Friday, June 17, 2011

Python Webserver Checking SSL Certificates

Python Urllib and Urllib2 have warnings that say:
"Warning: When opening HTTPS URLs, it is not attempted to validate the server certificate. Use at your own risk!"



Add SSL-cert-check thing: `pip install backports.ssl_match_hostname` ... because Django/Python's urllib's urlopen does not check the SSL server certificates [warning on urllib documentation](http://docs.python.org/library/urllib.html), thus becoming vulnerable to Man-In-The-Middle attacks. [Solution source](http://stackoverflow.com/questions/1087227/validate-ssl-certificates-with-python/3946778#3946778)
http://wiki.python.org/moin/Twisted-Examples
--> Twisted, PyOpenSSL, Pycrypto
`svn co svn://svn.twistedmatrix.com/svn/Twisted/trunk`
`cd trunk`
`python setup.py install`

`pip install pyopenssl`

`python setup.py install`

Check in python shell: `import twisted, OpenSSL, Crypto`

2 comments: