How to fix OpenSSL.SSL.Error: [('SSL routines', '', 'certificate verify failed')] in twisted framework?

I am using MacOS ventura and pycharm and trying to establish a connection between a twisted server/client with tls following this guide: TLS server with client authentication via client certificate verificationTherefore i created a self signed certificate like in this example with:

openssl req -x509 -newkey rsa:4096 -days 365 -nodes -keyout ca-key.pem -out ca-cert.pem -subj "/C=/ST=/L=/O=/OU=/CN=*."
openssl req -newkey rsa:4096 -nodes -keyout server-key.pem -out server-req.pem -subj "/C=/ST=/L=/O=/OU=/CN=*."
openssl x509 -req -in server-req.pem -days 60 -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile server-ext.cnf

server-ext.cnf contains: subjectAltName=DNS:*.example.comIP:0.0.0.0

openssl verify -CAfile ca-cert.pem server-cert.pem returns OK

I merged server-key.pem and server-cert.pem in server.pem and renamed server-cert.pem in public.pem

running this for the server

\#!/usr/bin/env python
# Copyright (c) Twisted Matrix Laboratories.
# See LICENSE for details.
import sys
from twisted.internet import ssl, protocol, task, defer
from twisted.python import log
from twisted.python.modules import getModule
import echoserv
def main(reactor):
log.startLogging(sys.stdout)
certData = getModule(__name__).filePath.sibling('public.pem').getContent()
authData = getModule(__name__).filePath.sibling('server.pem').getContent()
authority = ssl.Certificate.loadPEM(certData)
certificate = ssl.PrivateCertificate.loadPEM(authData)
factory = protocol.Factory.forProtocol(echoserv.Echo)
reactor.listenSSL(8000, factory, certificate.options(authority))
return defer.Deferred()
if __name__ == '__main__':
import ssl_clientauth_server
task.react(ssl_clientauth_server.main)

and that for the client side

#!/usr/bin/env python
# Copyright (c) Twisted Matrix Laboratories.
# See LICENSE for details.
from twisted.internet import ssl, task, protocol, endpoints, defer
from twisted.python.modules import getModule
import echoclient
@defer.inlineCallbacks
def main(reactor): factory = protocol.Factory.forProtocol(echoclient.EchoClient) certData = getModule(__name__).filePath.sibling('public.pem').getContent() authData = getModule(__name__).filePath.sibling('server.pem').getContent() clientCertificate = ssl.PrivateCertificate.loadPEM(authData) authority = ssl.Certificate.loadPEM(certData) options = ssl.optionsForClientTLS(u'example.com', authority, clientCertificate) endpoint = endpoints.SSL4ClientEndpoint(reactor, 'localhost', 8000, options) echoClient = yield endpoint.connect(factory) done = defer.Deferred() # echoClient.connectionLost = lambda reason: done.callback(None) echoClient.connectionLost = lambda reason: done.callback(reason) yield done
if __name__ == '__main__': import ssl_clientauth_client task.react(ssl_clientauth_client.main)

the server code is working, but the client code raises an error: OpenSSL.SSL.Error: [('SSL routines', '', 'certificate verify failed')]

I tried the steps in this Answer, installed openssl via homebrew, certifi, did export SSL_CERT_FILE="$(python -m certifi)", installed service-identity but nothing helped so far.

I am expecting a connection between server and client using TLS. How to fix this?

1 Answer

after recreating the key/certificate with:

openssl req \ -newkey rsa:2048 -nodes -keyout domain.key \ -x509 -days 365 -out domain.crt

the error: OpenSSL.SSL.Error: [('SSL routines', '', 'certificate verify failed')] disappears.