Add TLS client certificate auth handler

README.md

@@ -403,6 +403,30 @@ g.set_to_current_time()
 push_to_gateway('localhost:9091', job='batchA', registry=registry, handler=my_auth_handler)
 ```
 
+If the push gateway you are connecting to is protected with HTTPS Client Certificate Auth,
+you can use a special handler to set the TLS context.
+
+```python
+from prometheus_client import CollectorRegistry, Gauge, push_to_gateway
+from prometheus_client.exposition import tls_client_auth_handler
+
+def my_auth_handler(url, method, timeout, headers, data):
+    context = ssl.create_default_context()
+    context.load_cert_chain(
+        certfile='pushgateway_client_cert',
+        keyfile='pushgateway_client_key')
+    context.load_verify_locations(
+        cafile='pushgateway_client_ca')
+
+    return tls_client_auth_handler(
+        url, method, timeout, headers, data, context)
+
+registry = CollectorRegistry()
+g = Gauge('job_last_success_unixtime', 'Last time a batch job successfully finished', registry=registry)
+g.set_to_current_time()
+push_to_gateway('localhost:9091', job='batchA', registry=registry, handler=my_auth_handler)
+```
+
 ## Bridges
 
 It is also possible to expose metrics to systems other than Prometheus.

prometheus_client/exposition.py

@@ -17,7 +17,7 @@
 try:
     from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer
     from SocketServer import ThreadingMixIn
-    from urllib2 import build_opener, Request, HTTPHandler
+    from urllib2 import build_opener, Request, HTTPHandler, HTTPSHandler
     from urllib import quote_plus
     from urlparse import parse_qs, urlparse
 except ImportError:
@@ -121,7 +121,7 @@ def sample_line(s):
         except Exception as exception:
             exception.args = (exception.args or ('',)) + (metric,)
             raise
-                    
+
         for suffix, lines in sorted(om_samples.items()):
             output.append('# TYPE {0}{1} gauge\n'.format(metric.name, suffix))
             output.extend(lines)
@@ -242,6 +242,25 @@ def handle():
     return handle
 
 
+def tls_client_auth_handler(url, method, timeout, headers, data, tlscontext):
+    ''' Handler that implements TLS client certificate authenticated connections. '''
+
+    def handle():
+        request = Request(url, data=data)
+        request.get_method = lambda: method
+        for k, v in headers:
+            request.add_header(k, v)
+
+        resp = build_opener(
+            HTTPSHandler(context=tlscontext)).open(
+                request, timeout=timeout)
+        if resp.code >= 400:
+            raise IOError("error talking to pushgateway: {0} {1}".format(
+                resp.code, resp.msg))
+
+    return handle
+
+
 def push_to_gateway(
         gateway, job, registry, grouping_key=None, timeout=30,
         handler=default_handler):