pythonsslhandshakesslhandshakeexceptiontls1.3

How to view handshake/certificate information for attempted but failed connection, Python ssl


I am attempting to connect a client and server with sslContext.wrap_socket with the Python ssl library. I am getting some strange SSL errors including WRONG_VERSION_NUMBER and UNKNOWN_CA even though both the version number and CA are specifically hardcoded in the server and client.

To double check that these hardcoded values are getting through, I want to print out the certificate fields and the TLS version number the client is attempting to connect with. I can do this with SSLSocket.getpeercert() and SSLSocket.version(), but this only works after the handshake (in sslContext.wrap_socket) is complete. The handshakes resulting in errors never complete, and so I cannot use those methods.

Is there a way I can get certificate/TLS transaction information from a failed handshake?


Edit: The error is irrelevant to the question. I know how to fix the error, what I want is to see the handshake information.


Solution

  • This seems to be impossible without modifying CPython. SSLSocket.getpeercert() in ssl.py seems to call _ssl__SSLSocket_getpeercert_impl() in _ssl.c which returns an error if SSL initialization is not complete:

    static PyObject *
    _ssl__SSLSocket_getpeercert_impl(PySSLSocket *self, int binary_mode)
    /*[clinic end generated code: output=1f0ab66dfb693c88 input=e35af55fa5f9bab8]*/
    {
        int verification;
        X509 *peer_cert;
        PyObject *result;
    
        if (!SSL_is_init_finished(self->ssl)) {
            PyErr_SetString(PyExc_ValueError,
                            "handshake not done yet");
            return NULL;
        }
    
    ...etc
    

    Also, after reading it's documentation, I believe this also cannot be done with the pyOpenSSL library.