aiohttp and PyOpenSSL

[sfc-gh-yqiu]

Hi there, I'm migrating a codebase from urllib3 to aiohttp. However, we use a custom OCSP verification process that is entirely dependent on PyOpenSSL (it works with Context and Connection from OpenSSL.SSL), which aiohttp doesn't support. I'm trying to figure out how to hack PyOpenSSL Context so I can pass it into aiohttp requests.

I've been looking everywhere, and the only relevant thread I was able to find was from 2015. I'm wondering if anyone has had to do something similar before.

Any advice is appreciated. 🙏

[Dreamsorcerer]

I doubt the situation has changed much, so that's probably the most relevant information you'll get.

Although, the Context looks similar to SSLContext, so if it's compatible maybe you'll be able to pass it in as the ssl parameter. But, I assume you'll still need to figure out something to replace the connector parameter with.

[sfc-gh-yqiu]

Thanks! I'll look more into that.

In that thread, they add a wrap_socket method - presumably to get the OpenSSL Context to work like a regular SSLContext. However, I haven't been able to find a code path in aiohttp that calls SSLContext. Is this due to a change or am I missing something?

[Dreamsorcerer]

Not sure what you mean by calling it. I see references all over the code, it appears to get passed around a lot.
I have just realised that the ssl parameter is on the request() method though, so not stored on the ClientSession itself, which might make it a little more annoying to use, as you'd need to pass it through to every request() call.

[sfc-gh-yqiu]

Apologies, I meant I wasn't able to find anything that calls SSLContext.wrap_socket.

[Dreamsorcerer]

No idea. I would expect that it's probably called by asyncio, not us (though you can always checkout a commit from 2015 and grep the code to check if it used to be there...).

[sfc-gh-yqiu]

Will try it out, thank you.