[issue18138] ssl.SSLContext.add_cert()

Christian Heimes added the comment: I think the patch in #16487 does too many things at once. The new patch is a draft for a new patch that adds SSLContext.load_verify_locations(cadata) to the SSL module. cadata can be a bunch of PEM encoded certs (ASCII) or DER encoded certs (bytes-like). The

[issue18138] ssl.SSLContext.add_cert()

Changes by Jesús Cea Avión : -- nosy: +jcea ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.

[issue18138] ssl.SSLContext.add_cert()

Changes by Christian Heimes : Added file: http://bugs.python.org/file30643/sslctx_add_cert5.patch ___ Python tracker ___ ___ Python-bugs-list

[issue18138] ssl.SSLContext.add_cert()

Christian Heimes added the comment: Yes, I have seen them. In fact OpenSSL has library, function and reason. if ((ERR_GET_LIB(errcode) == ERR_LIB_X509) && (ERR_GET_REASON(errcode) == X509_R_CERT_ALREADY_IN_HASH_TABLE)) {} I'm going for 3) -- __

[issue18138] ssl.SSLContext.add_cert()

Antoine Pitrou added the comment: Le mardi 18 juin 2013 à 17:30 +, Christian Heimes a écrit : > Christian Heimes added the comment: > > I'm pondering about the error case "cert already in hash table". There > should be a way to distinguish the error from other errors. I don't know if you've

[issue18138] ssl.SSLContext.add_cert()

Christian Heimes added the comment: I'm pondering about the error case "cert already in hash table". There should be a way to distinguish the error from other errors. I see three ways to handle the case: 1) introduce SSLCertInStoreError exeption 2) ignore the error and do nothing 3) ignore the

[issue18138] ssl.SSLContext.add_cert()

Antoine Pitrou added the comment: > The check for trailing data ensures that the user gets an error > message if she tries to load a PEM string with multiple certs. She > might expect that add_ca_cert(pem) loads all PEM certs from the > string while in fact PEM_read_bio_X509() only loads the firs

[issue18138] ssl.SSLContext.add_cert()

Christian Heimes added the comment: Here is a simplified version of the C function. It uses y* or es# "ascii" to parse the argument. The check for trailing data ensures that the user gets an error message if she tries to load a PEM string with multiple certs. She might expect that add_ca_cert

[issue18138] ssl.SSLContext.add_cert()

Christian Heimes added the comment: New patch: * rename function to add_ca_cert() * only accept CA certs, no other certs * raise an error if extra data is found after cert (e.g. two certs). PEM_read_bio_X509() silently ignores extra data * fixes from Ezio's code review * documentation

[issue18138] ssl.SSLContext.add_cert()

New submission from Christian Heimes: The patch implements an add_cert(pem_or_der_data) method for the ssl.SSLContext() object. On success the method adds a trusted CA cert to the context's internal cert store. The CA certificate can either be an ASCII unicode string (PEM format) or buffer obj