Part 1 of certificate validation: Require that the cert be signed by a CA.

diff --git a/tornado/iostream.py b/tornado/iostream.py
index 0d19af358ebe88a9b9401ea6b2a742492ffe4b6c..3cbd9b65e0079be48e57242316a19dcd08811c0b 100644 (file)
--- a/tornado/iostream.py
+++ b/tornado/iostream.py
@@ -382,6 +382,12 @@ class SSLIOStream(IOStream):
     wrapped when IOStream.connect is finished.
     """
     def __init__(self, *args, **kwargs):
+        """Creates an SSLIOStream.
+
+        If a dictionary is provided as keyword argument ssl_options,
+        it will be used as additional keyword arguments to ssl.wrap_socket.
+        """
+        self._ssl_options = kwargs.pop('ssl_options', {})
         super(SSLIOStream, self).__init__(*args, **kwargs)
         self._ssl_accepting = True
 
@@ -423,9 +429,9 @@ class SSLIOStream(IOStream):
         super(SSLIOStream, self)._handle_write()
 
     def _handle_connect(self):
-        # TODO(bdarnell): cert verification, etc
         self.socket = ssl.wrap_socket(self.socket,
-                                      do_handshake_on_connect=False)
+                                      do_handshake_on_connect=False,
+                                      **self._ssl_options)
         # Don't call the superclass's _handle_connect (which is responsible
         # for telling the application that the connection is complete)
         # until we've completed the SSL handshake (so certificates are

diff --git a/tornado/simple_httpclient.py b/tornado/simple_httpclient.py
index 8fa4e7e28f19a9e33dbf7fba7b9b2c7f2d5d5008..c23def6cf502f205cb8e33ad6b402c0d77d8b619 100644 (file)
--- a/tornado/simple_httpclient.py
+++ b/tornado/simple_httpclient.py
@@ -13,6 +13,7 @@ import contextlib
 import errno
 import functools
 import logging
+import os.path
 import re
 import socket
 import time
@@ -142,9 +143,13 @@ class _HTTPConnection(object):
                 host = self.client.hostname_mapping.get(host, host)
 
             if parsed.scheme == "https":
-                # TODO: cert verification, etc
+                ssl_options = dict(
+                    cert_reqs=ssl.CERT_REQUIRED,
+                    ca_certs=os.path.dirname(__file__) + '/ca-certificates.crt',
+                    )
                 self.stream = SSLIOStream(socket.socket(),
-                                          io_loop=self.io_loop)
+                                          io_loop=self.io_loop,
+                                          ssl_options=ssl_options)
             else:
                 self.stream = IOStream(socket.socket(),
                                        io_loop=self.io_loop)