Method test_bad_server_certificate

python/tests/proton_tests/ssl.py:450–488

A server with a self-signed certificate that is not trusted by the client. The client should reject the server.

(self)

        self._pump(client, server)

    def test_bad_server_certificate(self):
        """ A server with a self-signed certificate that is not trusted by the
        client.  The client should reject the server.
        """
        self.server_domain.set_credentials(self._testpath("bad-server-certificate.pem"),
                                           self._testpath("bad-server-private-key.pem"),
                                           "server-password")
        self.server_domain.set_peer_authentication(SSLDomain.ANONYMOUS_PEER)

        self.client_domain.set_trusted_ca_db(self._testpath("ca-certificate.pem"))
        self.client_domain.set_peer_authentication(SSLDomain.VERIFY_PEER)

        server = SslTest.SslTestConnection(self.server_domain, mode=Transport.SERVER)
        client = SslTest.SslTestConnection(self.client_domain)

        client.connection.open()
        server.connection.open()
        self._pump(client, server)
        assert client.transport.closed
        assert server.transport.closed
        assert client.connection.state & Endpoint.REMOTE_UNINIT
        assert server.connection.state & Endpoint.REMOTE_UNINIT

        del server
        del client

        # now re-try with a client that does not require peer verification
        self.client_domain.set_peer_authentication(SSLDomain.ANONYMOUS_PEER)

        client = SslTest.SslTestConnection(self.client_domain)
        server = SslTest.SslTestConnection(self.server_domain, mode=Transport.SERVER)

        client.connection.open()
        server.connection.open()
        self._pump(client, server)
        assert client.ssl.protocol_name() is not None
        client.connection.close()
        server.connection.close()
        self._pump(client, server)

    def test_allow_unsecured_client_which_connects_unsecured(self):
        """ Server allows an unsecured client to connect if configured.