sock.get_client_ca_list() returns empty result with TLS1.3
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 944
- Forks
- 440
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 6
Description
I try to get the list of client CAs, that a server allows.
with openssl I can call:
openssl s_client -connect hostname:443 -servername hostname and I can see the CAs after the lines
---
Acceptable client certificate CA names
for most servers I succeed with following code, that I borrowed from stackoverflow
import socket
from OpenSSL import SSL
def get_client_cert_cas(hostname, port):
ctx = SSL.Context(SSL.SSLv23_METHOD)
# uncommenting next line will make things work
# ctx.set_options(SSL.OP_NO_TLSv1_3)
sock = SSL.Connection(ctx, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
# next line for SNI
sock.set_tlsext_host_name(hostname.encode("utf-8"))
sock.connect((hostname, port))
sock.do_handshake() # without this command next line always returns empty list
return sock.get_client_ca_list())
For some servers I always get an empty answer. Though the openssl command returns the correct information.
As soon as I disable TLSv1_3 I am able to receive the client_ca_list.
Is this to be expected or is this a bug?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the provided get_client_cert_cas reproduction and compare sock.get_client_ca_list() under TLS 1.3 and with TLS 1.3 disabled. Use the OpenSSL s_client output as the expected result; done means the behavior is explained or corrected for affected servers, with the TLS-version distinction covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100