proxy.py(v2.3.1)配置自签名证书遇TLSV1_ALERT_UNKNOWN_CA错误

问题背景 #

在proxy.py（v2.3.1）中使用自签名证书时，出现ssl.SSLError: [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca错误，即使已将CA证书添加到系统信任列表，问题仍未解决。

现有实现代码 #

if __name__ == '__main__':
    # get random available port to run proxy
    proxy_port = proxy.common.utils.get_available_port()

    # set up proxy to redirect all requests from the browser through the client
    with proxy.start(
            ['--host', '127.0.0.1',
             '--port', str(proxy_port),
             '--ca-cert-file', '/home/user/app/app-ca.pem',
             '--ca-key-file', '/home/user/app/app-ca.key',
             '--ca-signing-key-file', '/home/user/app/app-signing.key'],
            plugins=
            [b'header_modifier.BasicAuthorizationPlugin',
             header_modifier.BasicAuthorizationPlugin]):
        selenium_proxy.proxyType = ProxyType.MANUAL
        selenium_proxy.httpProxy = '127.0.0.1:' + str(proxy_port)
        selenium_proxy.sslProxy = '127.0.0.1:' + str(proxy_port)
        print('Proxy address: ' + selenium_proxy.httpProxy)
        run_app()

错误日志 #

Oct 26 14:56:32 raspberrypi python3[2727]: 2023-10-26 14:56:32,654 - pid:2727 [I] load_plugins:334 - Loaded plugin proxy.http.proxy.HttpProxyPlugin
Oct 26 14:56:32 raspberrypi python3[2727]: 2023-10-26 14:56:32,656 - pid:2727 [I] load_plugins:334 - Loaded plugin header_modifier.BasicAuthorizationPlugin
Oct 26 14:56:32 raspberrypi python3[2727]: 2023-10-26 14:56:32,656 - pid:2727 [I] load_plugins:334 - Loaded plugin __main__.BasicAuthorizationPlugin
Oct 26 14:56:32 raspberrypi python3[2727]: 2023-10-26 14:56:32,657 - pid:2727 [I] listen:115 - Listening on 127.0.0.1:42591
Oct 26 14:56:32 raspberrypi python3[2727]: 2023-10-26 14:56:32,692 - pid:2727 [I] start_workers:136 - Started 4 workers
Oct 26 14:56:43 raspberrypi python3[2727]: 2023-10-26 14:56:43,505 - pid:2733 [E] intercept:540 - OSError when wrapping client
Oct 26 14:56:43 raspberrypi python3[2727]: Traceback (most recent call last):
Oct 26 14:56:43 raspberrypi python3[2727]:   File "/usr/local/lib/python3.7/dist-packages/proxy/http/proxy/server.py", line 529, in intercept
Oct 26 14:56:43 raspberrypi python3[2727]:     self.wrap_client()
Oct 26 14:56:43 raspberrypi python3[2727]:   File "/usr/local/lib/python3.7/dist-packages/proxy/http/proxy/server.py", line 559, in wrap_client
Oct 26 14:56:43 raspberrypi python3[2727]:     self.client.wrap(self.flags.ca_signing_key_file, generated_cert)
Oct 26 14:56:43 raspberrypi python3[2727]:   File "/usr/local/lib/python3.7/dist-packages/proxy/core/connection/client.py", line 43, in wrap
Oct 26 14:56:43 raspberrypi python3[2727]:     ssl_version=ssl.PROTOCOL_TLS)
Oct 26 14:56:43 raspberrypi python3[2727]:   File "/usr/lib/python3.7/ssl.py", line 1222, in wrap_socket
Oct 26 14:56:43 raspberrypi python3[2727]:     suppress_ragged_eofs=suppress_ragged_eofs
Oct 26 14:56:43 raspberrypi python3[2727]:   File "/usr/lib/python3.7/ssl.py", line 412, in wrap_socket
Oct 26 14:56:43 raspberrypi python3[2727]:     session=session
Oct 26 14:56:43 raspberrypi python3[2727]:   File "/usr/lib/python3.7/ssl.py", line 853, in _create
Oct 26 14:56:43 raspberrypi python3[2727]:     self.do_handshake()
Oct 26 14:56:43 raspberrypi python3[2727]:   File "/usr/lib/python3.7/ssl.py", line 1117, in do_handshake
Oct 26 14:56:43 raspberrypi python3[2727]:     self._sslobj.do_handshake()
Oct 26 14:56:43 raspberrypi python3[2727]: ssl.SSLError: [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:1056)
Oct 26 14:56:43 raspberrypi python3[2727]: 2023-10-26 14:56:43,511 - pid:2733 [I] access_log:397 - 127.0.0.1:42880 - CONNECT firefox.settings.services.mozilla.com:443 - 0 bytes - 123.52 ms

证书生成步骤 #

openssl genrsa -out app-ca.key 2048
openssl req -x509 -new -nodes -key app-ca.key -sha256 -days 1825 -out app-ca.pem
openssl genrsa -out app-signing.key 2048
chown user app-*

已尝试操作 #

将CA证书添加到系统信任列表：

cp app-ca.pem /usr/local/share/ca-certificates/app-ca.crt
update-ca-certificates

执行后输出：

Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

解决方案 #

1. 让浏览器信任CA证书 #

系统信任证书不代表浏览器会自动信任（如Firefox、Chrome都有独立的证书存储）：

• 打开浏览器设置，找到证书管理选项
• 导入/home/user/app/app-ca.pem，勾选“信任此CA用于标识网站”选项

2. 简化proxy.py的证书参数 #

proxy.py v2.3.1中，CA私钥本身即可用于签名，无需单独指定--ca-signing-key-file。修改启动参数，移除该选项：

with proxy.start(
        ['--host', '127.0.0.1',
         '--port', str(proxy_port),
         '--ca-cert-file', '/home/user/app/app-ca.pem',
         '--ca-key-file', '/home/user/app/app-ca.key'],
        plugins=
        [b'header_modifier.BasicAuthorizationPlugin',
         header_modifier.BasicAuthorizationPlugin]):

3. 确保Python环境信任证书 #

Python的certifi库可能使用独立的证书存储，可将CA证书追加到其证书文件中：

cat /home/user/app/app-ca.pem >> $(python3 -m certifi)

或者设置环境变量让Python使用系统证书：

export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

执行上述命令后再运行你的Python脚本。

4. 验证证书有效性 #

检查CA证书是否可被自身验证：

openssl verify -CAfile app-ca.pem app-ca.pem

若返回app-ca.pem: OK则证书有效；若失败，重新生成CA证书，确保生成时填写的Common Name等信息正确。

内容的提问来源于stack exchange，提问作者wizzfizz94