search

Pr0Ger / PyAPNs2

Python library for interacting with the Apple Push Notification service (APNs) via HTTP/2 protocol
MIT License
349 stars 179 forks source link

Certificate usage #51

Closed velis74 closed 7 years ago

velis74 commented 7 years ago

I'm trying to establish this functionality, but failing miserably in certificate initialisation phase:

I have generated a "VoIP Services" certificate. Downloaded it comes in .cer format. I convert it to .pem using OpenSSL: openssl x509 -inform der -in ios.cer -out ios.pem

Whichever of these two certificates I try to use:

        client = APNsClient(os.path.join(settings.BASE_DIR, 'ScantronServer' ,'ios.cer'),
                            use_sandbox=False, use_alternative_port=False)

I get a similar error: ssl.SSLError: [SSL] PEM lib (_ssl.c:3288) --> for .cer ssl.SSLError: [SSL] PEM lib (_ssl.c:3309) --> for .pem

The way I see it after much debugging is that the issue is in library trying to validate the entire certificate chain, which it does not have.

Am I generating a wrong certificate type / converting it incorrectly?

velis74 commented 7 years ago

An additional remark: on the certificate generation page (right at the bottom), there's a warning:

Intermediate Certificates

To use your certificates, you must have the intermediate signing certificate in your system keychain. This is automatically installed by Xcode. However, if you need to reinstall the intermediate signing certificate click the link below:

Worldwide Developer Relations Certificate Authority

I have tried to use this certificate, by manually creating CertificateCredentials:

        cred = CertificateCredentials(os.path.join(settings.BASE_DIR, 'ScantronServer', 'ios.cer'),
                                      cert_chain=os.path.join(settings.BASE_DIR, 'ScantronServer', 'AppleWWDRCA.cer'))

but this fails before the "chain" file would be parsed because it first tries to initialise the chain from client certificate.

I also imported this certificate into my computer's certificate store (the Windows one), but that doesn't seem to have any effect.

velis74 commented 7 years ago

Another remark: this tool works with the certificate without issues.

velis74 commented 7 years ago

OK, found out what the problem was: The generated certificate has to be imported into keystore of the computer that generated the .csr. During this import, the private key is supposed to attach to the certificate. Then simply export the certificate into .p12 and finally convert to .pem

openssl pkcs12 -in /path/to/p12/certificate -out /path/to/pem/certificate/export/location -nodes -clcerts