Python Sockets SSL: certificate verify failed
<p>I am attempting to use python sockets to make an Extensible Provisioning Protocol (EPP) request to a domain registrar, which only accepts requests over ssl.</p>

<p>Certificate file: www.myDomain.se.crt
Key File: mydomain.pem</p>

<pre><code>openssl s_client -connect epptestv3.iis.se:700 -cert www.myDomain.se.crt -key mydomain.pem
</code></pre>

<p>When I try making request using openssl client I successfully get greeting response from registrar, but when I use following code in python i get ssl certificate error.</p>

<pre><code>sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(15)
sock.connect(('epptestv3.iis.se', 700))
sock.settimeout(60)  # regular timeout


ssl_keyfile='myDomain.pem'
ssl_certfile='www.myDomain.se.crt'
ssl_ciphers='AES256-GCM-SHA384'
ssl_version=ssl.PROTOCOL_TLSv1_2

sock = ssl.wrap_socket(sock,
                        ssl_keyfile,
                        ssl_certfile,
                        ssl_version=ssl_version,
                        ciphers=ssl_ciphers,
                        server_side=False,
                        cert_reqs=ssl.CERT_REQUIRED,
                        ca_certs=None
                        )
</code></pre>

<p>After executing script I get following error:</p>

<pre><code>Traceback (most recent call last):
  File "server_connect.py", line 54, in &lt;module&gt;
    ca_certs=ssl_keyfile
  File "/usr/lib/python2.7/ssl.py", line 933, in wrap_socket
    ciphers=ciphers)
  File "/usr/lib/python2.7/ssl.py", line 601, in __init__
    self.do_handshake()
  File "/usr/lib/python2.7/ssl.py", line 830, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)
</code></pre>

<p>Any idea what's wrong here?</p>

<p>From your code:</p>

<pre><code>                    cert_reqs=ssl.CERT_REQUIRED,
                    ca_certs=None
</code></pre>

<p>From the <a href="https://docs.python.org/2/library/ssl.html#ssl.wrap_socket" rel="nofollow">documentation of wrap_socket</a>:</p>

<blockquote>
  <p>If the value of this parameter is not CERT_NONE, then <strong>the ca_certs parameter must point to a file of CA certificates</strong>.</p>
</blockquote>

<p>Essentially you are asking in your code to validate the certificate from the server (<code>CERT_REQUIRED</code>) but specify at the same time that you have no trusted root (<code>ca_certs=None</code>). But without trusted root certificates no validation can be done.</p>

<p>Note that changing your code to use <code>CERT_NONE</code> instead would be a bad idea. It would probably work since no certificate validation will be done but it would be open to man in the middle attacks.</p>

python sockets ssl registrar epp