<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Dec 10, 2013, at 6:01 AM, Laurens Van Houtven <_@lvh.io> wrote:<br><div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><div><div>Somehow, JP's e-mail did not make it into my inbox :-(<br><br></div>Anyway, using the context factory that I got from ssl.PrivateCertificate.options() (which I think is CertificateOptions), I wasn't able to inspect the peer certificate. That's on 13.2. Using the context factory I pasted in a previous e-mail, it's now working great :)<br>
<br></div>cheers<br>lvh</div></blockquote><br></div><div>CertificateOptions will only set 'verify' if there are certificate authorities to verify against.</div><div><br></div><div>However, you can still CertificateOptions with a wrapper, like this:</div><div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><br></div><div>from twisted.internet.ssl import ContextFactory</div><div>from OpenSSL import SSL</div><div><br></div><div>class TOFUVerify(ContextFactory):</div><div> def __init__(self, wrapped):</div><div> self.wrapped = wrapped</div><div><br></div><div> def getContext(self):</div><div> ctx = self.wrapped.getContext()</div><div> ctx.set_verify(SSL.VERIFY_PEER, lambda *args: True)</div><div> return ctx</div></div></blockquote></div><div><br></div><div>since CertificateOptions sets a bunch of other options for you that might be useful.</div><div><br></div><div>-glyph</div><div><br></div></body></html>