Here you canfind an example of the use of TLS.The first and last few lines of this file sslclient.py look completely normal: opening a socket to a remote
server, and then sending and receiving data per the protocol that the server supports. The cryptographic
protection is invoked by the few lines of code in the middle—two lines that load a certificate database
and make the TLS connection itself, and then the call to match_hostname() that performs the crucial test
of whether we are really talking to the intended server or perhaps to an impersonator.
import os, socket, ssl, sys
from backports.ssl_match_hostname import match_hostname, CertificateError
try:
script_name, hostname = sys.argv
except ValueError:
print >>sys.stderr, 'usage: sslclient.py <hostname>'
sys.exit(2)
# First we connect, as usual, with a socket.
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((hostname, 443))
# Next, we turn the socket over to the SSL library!
ca_certs_path = os.path.join(os.path.dirname(script_name), 'certfiles.crt')
sslsock = ssl.wrap_socket(sock, ssl_version=ssl.PROTOCOL_SSLv3,
cert_reqs=ssl.CERT_REQUIRED, ca_certs=ca_certs_path)
# Does the certificate that the server proffered *really* match the
# hostname to which we are trying to connect? We need to check.
try:
match_hostname(sslsock.getpeercert(), hostname)
except CertificateError, ce:
print 'Certificate error:', str(ce)
sys.exit(1)
# From here on, our `sslsock` works like a normal socket. We can, for
# example, make an impromptu HTTP call.
sslsock.sendall('GET / HTTP/1.0\r\n\r\n')
result = sslsock.makefile().read() # quick way to read until EOF
sslsock.close()
print 'The document https://%s/ is %d bytes long' % (hostname, len(result))
Note that the certificate database needs to be provided as a file named certfiles.crt in the same
directory as the script.
root@erlerobot:~/Python_files# cat /etc/ssl/certs/* > certfiles.crt
root@erlerobot:~/Python_files# sslclient.py www.openssl.org
The document https://www.openssl.org/ is 15941 bytes long