Python ssl服务器报告TLSV1_ALERT_UNKNOWN_CA

Question

我有一个Python SSL服务器,一旦Firefox连接就使用自签名证书转储错误.我像这样启动我的服务器:

httpd = BaseHTTPServer.HTTPServer(('', 443), MyHTTPHandler)
httpd.socket = ssl.wrap_socket (httpd.socket, certfile='server.pem', server_side=True, cert_reqs=0)
httpd.serve_forever()

使用Firefox连接时出错:

----------------------------------------
Exception happened during processing of request from ('127.0.0.1', 51194)
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 295, in _handle_request_noblock
    self.process_request(request, client_address)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 321, in process_request
    self.finish_request(request, client_address)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 334, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 655, in __init__
    self.handle()
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/BaseHTTPServer.py", line 340, in handle
    self.handle_one_request()
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/BaseHTTPServer.py", line 310, in handle_one_request
    self.raw_requestline = self.rfile.readline(65537)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/socket.py", line 480, in readline
    data = self._sock.recv(self._rbufsize)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/ssl.py", line 734, in recv
    return self.read(buflen)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/ssl.py", line 621, in read
    v = self._sslobj.read(len or 1024)
SSLError: [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:1751)
----------------------------------------

我不会在Chrome或其他客户端上看到此行为.它只发生在第一个连接(关于证书的投诉),直到我接受证书.该异常实际上不会导致程序退出.

为什么我在服务器上收到错误？我该如何避免异常？

Answer 1

该TLv1 unknown CA警报是由一些客户,因为它是由一个未知的发行者CA签名发送,如果他们不能验证服务器的证书 如果您使用的客户端已经信任的证书或者可以针对客户端的根CA验证证书,则可以避免此类异常(不要忘记也包括链证书).

如果您无法避免此错误(例如,因为您使用的是自签名证书),则必须捕获异常并通过关闭连接来处理它.您可能需要通过使用handle_request自己处理每个请求并捕获异常而不是使用来执行此操作serve_forever.