Hosting HTTPS With Flask

curl --cacert ca-public-key.pem https://localhost:5684/

I have followed the entire tutorial with the provided code on my machine up to this point, and everything has run just fine.

Unfortunately this final attempt to hit the server with curl is still returning exit code 60 (invalid certificate).

I have tried:

• generating new keys (PEM files)
• entering the full file path for ca-public-key.pem in the –cacert argument

I would appreciate any suggestions… I was really excited to get this final response from the server.

@Stuart The sample certificate included in the supporting material has already expired. However, generating a new one with the included script doesn’t work for me either. Unfortunately, I’m not sure what the reason is off the top of my head.

You could try creating a self-signed certificate with openssl as a quick workaround, though:

$ openssl req -x509 -newkey rsa:4096 -keyout server-private-key.pem -out server-public-key.pem -days 365

…and then ignore insecure certificates:

$ curl -k https://localhost:5684/
shhhh, this is secret

Anyway, we’ll probably need @Christopher‘s help with this one.

Hi @Stuart,

@Bartosz and I have been plugging away at this, and I think we’ve figured it out. The root certificate generation code needs to change a little bit, I’ll show you how.

The version of curl I’m using is a bit older and uses TLS 1.2. The version Bartosz is using (and I suspect you are as well) uses the more up to date TLS 1.3. When I install a new version of curl, I get the same problem you are experiencing.

The key to fixing it is inside of the builder code. Currently, make_builder has the following:

    builder = (
        x509.CertificateBuilder()
        .subject_name(subject)
        .issuer_name(issuer)
        .serial_number(x509.random_serial_number())
        .not_valid_before(valid_from)
        .not_valid_after(valid_to)
    )

To get a valid CA certificate you also need another parameter. Change your builder to include:

        .add_extension(x509.BasicConstraints(ca=True,
                path_length=None), critical=True)

This change should only be for generating the public CA. In my own code I added a is_ca parameter to make_builder and to PublicKey.generate. My make_builder now looks like this:

def make_builder(subject, issuer, is_ca=False):
    # Expire this certificate 30 days from now
    valid_from,valid_to = date_range(3000)

    # Chain-call certificate builder with necessary parameters
    builder = (
        x509.CertificateBuilder()
        .subject_name(subject)
        .issuer_name(issuer)
        .serial_number(x509.random_serial_number())
        .not_valid_before(valid_from)
        .not_valid_after(valid_to)
    )

    if is_ca:
        builder = builder.add_extension(x509.BasicConstraints(ca=True,
            path_length=None), critical=True)

    return builder

Then you have to make changes to PublicKey and generate_keys.py to expose this new parameter. Or, you can cheat add the line by hand, commenting it in and out depending on your needs.

What does all this mean? I’m not 100% sure, but I suspect that either TLS 1.2 didn’t require this parameter, or was more forgiving when it was missing.

We’ll update the course with the new code at some point, but in the meantime, you can add the new .add_extension call and should be good to go.

Thanks for the comment. Hope you enjoyed the course, this bump not withstanding.

Happy coding!