python龙卷风中的SSL（https）

Posted 2021-04-07

我通过以下方式创建了证书文件和密钥文件：

openssl req  -newkey rsa:2048 -nodes -keyout ho-madad.1.pem -out ho-madad.2.pem       

我成功收到了这两份文件。我将这两个文件放在Python项目的根目录下。

在PyCharm我有这个代码：

import os
import tornado.ioloop
import tornado.web
import tornado.httpserver
import http.server


class MainHandler(tornado.web.RequestHandler):
    def prepare(self):
    if self.request.protocol == "http":
        self.redirect("https://%s" % self.request.full_url() 
                 [len("http://"):], permanent=True)

def get(self):
    self.write("Hello, world")

application = tornado.web.Application([
    (r"/t", MainHandler),
])

http_server = tornado.httpserver.HTTPServer(application,
    ssl_options = {

    "certfile": os.path.join("ho-madad.2.pem"),
    "keyfile": os.path.join("ho-madad.1.pem"),
    }
)

if __name__ == '__main__':
    http_server.listen(443)
    tornado.ioloop.IOLoop.instance().start()

但是当我使用https://ho-madad/t从浏览器运行时，我收到此错误：

handle: <Handle BaseAsyncIOLoop._handle_events(356, 1)>
Traceback (most recent call last):
  File >"C:Users
isimAppDataLocalProgramsPythonPython36Libasyncioevents.py", 

line 145, in _run   self._callback(*self._args)

  File "C:Users
isimDocumentsEPM>ServerSideCodeEmpServerSidevenvlibsite-ackages	ornadoplatformasyncio.py",

 line 122, in _handle_events   handler_func(fileobj, events)
  File "C:Users
isimDocumentsEPM >ServerSideCodeEmpServerSidevenvlibsite-packages	ornadostack_context.py", 
line 300, in null_wrapper   return fn(*args, **kwargs)
  File "C:Users
isimDocumentsEPM >ServerSideCodeEmpServerSidevenvlibsite-packages	ornado
etutil.py", line >262, in accept_handler   callback(connection, address)
  File "C:Users
isimDocumentsEPM >ServerSideCodeEmpServerSidevenvlibsite-packages	ornado	cpserver.py", line >263, in _handle_connection do_handshake_on_connect=False)
  File "C:Users
isimDocumentsEPM >ServerSideCodeEmpServerSidevenvlibsite-packages	ornado
etutil.py", line >565, in ssl_wrap_socket context = ssl_options_to_context(ssl_options)
  File "C:Users
isimDocumentsEPM >ServerSideCodeEmpServerSidevenvlibsite-packages	ornado
etutil.py", line 540, in ssl_options_to_context
    context.load_cert_chain(ssl_options['certfile'], ssl_options.get('keyfile', >None))
ssl.SSLError: [SSL] PEM lib (_ssl.c:3393)

答案

openssl req的默认输出是证书签名请求而不是证书。添加-x509选项以生成自签名证书，或将签名请求提交给您选择的证书颁发机构以获取签名CA.