diff options
| author | Quentin Pradet <quentin.pradet@gmail.com> | 2020-03-16 22:05:06 +0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-03-16 22:05:06 +0400 |
| commit | eee53a69e1af019da18635d6974f893308db0ada (patch) | |
| tree | 880e7df8d2c05643e344ebcb8d4811cf816f0cb0 /src | |
| parent | 7cb6b5d91fcd57d21285a05588e02a2ad1605f2b (diff) | |
| download | urllib3-eee53a69e1af019da18635d6974f893308db0ada.tar.gz | |
Ensure load_verify_locations raises SSLError for all backends (#1812)
* Ensure load_verify_locations raises SSLError for all backends
This also adds TestSSL to the classes tested in SecureTransport and
PyOpenSSL, since:
1. TestSSL was the most natural place for this test.
2. The test only makes sense when run against all SSL backends.
Co-authored-by: Pierre-Louis Bonicoli <pierre-louis.bonicoli@libregerbil.fr>
* Remove redundant check in test
pytest.raises() already checks this.
* Update test_socketlevel.py
Co-authored-by: Pierre-Louis Bonicoli <pierre-louis.bonicoli@libregerbil.fr>
Co-authored-by: Seth Michael Larson <sethmichaellarson@gmail.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/urllib3/contrib/pyopenssl.py | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/urllib3/contrib/pyopenssl.py b/src/urllib3/contrib/pyopenssl.py index 3051ef3a..81a80651 100644 --- a/src/urllib3/contrib/pyopenssl.py +++ b/src/urllib3/contrib/pyopenssl.py @@ -450,9 +450,12 @@ class PyOpenSSLContext(object): cafile = cafile.encode("utf-8") if capath is not None: capath = capath.encode("utf-8") - self._ctx.load_verify_locations(cafile, capath) - if cadata is not None: - self._ctx.load_verify_locations(BytesIO(cadata)) + try: + self._ctx.load_verify_locations(cafile, capath) + if cadata is not None: + self._ctx.load_verify_locations(BytesIO(cadata)) + except OpenSSL.SSL.Error as e: + raise ssl.SSLError("unable to load trusted certificates: %r" % e) def load_cert_chain(self, certfile, keyfile=None, password=None): self._ctx.use_certificate_chain_file(certfile) |