bpo-40990: Add HTTPS support to http.server.HTTPServer by remilapeyre · Pull Request #20923 · python/cpython · GitHub

https://bugs.python.org/issue40990

ssl module is optional and may not be available. The http.server and its tests should still work when ssl is not present.
You have to deal with ALPN correctly and refuse connections when ALPN is present and does not contain correct protocol indicator
keys are usually protected and wrapped with PKCS#8 PBE2
tls is technically correct but we don't use it in arguments yet
SSLSocket may raise exceptions that are not yet handled by HTTPServer
HTTPSServer should be a separate class

This should be a separate class, not an argument.

ssl support is optional, you have to wrap the import in a try/except block.

use ssl.create_default_context.

The default SSL context requires a TLS 1.3 certificate so it doesn't work with ssl_cert.pem:

ssl.SSLError: [SSL: TLSV13_ALERT_CERTIFICATE_REQUIRED] tlsv13 alert certificate required

Is this something that we want to force for a development server?

There is no such thing as a TLS 1.3 certificate. This is a TLS alert with message certificate required. Looks like the certificate does not have correct extensions to handle TLS 1.3.

You cannot use any file from test directory any way. The directory is often not installed or shipped to reduce disk space usage in containers or on small systems.

It's not a cert file, it's a cert chain file.

cert chain

It's common to have the private key and the cert chain in the same file. The key argument should be optional.

try/except ImportError

os.path.join(os.path.dirname(__file__), 'ssl_cert.pem')

Skip the test if ssl module is not supported

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

And if you don't make the requested changes, you will be put in the comfy chair!

@remilapeyre I'm happy to continue this PR if you are not able to continue it

@remilapeyre I'm happy to continue this PR if you are not able to continue it

Hi @jaswdr, I've been quite busy but should be able to finish it this week :)

spelling: purposes

closing this PR as abandoned as there's a new one up.

Add HTTPS support to http.server.HTTPServer

821b738

the-knights-who-say-ni added the CLA signed label Jun 16, 2020

bedevere-bot added the awaiting review label Jun 16, 2020

tiran requested changes Jun 17, 2020

View reviewed changes

bedevere-bot removed the awaiting review label Jun 17, 2020

bedevere-bot added the awaiting changes label Jun 17, 2020

akulakov reviewed Jun 23, 2021

View reviewed changes

ezio-melotti removed the CLA signed label Jul 13, 2022

remilapeyre mannequin mentioned this pull request Sep 26, 2023

Make http.server support SSL #85162

Closed

donbarbos mentioned this pull request Feb 3, 2025

gh-85162: Add HTTPSServer to http.server #129607

Merged

gpshead closed this Feb 3, 2025

               import socket # For gethostbyaddr()
               import socketserver
               import sys
+              import ssl

+                      """Wrap the socket in SSLSocket if TLS is enabled"""
+                      super().server_activate()
+                      if self.tls_cert and self.tls_key:
+                          context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)

+                  def __init__(self, server_address, RequestHandlerClass,
+                          bind_and_activate=True, *, tls=None):
+                      if tls is None:
+                          self.tls_cert = self.tls_key = None

+                  elif not args.tls_cert or not args.tls_key:
+                      parser.error('Both --tls-cert and --tls-key must be provided to enable TLS')
+                  else:
+                      tls = (args.tls_cert, args.tls_key)

               import html
               import http.client
               import urllib.parse
+              import ssl

		.. class:: HTTPServer(server_address, RequestHandlerClass, \
		bind_and_activate=True, *, tls=None)

		parser.add_argument('--tls-cert',
		help='Specify the path to a TLS certificate')

+                  # BaseHTTPServerTestCase.
+                  # We have to use the correct path from the folder created by regtest
+                  tls = ('../../Lib/test/ssl_cert.pem', '../../Lib/test/ssl_key.pem')

		self.assertEqual(b'', data)


		class BaseHTTPSServerTestCase(BaseTestCase):


		.. warning::

		The HTTPS support is for development and test puposes and must not be used

bpo-40990: Add HTTPS support to http.server.HTTPServer by remilapeyre · Pull Request #20923 · python/cpython · GitHub

Uh oh!

Uh oh!

bpo-40990: Add HTTPS support to http.server.HTTPServer - #20923

bpo-40990: Add HTTPS support to http.server.HTTPServer#20923remilapeyre wants to merge 1 commit intopython:mainpython/cpython:mainfrom remilapeyre:bpo-40990remilapeyre/cpython:bpo-40990Copy head branch name to clipboard

Conversation

remilapeyre commented Jun 16, 2020 • edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tiran left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bedevere-bot commented Jun 17, 2020

Uh oh!

jaswdr commented May 12, 2021

Uh oh!

remilapeyre commented May 19, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gpshead commented Feb 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

bpo-40990: Add HTTPS support to http.server.HTTPServer#20923
remilapeyre wants to merge 1 commit into
python:mainfrom
remilapeyre:bpo-40990

remilapeyre commented Jun 16, 2020 •
edited by bedevere-bot
Loading