python-3.x - ssl.SSLError : [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl. c:777)

Question

我目前正在使用 websocket-client 处理 python 到 QlikSense 服务器的连接。对于身份验证，我使用了 Qlik sense 服务器生成的证书。

即使我遵循了此 link 中提到的相同代码逻辑，但仍然出现错误。

from websocket import create_connection

def conn(senseHost, userDirectory, userId, privateKeyPath):

    # self.url = "wss://" + senseHost + ":4747/app/" # invalid
    url = "wss://" + senseHost + ":4747/app"  # valid
    ca = open(privateKeyPath + "root.pem").read()
    cer = open(privateKeyPath + "client.pem").read()
    key = open(privateKeyPath + "client_key.pem").read()
    certs = ({"ca": ca,
              "cert": cer,
              "key": key})
    # import pdb
    # pdb.set_trace()
    # ERROR raised here.
    ws = create_connection(url, sslopt=certs,
                                header={'X-Qlik-User: UserDirectory=%s; UserId=%s' % (userDirectory, userId)})
    session = self.ws.recv()
    return session

# below code has specific perameters.
c = conn("blablah.com","XYZ","ME","path/to/cert/")

我使用 pdb 跟踪了一个错误，

-> ws = create_connection(url,sslopt=certs,header={'X-Qlik-User: UserDirectory=%s; UserId=%s' % (userDirectory, userId)})
(Pdb) n
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)

Answer 1

经过 4 个小时的努力，我找到了解决方案。

def conn(senseHost, userDirectory, userId, privateKeyPath):
    url = "wss://" + senseHost + ":4747/app"  # valid
    certs = ({"ca_certs": privateKeyPath + "root.pem",
              "certfile": privateKeyPath + "client.pem",
              "keyfile": privateKeyPath + "client_key.pem",
              "cert_reqs":ssl.CERT_REQUIRED,
              "server_side": False
              })
    ssl.match_hostname = lambda cert, hostname: True
    ws = create_connection(url, sslopt=certs,
                                header={'X-Qlik-User: UserDirectory=%s; UserId=%s'% (userDirectory, userId)})