python - Python 中的证书存储库

Question

我在 python 中使用请求，我想使用 SSL。

>>> requests.get('https://github.com', verify=True)
<Response [200]>

文档说:

You can pass verify the path to a CA_BUNDLE file with certificates of trusted CAs. This list of trusted CAs can also be specified through the REQUESTS_CA_BUNDLE environment variable.

有人知道如何配置此环境变量或信任证书吗？

谢谢!!

Answer 1

查看 python 请求代码:

            # Look for requests environment configuration and be compatible
            # with cURL.
            if verify is True or verify is None:
                verify = (os.environ.get('REQUESTS_CA_BUNDLE') or
                          os.environ.get('CURL_CA_BUNDLE'))

因此您必须设置其中一个环境变量才能进行 SSL 调用。

设置环境变量 REQUESTS_CA_BUNDLE:

$ export REQUESTS_CA_BUNDLE=/etc/ssl/certs/foo.crt

或者将其设置到一个目录

$ export REQUESTS_CA_BUNDLE=/etc/ssl/certs

http://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification

Note:
If verify is set to a path to a directory, the directory must have been
processed using the c_rehash utility supplied with OpenSSL.

所以你必须重新散列目录中的那些证书:

$ cd /etc/ssl/certs
$ for i in *.crt; do ln -s $i $(openssl x509 -hash -noout -in $i).0; done

或

$ c_rehash /etc/ssl/certs