Mailing List Archive: Python: Dev

HTTPS repositories failing when using selfsigned certs

Index | Next | Previous | View Threaded

jcea at jcea

Jul 31, 2012, 8:58 PM

Post #1 of 3 (196 views)
Permalink

HTTPS repositories failing when using selfsigned certs

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

My mercurial clone is <https://hg.jcea.es/cpython-2011/>, and today I
can't create a patch from it (in the bug tracker). No explanation in
the web interface, but checking the sourcecode of the resulting page,
I see a SSL certificate failure.

So, looks like bugs.python.org is now verifying repository certificates.

My certificate is selfsigned and, moreover, it is behind a SNI server,
so the certificate python.org is getting is a selfsigned "jcea.es"
certificate.

What can I do, beside buying a "real" cert?.

Do we have a certificate whitelist, like mercurial?. In my .hgrc, I use

"""
[hostfingerprints]
# En realidad es www.jcea.es. hg.jcea.es esta tras SNI
hg.jcea.es = 54:7e:a7:36:56:c6:80:41:f8:fd:d6:c0:95:44:68:a9:93:58:ca:4c
"""

PS: If I try to use the http version of my repository
(<http://hg.jcea.es/cpython-2011>), I get an error: "('invalid token',
97)".

- --
Jesus Cea Avion _/_/ _/_/_/ _/_/_/
jcea [at] jcea - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/
jabber / xmpp:jcea [at] jabber _/_/ _/_/ _/_/_/_/_/
. _/_/ _/_/ _/_/ _/_/ _/_/
"Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/
"My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/
"El amor es poner tu felicidad en la felicidad de otro" - Leibniz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQCVAwUBUBipTplgi5GaxT1NAQKyjQP9F1rIKSlDIs8uHLrhIVmaOodRH3umYeyl
zhkiGm34+Cw6I22OQre3VoJ+9vrUF/Go/LpU+UpAH5adzgq4Xfef3Q8jRhclSZmU
ADvGpKhmlzDCahxsQoYXD7UHkc/BLkfNvx+q0wzfDUELbinLyITF4pp2/dLtoNtN
LFG9te1M55A=
=pgh1
-----END PGP SIGNATURE-----
_______________________________________________
Python-Dev mailing list
Python-Dev [at] python
http://mail.python.org/mailman/listinfo/python-dev
Unsubscribe: http://mail.python.org/mailman/options/python-dev/list-python-dev%40lists.gossamer-threads.com

solipsis at pitrou

Aug 1, 2012, 5:12 AM

Post #2 of 3 (187 views)
Permalink

Re: HTTPS repositories failing when using selfsigned certs [In reply to]

On Wed, 01 Aug 2012 05:58:06 +0200
Jesus Cea <jcea [at] jcea> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> My mercurial clone is <https://hg.jcea.es/cpython-2011/>, and today I
> can't create a patch from it (in the bug tracker). No explanation in
> the web interface, but checking the sourcecode of the resulting page,
> I see a SSL certificate failure.
>
> So, looks like bugs.python.org is now verifying repository certificates.
>
> My certificate is selfsigned and, moreover, it is behind a SNI server,
> so the certificate python.org is getting is a selfsigned "jcea.es"
> certificate.
>
> What can I do, beside buying a "real" cert?.

Why don't you just use a HTTP URL?

Regards

Antoine.

--
Software development and contracting: http://pro.pitrou.net

_______________________________________________
Python-Dev mailing list
Python-Dev [at] python
http://mail.python.org/mailman/listinfo/python-dev
Unsubscribe: http://mail.python.org/mailman/options/python-dev/list-python-dev%40lists.gossamer-threads.com

solipsis at pitrou

Aug 1, 2012, 5:19 AM

Post #3 of 3 (185 views)
Permalink

Re: HTTPS repositories failing when using selfsigned certs [In reply to]

On Wed, 1 Aug 2012 14:12:54 +0200
Antoine Pitrou <solipsis [at] pitrou> wrote:

> On Wed, 01 Aug 2012 05:58:06 +0200
> Jesus Cea <jcea [at] jcea> wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > My mercurial clone is <https://hg.jcea.es/cpython-2011/>, and today I
> > can't create a patch from it (in the bug tracker). No explanation in
> > the web interface, but checking the sourcecode of the resulting page,
> > I see a SSL certificate failure.
> >
> > So, looks like bugs.python.org is now verifying repository certificates.
> >
> > My certificate is selfsigned and, moreover, it is behind a SNI server,
> > so the certificate python.org is getting is a selfsigned "jcea.es"
> > certificate.
> >
> > What can I do, beside buying a "real" cert?.
>
> Why don't you just use a HTTP URL?

Whoops, I hadn't seen the P.S. in your e-mail:

> PS: If I try to use the http version of my repository
> (<http://hg.jcea.es/cpython-2011>), I get an error: "('invalid token',
> 97)".

In this case the issue with the http version should perhaps be figured
out first.

Regards

Antoine.

--
Software development and contracting: http://pro.pitrou.net

_______________________________________________
Python-Dev mailing list
Python-Dev [at] python
http://mail.python.org/mailman/listinfo/python-dev
Unsubscribe: http://mail.python.org/mailman/options/python-dev/list-python-dev%40lists.gossamer-threads.com

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads