Drop md5 and sha1 fingerprints

[asvetlov]

Should be done in 3.0

[oleksandr-kuzmenko]

I can help with this

[redixin]

To extract signature hash algorithm we need to use either openssl or cryptography. Core library does not expose this information: https://docs.python.org/3/library/ssl.html#ssl.SSLSocket.getpeercert

@Alxpy @asvetlov ideas?

@Alxpy are you still interested in this issue?

[asvetlov]

We use getpeercert(binary_form=True), everything works fine for years

[redixin]

Sorry I misunderstood what exactly is needed. I thought you want to disallow client connections to https servers where md5|sha1 was used to sign certificate by CA.

So you want to disallow sha1|md5 while checking fingerprint as described here?

# Attempt to connect to https://www.python.org
# with a pin to a bogus certificate:
bad_fingerprint = b'0'*64
exc = None
try:
    r = await session.get('https://www.python.org',
                          fingerprint=bad_fingerprint)
except aiohttp.FingerprintMismatch as e:
    exc = e
assert exc is not None
assert exc.expected == bad_fingerprint

# www.python.org cert's actual fingerprint
assert exc.got == b'...'

Looks like its enough to raise (instead of warning) something from aiohttp/client_exceptions.py in this piece:

aiohttp/aiohttp/client_reqrep.py

Line 348 in 20362c5

warnings.warn('md5 and sha1 are insecure and deprecated. '

Should new exception be created? Like InsecureFingerprintHash(ClientSSLError)

[asvetlov]

I think ValueError is enough.

[oleksandr-kuzmenko]

@redixin yes, I'm interested in this issue, I'll do it on the weekend

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a [new issue] for related bugs.
If you feel like there's important points made in this discussion, please include those exceprts into that [new issue].
[new issue]: https://github.com/aio-libs/aiohttp/issues/new