Hello,

I would like to see an implementation for SSL/TLS pinning in the sll module of the standard library.

At this moment it's only possible to give the client a CAcert and check if the server's certificate is signed with this CA by creating a ssl.Context object with ssl.Context("/path/to/cafile"). If I don't know the server's certificate, that is I just have the root certificate, this is okay. But if I implement my own server/client structure I know the server's certificate. And here comes pinning into play: If I know server's certificate I could not only check if it's signed with my CA but also if it is the specific certificate I've signed. This is a better protection against MITM e.g. and would be a great enhancement of the ssl module IMHO.

raymontag

TLS cert pinning should be possible with the implementation of #18293

Yep, that's exactly what I meant :)

If you want to check for a specific server certificate, then I guess it should be enough to expose the cert's fingerprint in the data returned by getpeercert().

getpeercert() doesn't return Subject Public Key Info yet. It's on my TODO list. Chrome uses SPKI (PK algo + mod + exp) to pin certs, https://www.imperialviolet.org/2011/05/04/pinning.html

Yeah, this was my first idea, too.

Are there at this moment other possibilities to implement pinning myself with the options the module provides me?

> Are there at this moment other possibilities to implement pinning
> myself with the options the module provides me?

I don't think so. Perhaps you could use the serialNumber, but I'm not
sure how safe it is, even when restricting to a single CA cert.

That's not a good idea, a serial number could be faked.

sha256(conn.getpeercert(True)) works until the cert gets e.g. more SAN fields.

> sha256(conn.getpeercert(True)) works until the cert gets e.g. more
> SAN fields.

Indeed, that's simply comparing the certificate by binary value. At this
point you don't even need a CA anymore, I guess :-)

Great, that matches my needs exactly

This technique is used in Mercurial and I use it in my projects too.