Auto enter member phrase in case of Python ssl Client / Server

Question

I need to create a Client / Server application to send files from clients to the server. I use simple ssl sockets for this and make sure with certificates.

 ms = socket.socket(socket.AF_INET, socket.SOCK_STREAM) ssl_sock = ssl.wrap_socket(ms, keyfile=".../newCA/my_client.key", certfile=".../newCA/my_client.crt", server_side=0, cert_reqs=ssl.CERT_REQUIRED, ca_certs=".../newCA/CA/my-ca.crt" ) ssl_sock.connect((HOST, MPORT)) 

And server side:

 msock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) self.ssl_sock = ssl.wrap_socket(msock, keyfile=".../newCA/my_server.key", certfile=".../newCA/my_server.crt", server_side=1, cert_reqs=ssl.CERT_REQUIRED, ca_certs=".../newCA/CA/my-ca.crt" ) self.ssl_sock.bind(('', self.PORT)) self.ssl_sock.listen(self.QUEUE_MAX) 

The problem is this: when the client tries to connect to the server, for this it is necessary to enter the password for the private key for both: for the server and client sides.

• In Java, we need to set the System Property: javax.net.ssl.keyStorePassword = "", and it should be used automatically, but how is it used in Python? I cannot enter the password all the time when the client connects.

---

The problem is that my application: the client must use the already signed certificate, and the server must use the already signed certificate. I can’t change it. Both Serever and clients are long-lived applications, so we just launch them and we don’t need to look for them. But, as I understand it, Python does not provide statndard a way to automatically enter a password for a private key. Could there be other suggestions?

Answer 1

The missing phrase must be entered by the person as a means of identification. If you want to hard code it, an SSL key without a passphrase provides the same level of security. To get rid of the phrase, see also: http://aleph-null.tv/article/20080714-1337-917.xml/Apache,-SSL,-and-"%3BGetting-Rid-of-the-Passphrase"%3B

Answer 2

You can also refer to the SSLSocket passphrase / password in Python . It is permissible to remove the passphrase of the private key file for a server-side case. OpenSSL provides utilities for this. For instance:

openssl pkey -in yourkey-with-pass.pem -out yourkey-without-pass.pem

Answer 3

Here is the solution I found, drawing inspiration from this article:
Create a Python request session using a password-protected phrase on the client side Cert

 import ssl import requests from requests.adapters import HTTPAdapter class SSLAdapter(HTTPAdapter): def init_poolmanager(self, *args, **kwargs): context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH) context.load_cert_chain(certfile='my_certificate.crt', password='my_passphrase') kwargs['ssl_context'] = context return super().init_poolmanager(*args, **kwargs) session = requests.session() session.mount('https://my_protected_site.com', SSLAdapter())