Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sock.get_client_ca_list() returns empty result with TLS1.3 #1010

Open
feenes opened this issue Apr 2, 2021 · 0 comments
Open

sock.get_client_ca_list() returns empty result with TLS1.3 #1010

feenes opened this issue Apr 2, 2021 · 0 comments

Comments

@feenes
Copy link

feenes commented Apr 2, 2021

I try to get the list of client CAs, that a server allows.

with openssl I can call:
openssl s_client -connect hostname:443 -servername hostname and I can see the CAs after the lines

---
Acceptable client certificate CA names

for most servers I succeed with following code, that I borrowed from stackoverflow

import socket
from OpenSSL import SSL

def get_client_cert_cas(hostname, port):
    ctx = SSL.Context(SSL.SSLv23_METHOD)
    # uncommenting next line will make things work
    # ctx.set_options(SSL.OP_NO_TLSv1_3)
    sock = SSL.Connection(ctx, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
    # next line for SNI
    sock.set_tlsext_host_name(hostname.encode("utf-8"))
    sock.connect((hostname, port))
    sock.do_handshake()  # without this command next line always returns empty list
    return sock.get_client_ca_list())

For some servers I always get an empty answer. Though the openssl command returns the correct information.
As soon as I disable TLSv1_3 I am able to receive the client_ca_list.

Is this to be expected or is this a bug?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant