Bug 1671353
| Summary: | http.client doesn't support Post-Handshake Authentication (TLS 1.3) | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Branislav Náter <bnater> |
| Component: | python3 | Assignee: | Charalampos Stratakis <cstratak> |
| Status: | CLOSED ERRATA | QA Contact: | Lukáš Zachar <lzachar> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.0 | CC: | bnater, cheimes, cstratak, jkejda, mnalband, pviktori, vstinner |
| Target Milestone: | rc | ||
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | python3-3.6.8-13.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-11-05 22:03:43 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
For backward compatibility PHA is disabled by default. Please try again with:
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ctx.load_default_certs()
ctx.load_cert_chain('/etc/pki/tls/certs/admin.crt', '/etc/pki/tls/private/admin.key')
ctx.post_handshake_auth = True # <<<<< enable PHA
conn = HTTPSConnection(hostname, context=ctx)
conn.request('GET', '/test')
print(conn.getresponse().read().decode('utf-8'))
Did the example above help? Branislav, did the example above help? Do you need anything from our side? Upstream bug https://bugs.python.org/issue37440 and upstream fix https://github.com/python/cpython/commit/d1bd6e79da1ee56dc1b902d804216ffd267399db address the issue and enable PHA by default. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2019:3520 |
Description of problem: http.client doesn't support Post-Handshake Authentication (TLS 1.3) Version-Release number of selected component (if applicable): platform-python-3.6.8-1.el8 How reproducible: $ sudo python3 tls13.py <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /test on this server.<br /> Reason: Cannot perform Post-Handshake Authentication.<br /></p> </body></html> $ cat /etc/httpd/conf.d/test.conf <Location "/test"> SSLVerifyClient require </Location> $ cat tls13.py import ssl import socket from http.client import HTTPSConnection hostname = socket.getfqdn() ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) ctx.load_default_certs() ctx.load_cert_chain('/etc/pki/tls/certs/admin.crt', '/etc/pki/tls/private/admin.key') conn = HTTPSConnection(hostname, context=ctx) conn.request('GET', '/test') print(conn.getresponse().read().decode('utf-8'))