- Creating self signed certificate
- Using ssl in python server
- Using ssl in requests
Keep private key safe!
# 2048 bit, no password, private key: root.key, self-signed certificate: root.crt
openssl req -newkey rsa:2048 -nodes -keyout root.key -x509 -days 365 -out root.crt
ref: https://piware.de/2011/01/creating-an-https-server-in-python/
import BaseHTTPServer, SimpleHTTPServer
import ssl
# subclass BaseHTTPRequestHandler for custom server
httpd = BaseHTTPServer.HTTPServer(('localhost', 4443), SimpleHTTPServer.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket, keyfile="/path/to/root.key", certfile='/path/to/root.crt', server_side=True)
httpd.serve_forever()
doc: http://docs.python-requests.org/en/latest/user/advanced/#ssl-cert-verification
Because the certificate is self-signed. It cannot defend the man-in-the-middle attack. Except you give the client a copy of your certificate! It maybe even safer than CA certificate since only you have the certificate.
import requests
r = requests.get('localhost', verify='/path/to/root.crt')