TLS cert rotation: restructure server methods to improve error messages

This commit is contained in:
Alberto Sottile 2019-02-19 10:18:27 +01:00
parent 8b8e45a4d6
commit e8d797550b

View File

@ -208,15 +208,6 @@ class SyncFactory(Factory):
watcher.setPlaylistIndex(room.getName(), room.getPlaylistIndex()) watcher.setPlaylistIndex(room.getName(), room.getPlaylistIndex())
def _allowTLSconnections(self, path): def _allowTLSconnections(self, path):
self.options = self._createTLSContextFactory(path)
if self.options is not None:
self.serverAcceptsTLS = True
else:
self.serverAcceptsTLS = False
self.lastEditCertTime = None
print("TLS support is not enabled.")
def _createTLSContextFactory(self, path):
try: try:
privKey = open(path+'/privkey.pem', 'rt').read() privKey = open(path+'/privkey.pem', 'rt').read()
certif = open(path+'/cert.pem', 'rt').read() certif = open(path+'/cert.pem', 'rt').read()
@ -236,22 +227,26 @@ class SyncFactory(Factory):
contextFactory = ssl.CertificateOptions(privateKey=privKeyPySSL, certificate=certifPySSL, contextFactory = ssl.CertificateOptions(privateKey=privKeyPySSL, certificate=certifPySSL,
extraCertChain=chainPySSL, acceptableCiphers=accCiphers, extraCertChain=chainPySSL, acceptableCiphers=accCiphers,
raiseMinimumTo=ssl.TLSVersion.TLSv1_2) raiseMinimumTo=ssl.TLSVersion.TLSv1_2)
except Exception as e:
print(e)
contextFactory = None
return contextFactory self.options = contextFactory
self.serverAcceptsTLS = True
except Exception as e:
self.options = None
self.serverAcceptsTLS = False
self.lastEditCertTime = None
print("Error while loading the TLS certificates.")
print(e)
print("TLS support is not enabled.")
def checkLastEditCertTime(self): def checkLastEditCertTime(self):
try: try:
outTime = os.path.getmtime(self.certPath+'/cert.pem') outTime = os.path.getmtime(self.certPath+'/cert.pem')
except: except:
outTime = None outTime = None
return outTime return outTime
def updateTLSContextFactory(self): def updateTLSContextFactory(self):
self.options = self._createTLSContextFactory(self.certPath) self._allowTLSconnections(self.certPath)