Flask+Eventlet+DispatcherMiddleware配置SSL遇证书未知错误求助

问题背景 #

我基于Flask、Eventlet、DispatcherMiddleware和Socket.IO编写了Python服务，在为连接配置SSL后，出现ssl.SSLError: [SSL: SSLV3_ALERT_CERTIFICATE_UNKNOWN]错误。

初始代码 #

import socketio
from eventlet import listen, wrap_ssl
from eventlet.wsgi import server
from flask import Flask
from werkzeug.middleware.dispatcher import DispatcherMiddleware


app = Flask(__name__)
app1 = Flask(__name__)


sio = socketio.Server(async_mode="eventlet")


app.wsgi_app = socketio.WSGIApp(sio, DispatcherMiddleware(app, {"/app1": app1}))


server(listen(("localhost", 80)), app)

版本信息 #

Python 3.10.7 64-bit
python-socketio==5.8.0
eventlet==0.33.3
Flask==2.3.1
Werkzeug==2.3.0

调整后的SSL配置代码 #

import socketio
from eventlet import listen
from eventlet.wsgi import server
from flask import Flask
from werkzeug.middleware.dispatcher import DispatcherMiddleware


app = Flask(__name__)
app1 = Flask(__name__)


sio = socketio.Server(async_mode="eventlet")


app.wsgi_app = socketio.WSGIApp(sio, DispatcherMiddleware(app, {"/app1": app1}))


server(wrap_ssl(listen(("127.0.0.1", 443)), certfile='MyCert.crt', keyfile='MyPrivate.key'), app)

错误栈 #

(17524) wsgi starting up on https://127.0.0.1:443
(17524) accepted ('127.0.0.1', 62260)
Traceback (most recent call last):
  File "C:\Program Files\Python310\lib\site-packages\eventlet\hubs\selects.py", line 59, in wait    
    listeners.get(fileno, hub.noop).cb(fileno)
  File "C:\Program Files\Python310\lib\site-packages\eventlet\greenthread.py", line 221, in main    
    result = function(*args, **kwargs)
  File "C:\Program Files\Python310\lib\site-packages\eventlet\wsgi.py", line 837, in process_request
    proto.__init__(conn_state, self)
  File "C:\Program Files\Python310\lib\site-packages\eventlet\wsgi.py", line 350, in __init__       
    self.handle()
  File "C:\Program Files\Python310\lib\site-packages\eventlet\wsgi.py", line 383, in handle
    self.handle_one_request()
  File "C:\Program Files\Python310\lib\site-packages\eventlet\wsgi.py", line 412, in handle_one_request
    self.raw_requestline = self._read_request_line()
  File "C:\Program Files\Python310\lib\site-packages\eventlet\wsgi.py", line 395, in _read_request_line
    return self.rfile.readline(self.server.url_length_limit)
  File "C:\Program Files\Python310\lib\socket.py", line 705, in readinto
    return self._sock.recv_into(b)
  File "C:\Program Files\Python310\lib\site-packages\eventlet\green\ssl.py", line 253, in recv_into
    return self._base_recv(nbytes, flags, into=True, buffer_=buffer)
  File "C:\Program Files\Python310\lib\site-packages\eventlet\green\ssl.py", line 268, in _base_recv
    read = self.read(nbytes, buffer_)
  File "C:\Program Files\Python310\lib\site-packages\eventlet\green\ssl.py", line 187, in read
    return self._call_trampolining(
  File "C:\Program Files\Python310\lib\site-packages\eventlet\green\ssl.py", line 162, in _call_trampolining
    return func(*a, **kw)
  File "C:\Program Files\Python310\lib\ssl.py", line 1130, in read
    return self._sslobj.read(len, buffer)
ssl.SSLError: [SSL: SSLV3_ALERT_CERTIFICATE_UNKNOWN] sslv3 alert certificate unknown (_ssl.c:2548)
Removing descriptor: 852

解决方案 #

这个错误本质是客户端不认可服务端的SSL证书，可从以下几个方向排查修复：

1. 验证证书与私钥的有效性 #

• 确认自签名证书的**Common Name(CN)**与访问地址一致（当前用的是127.0.0.1，证书CN需设为127.0.0.1或localhost）。
• 检查证书与私钥是否配对，用openssl命令验证：

  openssl x509 -noout -modulus -in MyCert.crt | openssl md5
  openssl rsa -noout -modulus -in MyPrivate.key | openssl md5
  

  两个命令输出的MD5值必须完全相同，否则证书与私钥不匹配。

2. 完善Eventlet的wrap_ssl参数 #

调用wrap_ssl时明确指定TLS版本，避免使用过时的SSLv3协议，同时按需配置验证规则：

import ssl  # 需新增ssl模块导入

server(wrap_ssl(
    listen(("127.0.0.1", 443)),
    certfile='MyCert.crt',
    keyfile='MyPrivate.key',
    server_side=True,
    ssl_version=ssl.PROTOCOL_TLS_SERVER,
    cert_reqs=ssl.CERT_NONE  # 测试环境关闭客户端证书验证，生产环境按需调整
), app)

3. 让客户端信任证书 #

• 浏览器访问时，将自签名证书添加到浏览器的信任列表。
• Socket.IO客户端连接时，测试环境可临时关闭证书验证（生产环境禁止）：

  const socket = io('https://127.0.0.1:443', {
    rejectUnauthorized: false
  });
  

4. 端口权限问题 #

443是标准HTTPS端口，Windows/Linux下需要管理员权限才能绑定。如果不想使用管理员权限，可改用非标准端口（如8443），访问地址改为https://127.0.0.1:8443。

内容的提问来源于stack exchange，提问作者Florian