Sfoglia il codice sorgente

[core] Added SSL Certificate Chain support to CherryPy

Enrico Berti 10 anni fa
parent
commit
df932c6

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -75,6 +75,9 @@
   # Filename of SSL RSA Private Key
   ## ssl_private_key=
 
+  # Filename of SSL Certificate Chain
+  ## ssl_certificate_chain=
+
   # SSL certificate password
   ## ssl_password=
 

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -79,6 +79,9 @@
   # Filename of SSL RSA Private Key
   ## ssl_private_key=
 
+  # Filename of SSL Certificate Chain
+  ## ssl_certificate_chain=
+
   # SSL certificate password
   ## ssl_password=
 

+ 6 - 0
desktop/core/src/desktop/conf.py

@@ -113,6 +113,12 @@ SSL_PRIVATE_KEY = Config(
   type=coerce_file,
   default=None)
 
+SSL_CERTIFICATE_CHAIN = Config(
+  key="ssl_certificate_chain",
+  help=_("Filename of SSL Certificate Chain"),
+  type=coerce_file,
+  default=None)
+
 SSL_CIPHER_LIST = Config(
   key="ssl_cipher_list",
   help=_("List of allowed and disallowed ciphers"),

+ 7 - 0
desktop/core/src/desktop/lib/wsgiserver.py

@@ -46,6 +46,10 @@ Want SSL support? Just set these attributes:
     
     server.ssl_certificate = <filename>
     server.ssl_private_key = <filename>
+
+Supports also SSL certificate chains with this attribute:
+
+    server.ssl_certificate_chain = <filename>
     
     if __name__ == '__main__':
         try:
@@ -1524,6 +1528,7 @@ class CherryPyWSGIServer(object):
     # Paths to certificate and private key files
     ssl_certificate = None
     ssl_private_key = None
+    ssl_certificate_chain = None
     ssl_cipher_list = "DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2"
     ssl_password_cb = None
     
@@ -1693,6 +1698,8 @@ class CherryPyWSGIServer(object):
             try:
               ctx.use_privatekey_file(self.ssl_private_key)
               ctx.use_certificate_file(self.ssl_certificate)
+              if self.ssl_certificate_chain:
+                ctx.use_certificate_chain_file(self.ssl_certificate_chain)
             except Exception, ex:
               logging.exception('SSL key and certificate could not be found or have a problem')
               raise ex

+ 3 - 0
desktop/core/src/desktop/management/commands/runcherrypyserver.py

@@ -43,6 +43,7 @@ CPSERVER_OPTIONS = {
   'server_group': conf.SERVER_GROUP.get(),
   'ssl_certificate': conf.SSL_CERTIFICATE.get(),
   'ssl_private_key': conf.SSL_PRIVATE_KEY.get(),
+  'ssl_certificate_chain': conf.SSL_CERTIFICATE_CHAIN.get(),
   'ssl_cipher_list': conf.SSL_CIPHER_LIST.get()
 }
 
@@ -85,6 +86,8 @@ def start_server(options):
     if options['ssl_certificate'] and options['ssl_private_key']:
         server.ssl_certificate = options['ssl_certificate']
         server.ssl_private_key = options['ssl_private_key']
+        if options['ssl_certificate_chain']:
+            server.ssl_certificate_chain = options['ssl_certificate_chain']
         server.ssl_cipher_list = options['ssl_cipher_list']
 
         ssl_password = conf.get_ssl_password()