How generate a localhost.pem

[qux-bbb]

Hi, in here: https://websockets.readthedocs.io/en/stable/intro.html#secure-example, it mentionted "localhost.pem". How can I generate a localhost.pem?

[aaugustin]

https://www.google.com/search?q=generate+certificate - first result should work.

[qux-bbb]

I tried, and when I run the server.py, I get an error.
My system is Ubuntu 16.04.7, x64
My python version is python3.7
The server.py is:

#!/usr/bin/env python

# WSS (WS over TLS) server example, with a self-signed certificate

import asyncio
import pathlib
import ssl
import websockets

async def hello(websocket, path):
    name = await websocket.recv()
    print(f"< {name}")

    greeting = f"Hello {name}!"

    await websocket.send(greeting)
    print(f"> {greeting}")

ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
localhost_pem = pathlib.Path(__file__).with_name("localhost.pem")
ssl_context.load_cert_chain(localhost_pem)

start_server = websockets.serve(
    hello, "localhost", 8765, ssl=ssl_context
)

asyncio.get_event_loop().run_until_complete(start_server)
asyncio.get_event_loop().run_forever()

I use this to generate a localhost.pem:

openssl req -x509 -nodes -new -sha256 -days 1024 -newkey rsa:2048 -keyout localhost.key -out localhost.pem -subj "/C=US/CN=Example-Root-CA"

when I run server.py by python3.7 server.py, the error is:

➜  tmp python3.7 server.py 
Traceback (most recent call last):
  File "server.py", line 21, in <module>
    ssl_context.load_cert_chain(localhost_pem)
ssl.SSLError: [SSL] PEM lib (_ssl.c:3932)

[qux-bbb]

I solved it by this link: https://fenghe.us/ssl-sslerror-ssl-pem-lib-_ssl-c3824-python-websockets-ssl/
Generate key.pem, cert.pem, key_cert.pem:

openssl req -x509 -nodes -new -sha256 -days 1024 -newkey rsa:2048 -keyout key.pem -out cert.pem -subj "/C=US/CN=localhost"
cat key.pem cert.pem > key_cert.pem

The server.py use key_cert.pem and the client.py use cert.pem.

server.py

#!/usr/bin/env python

# WSS (WS over TLS) server example, with a self-signed certificate

import asyncio
import pathlib
import ssl
import websockets

async def hello(websocket, path):
    name = await websocket.recv()
    print(f"< {name}")

    greeting = f"Hello {name}!"

    await websocket.send(greeting)
    print(f"> {greeting}")

ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
localhost_pem = pathlib.Path(__file__).with_name("key_cert.pem")
ssl_context.load_cert_chain(localhost_pem)

start_server = websockets.serve(
    hello, "localhost", 8765, ssl=ssl_context
)

asyncio.get_event_loop().run_until_complete(start_server)
asyncio.get_event_loop().run_forever()

client.py

#!/usr/bin/env python

# WSS (WS over TLS) client example, with a self-signed certificate

import asyncio
import pathlib
import ssl
import websockets

ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
localhost_pem = pathlib.Path(__file__).with_name("cert.pem")
ssl_context.load_verify_locations(localhost_pem)

async def hello():
    uri = "wss://localhost:8765"
    async with websockets.connect(
        uri, ssl=ssl_context
    ) as websocket:
        name = input("What's your name? ")

        await websocket.send(name)
        print(f"> {name}")

        greeting = await websocket.recv()
        print(f"< {greeting}")

asyncio.get_event_loop().run_until_complete(hello())

[aaugustin]

Probably your first attempt didn't work because the CN didn't match.

I don't feel this is specific to websockets: you'd get the same issue with any other connection over TLS in Python. Therefore I don't think any action is warranted here.

[qux-bbb]

Yes, it's not about websockets. I just want the secure-example to work.

[aaugustin]

The example should work as is, loading the certificate included in the repository:
https://github.com/aaugustin/websockets/blob/master/example/localhost.pem

[qux-bbb]

Yeah, it does work. Thanks very much!

[rayrapetyan]

Solution described in this thread doesn't work in 2024, connection from the client resets with:

Traceback (most recent call last):
  File "/workspaces/sigsvc/client.py", line 27, in <module>
    asyncio.get_event_loop().run_until_complete(hello())
  File "/usr/local/lib/python3.11/asyncio/base_events.py", line 653, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/workspaces/sigsvc/client.py", line 17, in hello
    async with websockets.connect(uri, ssl=ssl_context) as websocket:
  File "/workspaces/sigsvc/.venv/lib/python3.11/site-packages/websockets/legacy/client.py", line 629, in __aenter__
    return await self
           ^^^^^^^^^^
  File "/workspaces/sigsvc/.venv/lib/python3.11/site-packages/websockets/legacy/client.py", line 647, in __await_impl_timeout__
    return await self.__await_impl__()
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workspaces/sigsvc/.venv/lib/python3.11/site-packages/websockets/legacy/client.py", line 651, in __await_impl__
    _transport, _protocol = await self._create_connection()
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/asyncio/base_events.py", line 1112, in create_connection
    transport, protocol = await self._create_connection_transport(
                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/asyncio/base_events.py", line 1145, in _create_connection_transport
    await waiter
  File "/usr/local/lib/python3.11/asyncio/sslproto.py", line 575, in _on_handshake_complete
    raise handshake_exc
ConnectionResetError

[qux-bbb]

@rayrapetyan Maybe you can show more detail, for example, your scripts, your operations...

[rayrapetyan]

@qux-bbb, I've used server/client from your comment above: #876 (comment)

[qux-bbb]

@qux-bbb, I've used server/client from your comment above: #876 (comment)

I tested them on ubuntu22.04, and them work.

[rayrapetyan]

Sorry, you're right, I was using a faulty logging driver, your code above works!