
    2) The client connects to the master (at this time the client is not authenticated) and sends its CSR, it will also receives the CA certificate and the CRL in return. <br/>
    3) The master stores locally the CSR <br/>
    4) The administrator checks the CSR and can eventually sign it (this process can be automated with autosigning). I strongly suggest verifying certificate fingerprint at this stage.<br/>
    5) The client is then waiting for his signed certificate, which the master ultimately sends. <br/>
    6) All next communications will use this client certificate. Both the master and client will authenticate each others by virtue of sharing the same CA.<br/>
    (from <a href="http://www.masterzen.fr/2010/11/14/puppet-ssl-explained/" rel="nofollow">http://www.masterzen.fr/2010/11/14/puppet-ssl-explained/</a>)</p>
  </blockquote>
  
  <p>The main things that I don't know how to do are:<br/>
  - Which are the best libs to use?<br/>
  - What to use on the server side? Will Django behind apache/nginx be able to sign the certificate on the first run and do the auth using the certificates thereafter or I need to use something like twisted on the front end?<br/>
  - The best way to send the CSR would be a POST to the server?<br/>
  - Do any one knows if there is some code examples available that would cover both client and server sides?<br/>
  - Is there any other way to establish a trusted connection between client/server without human iteration (what is the best practice for authentication between webservices)?</p>