从Client.py到Node Server.js的套接字（_ssl.c：590）

我得到这个错误

File "C:\Python27\lib\ssl.py", line 844, in connect self._real_connect(addr, False) File "C:\Python27\lib\ssl.py", line 835, in _real_connect self.do_handshake() File "C:\Python27\lib\ssl.py", line 808, in do_handshake self._sslobj.do_handshake() ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) 

我试图build立一个安全的连接（ssl.socket）之间的python客户端和node.js服务器，我采取了上述错误。 我不知道什么是缺失或什么是我的错。 这里是我的源代码python客户端和node.js服务器

Node.js中的服务器套接字：

 var _HOST = '192.168.1.136'; var _PORT = 1337; var _address; const tls = require('tls'); const fs = require('fs'); const options = { // These are necessary only if using the client certificate authentication key: fs.readFileSync('./SSL_TLS/ServerCakey.pem'), cert: fs.readFileSync('./SSL_TLS/Server-cert.pem'), requestCert: true }; var server = tls.createServer(options, (socket) => { //const ProtocolEmmitter = new BasicProtocolEmmitter(); socket.on('connect', (e) => { console.log('client connected ' + socket.remoteAddress + ':' + socket.remotePort); console.log('server connected', socket.authorized ? 'authorized' : 'unauthorized'); }); socket.on('data', function(data) { console.log('clients says' + ': ' + data); }); socket.on('error', function(data) { console.log('client on error', data); }); socket.on('close', (e) => { console.log('client disconnected'); socket.end; setTimeout(() => { server.close(); server.listen(_PORT, _HOST, () => { _address = server.address(); console.log('opened server on %j', _address); console.log(' Server listening on %j ', _HOST, ':', _PORT); }); }, 10000); }); }); 

这里是我的Client.py套接字:(我正在使用Python 2.7.11）

 class SSLSocket: def __init__(self): Context = self.__loadContext() self._SSL_Sock = Context.wrap_socket(socket.socket(socket.AF_INET), server_hostname=host) self._SSL_Sock.connect((host, port)) def __loadContext(self): context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) context.verify_mode = ssl.CERT_REQUIRED context.check_hostname = True context.load_verify_locations("..Path/Client.crt") return context 

我忘了提及，我创buildclient.crt成功，我与成功validation

  `openssl x509 -req -days 365 -in server.csr -signkey server.key -out client.crt` Signature Ok 

Answer 1

  context.load_verify_locations("..Path/Client.crt") 

我认为你必须在这里的问题：

• 信任path的错误设置： load_verify_locations应设置可信CA，即它应该包含服务器证书的颁发者而不是某个客户端证书。
• 缺less客户端证书的设置：要加载客户端证书，您应该使用load_cert_chain 。