pyca / pyca/pyopenssl

sock.get_client_ca_list() returns empty result with TLS1.3

Open
#1,010 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
944
Forks
440
Avg merge
1d 6h
Merged PRs (30d)
6

Description

I try to get the list of client CAs, that a server allows.

with openssl I can call:
openssl s_client -connect hostname:443 -servername hostname and I can see the CAs after the lines

---
Acceptable client certificate CA names

for most servers I succeed with following code, that I borrowed from stackoverflow

import socket
from OpenSSL import SSL

def get_client_cert_cas(hostname, port):
    ctx = SSL.Context(SSL.SSLv23_METHOD)
    # uncommenting next line will make things work
    # ctx.set_options(SSL.OP_NO_TLSv1_3)
    sock = SSL.Connection(ctx, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
    # next line for SNI
    sock.set_tlsext_host_name(hostname.encode("utf-8"))
    sock.connect((hostname, port))
    sock.do_handshake()  # without this command next line always returns empty list
    return sock.get_client_ca_list())

For some servers I always get an empty answer. Though the openssl command returns the correct information.
As soon as I disable TLSv1_3 I am able to receive the client_ca_list.

Is this to be expected or is this a bug?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the provided get_client_cert_cas reproduction and compare sock.get_client_ca_list() under TLS 1.3 and with TLS 1.3 disabled. Use the OpenSSL s_client output as the expected result; done means the behavior is explained or corrected for affected servers, with the TLS-version distinction covered.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.