python - 花：设置 SSL 'verify_mode'

Question

使用： Flower 0.9.5（安装 Tornado 6.0.4）、Celery 4.4.6、Python 3.7

开始Flower时

celery -A myProj flower

一切都按预期工作。花服务于http://localhost:5555。

开始Flower时

celery -A myProj flower --keyfile=/home/me/cert/key.pem --certfile=/home/me/cert/cert.pem

它服务于https://localhost:5555但在尝试访问它时，Chrome 状态ERR_CONNECTION_RESET和Flower日志

2020-09-16 17:19:37,421 - tornado.general - ERROR - Uncaught exception, closing connection.
Traceback (most recent call last):
  File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 711, in _handle_events
      self._handle_read()
  File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 1498, in _handle_read
      self._do_ssl_handshake()
  File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 1458, in _do_ssl_handshake
        if not self._verify_cert(self.socket.getpeercert()):
  File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 1481, in _verify_cert
      assert verify_mode in (ssl.CERT_NONE, ssl.CERT_REQUIRED, ssl.CERT_OPTIONAL)
UnboundLocalError: local variable 'verify_mode' referenced before assignment
2020-09-16 17:19:37,423 - asyncio - ERROR - Exception in callback None()
handle: <Handle cancelled>
Traceback (most recent call last):
    File "/home/me/python/lib/python3.7/asyncio/events.py", line 88, in _run
        self._context.run(self._callback, *self._args)
    File "/home/me/.env/lib/python3.7/site-packages/tornado/platform/asyncio.py", line 139, in _handle_events
        handler_func(fileobj, events)
    File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 711, in _handle_events
        self._handle_read()
    File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 1498, in _handle_read
        self._do_ssl_handshake()
    File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 1458, in _do_ssl_handshake
        if not self._verify_cert(self.socket.getpeercert()):
    File "/home/me/.env/lib/python/site-packages/tornado/iostream.py", line 1481, in _verify_cert
        assert verify_mode in (ssl.CERT_NONE, ssl.CERT_REQUIRED, ssl.CERT_OPTIONAL)
UnboundLocalError: local variable 'verify_mode' referenced before assignment

注意：运行 Flower 时一切正常

celery -B brokerURL flower --keyfile=/home/me/cert/key.pem --certfile=/home/me/cert/cert.pem

里面有/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py：

def _verify_cert(self, peercert: Any) -> bool:
    """Returns ``True`` if peercert is valid according to the configured
    validation mode and hostname.

    The ssl handshake already tested the certificate for a valid
    CA signature; the only thing that remains is to check
    the hostname.
    """   
    if isinstance(self._ssl_options, dict):
        verify_mode = self._ssl_options.get("cert_reqs", ssl.CERT_NONE)
    elif isinstance(self._ssl_options, ssl.SSLContext):
        verify_mode = self._ssl_options.verify_mode
    assert verify_mode in (ssl.CERT_NONE, ssl.CERT_REQUIRED, ssl.CERT_OPTIONAL) # LINE 1481
    if verify_mode == ssl.CERT_NONE or self._server_hostname is None:
        return True
    cert = self.socket.getpeercert()
    if cert is None and verify_mode == ssl.CERT_REQUIRED:
        gen_log.warning("No SSL certificate given")
        return False
    try:
        ssl.match_hostname(peercert, self._server_hostname)
    except ssl.CertificateError as e:
        gen_log.warning("Invalid SSL certificate: %s" % e)
        return False
    else:
        return True

我怎样verify_mode = ssl.CERT_REQUIRED才能tornado通过Flower？在里面手动设置它_verify_cert确实有效。

标签： pythoncelerytornadoflower