How to stop handshaking and data sharing, if the server does not REQUEST for client certificate in two way SSL authentication in python3?

user_9874823 0
Viewed 58

I am using pyhthon3 requests library and want to request some resources from the server using HTTPS. So I use two way SSL authentication, and I have configured the server in a way which do not REQUEST for client certificate in response of 'client Hello' request.

enter image description here

As You can see IP xxx.xx.xxx.100 is the client and IP xxx.xx.xxx.207 is the server. So when the client sends 'Client Hello' to the sever, in response the server does not REQUEST for the client certificate, even though its two way SSL authentication.

So as per my requirements, how can I stop the process of handshaking and data sharing immediately in such case? Or how to force the server to REQUEST for client certificate?

python-requests client-certificates python-3.x ssl-certificate ssl
1 Answers

... even though its two way SSL authentication.

It's not. Just because the client has the certificate to do mutual authentication, does not mean that this certificate is actually used. It is only mutual authentication if the server actually requests it using a CertificateRequest (which is clearly not done) and the client then providing the requested certificate.

... how can I stop the process of handshaking and data sharing immediately in such case?

You can't. There is no API for this.

And I'm not sure what kind of sense such a requirement would make. The client has successfully authenticated the server which should be all needed by the client to exchange data with the server. The server instead might want to know who the client is before sending specific data. So authenticating the client before providing such data makes sense from a server perspective, but not from a client one. This would be like you refusing to drive a car if nobody is checking your drivers license.

Or how to force the server to REQUEST for client certificate?

This fully depends on the kind of server. Different servers need different configuration. For example with nginx see ssl_verify_client.

user_30810180
Related