twisted check client SSL trustRoot value

问题

I'm working on a twisted server where there should be a two way SSL handshake. I'm very new to working with these tools so I'm not sure how to set this option. This is my reactor:

def main(reactor):

   with open('/opt/ssl/cert.pem') as f:
       certdata = f.read()

   with open('/opt/ssl/issuer.pem') as f:
       issuer_certdata = f.read()

   log.info("SSL Certificate Loaded.")

   certificate = ssl.PrivateCertificate.loadPEM(certdata)
   issuer_certificate = ssl.PrivateCertificate.loadPEM(issuer_certdata)

   options = ssl.CertificateOptions(privateKey=certificate.privateKey.original,
                                 certificate=certificate.original,
                                 raiseMinimumTo=ssl.TLSVersion.TLSv1_2,
                                 trustRoot=ssl.trustRootFromCertificates([issuer_certificate]))

   factory = protocol.Factory.forProtocol(MPG)
   reactor.listenSSL(6060, factory, options)

return defer.Deferred()

From reading https://twistedmatrix.com/documents/16.2.0/api/twisted.internet.ssl.CertificateOptions.html, I found I need to be using the trustRoot argument, and pass it an object that holds the CA. Now, in my case, the server and the clients all have the same CA, so I pass that certificate, such that the CA from that certificate is trusted.

Yet, this doesn't work somehow, and our wireshark tests fail with an error message saying with unknown CA during client certificate valdiation. I don't know if that is because I configured the twisted server wrong, or because the CA info simply doesn't match.

Edit: Since Jean-Paul's original comment, I've tried using the intermediary, the CA and both of them combined as the trustRoot argument, using trustRootFromCertificates. All of them result in an unknown CA error.

PS. I'm on a Centos7, and I've updated /etc/pki/ca-trust/source/anchors/ to include the CA certificate. and ran update-ca-trust

PS2. Testing my server with the command below, I found that it can't validate my own chain when I delete trustRoot from my code above. openssl s_client -connect x.x.x.x:6060 -tls1_2 -state -cert cert.pem -key cert.pem

That is, without the trustRoot argument, this is the certificate chain from openssl:

---
Certificate chain
 0 s:C = TR, O = MYCERT
   i:C = TR, CN = MYCERT's issuer
---

While, with the trustRoot argument I'm getting:

---
Certificate chain
 0 s:C = TR, O = MYCE
   i:C = TR, CN = MYCERT's issuer
 1 s:C = TR, CN = MYCERT's issuer
   i:C = TR, L = ROOT CA
---

I don't know why trustRoot causes this change. I'm probably misunderstanding the whole thing, and am very lost. Any help would be appreciated.

来源：https://stackoverflow.com/questions/60776147/twisted-check-client-ssl-trustroot-value

标签

ssl

OpenSSL

twisted