HTTPS certificate validation

[ghost]

Python 2.7.9 enables certificate verification by default for http clients. This causes an issue when the SOAPpy client tries to pass parameters to an AppController. Python throws an SSLError exception (certificate verify failed) since the AppController is using a self-signed certificate.

One (not recommended) fix would be to globally disable verification.

I think a better fix would be to pass a custom SSLContext to SOAPpy, but I don't think it supports that feature at this time. Replacing _create_default_https_context with a function that creates a custom context is a possible temporary workaround.

However, the CN on the self-signed certificate (appscale.com) won't match the hostname that the SOAPpy client requests (the node's ip address). I don't know of a good way to fix this. Telling SOAPpy to set a Host: appscale.com header might work, but I'm not sure if SOAPpy supports this. Generating a certificate for each node (with the CN set to the node's ip address) might also work, but I'm not sure if that would have other undesirable consequences.

I can start working on a pull request once a decision is made on how to address this issue.

[nlake44]

Hey Chris. What do you think is the best way to go about this?

[cdonati]

I experimented with editing the SOAPpy library to support a custom SSLContext. That worked fine, but httplib (which SOAPpy uses) does not take headers into account when passing the hostname to the ssl module.

Monkeypatching the ssl module to support a custom hostname to check the certificate against would work. However, that seems unacceptable to me. So until a better solution is discovered, I submitted a pull request that just disables verification (the same behavior as <2.7.9).

[nlake44]

Merged. We'll leave this issue open until we can figure out a better solution. Thanks Chris!