id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc	launchpad_bug
2791	Tahoe CLI / SSL certificate	cedric		"Hi,

I'm running a small grid with few nodes.
I use Web API through HTTPS with self signed certificates/Internal CA
I'm dealing with some troubles when i call tahoe cli (eg: tahoe create-alias....).

""tahoe create-alias test"" return error:
{{{
Traceback (most recent call last):
  File ""/venv/local/lib/python2.7/site-packages/allmydata/scripts/runner.py"", line 162, in run
    rc = runner(sys.argv[1:], install_node_control=install_node_control)
  File ""/venv/local/lib/python2.7/site-packages/allmydata/scripts/runner.py"", line 147, in runner
    rc = cli.dispatch[command](so)
  File ""/venv/local/lib/python2.7/site-packages/allmydata/scripts/cli.py"", line 486, in create_alias
    rc = tahoe_add_alias.create_alias(options)
  File ""/venv/local/lib/python2.7/site-packages/allmydata/scripts/tahoe_add_alias.py"", line 85, in create_alias
    resp = do_http(""POST"", url)
  File ""/venv/local/lib/python2.7/site-packages/allmydata/scripts/common_http.py"", line 70, in do_http
    c.endheaders()
  File ""/usr/lib/python2.7/httplib.py"", line 997, in endheaders
    self._send_output(message_body)
  File ""/usr/lib/python2.7/httplib.py"", line 850, in _send_output
    self.send(msg)
  File ""/usr/lib/python2.7/httplib.py"", line 812, in send
    self.connect()
  File ""/usr/lib/python2.7/httplib.py"", line 1212, in connect
    server_hostname=server_hostname)
  File ""/usr/lib/python2.7/ssl.py"", line 350, in wrap_socket
    _context=self)
  File ""/usr/lib/python2.7/ssl.py"", line 566, in __init__
    self.do_handshake()
  File ""/usr/lib/python2.7/ssl.py"", line 796, in do_handshake
    match_hostname(self.getpeercert(), self.server_hostname)
  File ""/usr/lib/python2.7/ssl.py"", line 273, in match_hostname
    % (hostname, dnsnames[0]))
CertificateError: hostname '127.0.0.1' doesn't match u'Myhostname'
}}}

SSL certificate has CN=Myhostname and an alternative name IP.1=127.0.0.1.
CA certificate is available in /etc/ssl/certs/ and c_rehash done.

openssl s_client -connect 127.0.0.1:3456 -CApath /etc/ssl/certs/ return ""Ok"".

It seem that ssl.py is only try to verify CN == hostname, there is no verification on alternative name.

The only way i've found to get tahoe cli working is to change node.url by replacing https://127.0.0.1:3456 by https://Myhostname:3456

I missed something?

Thanks for your help and thanks for the great job on Tahoe-LAFS!
"	defect	new	normal	undecided	code-frontend-cli	1.11.0