Secure XMLRPC Server / PEM Files

[Daniel Crespo]

Hello everybody,

I'm trying to implement a secure xmlrpc server with basis on
http://aspn.activestate.com/ASPN/Coo.../Recipe/496786 recipe.
The thing that I'm concerned about is how can I get/create rapidly the
..pem files (the key and cert).

Any help?

Thanks

Daniel

[Laszlo Nagy]

Re: Secure XMLRPC Server / PEM Files

Daniel Crespo írta:

Hello everybody,
>
I'm trying to implement a secure xmlrpc server with basis on
http://aspn.activestate.com/ASPN/Coo.../Recipe/496786 recipe.
The thing that I'm concerned about is how can I get/create rapidly the
.pem files (the key and cert).
>
Any help?
>

Hello,

If you have OpenSSL installed, you can do the following:

1. Create a new directory and place the two attached files in it
(openssl.cnf and generate.sh)
2. Run "chmod +x gen_cert.sh ; ./gen_cert.sh yourdomain.com"
3. Answer to the questions. Be sure that your common name is your domain
name.

Then you will find PEM and DER formatted files. You should use the
unencrypted key.pem and cert.pem files.

Let me know if you have any problem.

Best,

Laszlo


#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#

RANDFILE = .rnd

############### ############### ############### ############### ########
[ ca ]
default_ca = CA_default # The default ca section

############### ############### ############### ############### ########
[ CA_default ]

dir = demoCA # Where everything is kept
certs = $dir\certs # Where the issued certs are kept
crl_dir = $dir\crl # Where the issued crl are kept
database = $dir\index.txt # database index file.
new_certs_dir = $dir\newcerts # default place for new certs.

certificate = $dir\cacert.pem # The CA certificate
serial = $dir\serial # The current serial number
crl = $dir\crl.pem # The current CRL
private_key = $dir\private\ca key.pem # The private key
RANDFILE = $dir\private\pr ivate.rnd # private random number file

x509_extensions = x509v3_extensio ns # The extentions to add to the cert
default_days = 365 # how long to certify for
default_crl_day s= 30 # how long before next CRL
default_md = md5 # which md to use.
preserve = no # keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_match

# For the CA policy
[ policy_match ]
countryName = optional
stateOrProvince Name = optional
organizationNam e = optional
organizationalU nitName = optional
commonName = supplied
emailAddress = optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = optional
stateOrProvince Name = optional
localityName = optional
organizationNam e = optional
organizationalU nitName = optional
commonName = supplied
emailAddress = optional

############### ############### ############### ############### ########
[ req ]
default_bits = 1024
default_keyfile = privkey.pem
distinguished_n ame = req_distinguish ed_name
attributes = req_attributes

[ req_distinguish ed_name ]
countryName = Country Name (2 letter code)
countryName_min = 2
countryName_max = 2

stateOrProvince Name = State or Province Name (full name)

localityName = Locality Name (eg, city)

0.organizationN ame = Organization Name (eg, company)

organizationalU nitName = Organizational Unit Name (eg, section)

commonName = Common Name (eg, your website's domain name)
commonName_max = 64

emailAddress = Email Address
emailAddress_ma x = 40

[ req_attributes ]
challengePasswo rd = A challenge password
challengePasswo rd_min = 4
challengePasswo rd_max = 20

[ x509v3_extensio ns ]

# under ASN.1, the 0 bit would be encoded as 80
nsCertType = 0x40

#nsBaseUrl
#nsRevocationUr l
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerNam e
#nsCertSequence
#nsCertExt
#nsDataType


openssl req -config openssl.cnf -new -out my-server.csr
openssl rsa -in privkey.pem -out my-server.key
openssl x509 -in my-server.csr -out my-server.cert -req -signkey my-server.key -days 1500
openssl x509 -in my-server.cert -out my-server.der.crt -outform DER

mv my-server.csr $1.csr
mv my-server.cert $1.cert.pem
mv my-server.key $1.key.pem
mv my-server.der.crt $1.der.crt

rm privkey.pem
rm -f .rnd

[Laszlo Nagy]

Re: Secure XMLRPC Server / PEM Files

>
>
If you have OpenSSL installed, you can do the following:
>
1. Create a new directory and place the two attached files in it
(openssl.cnf and generate.sh)
2. Run "chmod +x gen_cert.sh ; ./gen_cert.sh yourdomain.com"

I meant generate.sh instead of gen_cert.sh.

Under windows it won't work. But you can easily convert generate.sh into
generate.bat. :-)

Laszlo

[Daniel Crespo]

Re: Secure XMLRPC Server / PEM Files


Laszlo Nagy wrote:

If you have OpenSSL installed, you can do the following:

1. Create a new directory and place the two attached files in it
(openssl.cnf and generate.sh)
2. Run "chmod +x gen_cert.sh ; ./gen_cert.sh yourdomain.com"

I meant generate.sh instead of gen_cert.sh.
>
Under windows it won't work. But you can easily convert generate.sh into
generate.bat. :-)
>
Laszlo

I'm on Windows...
I'm also trying to get OpenSSL installed, but I need compilers and all
that stuff. Before getting involved in that, do you know of a faster
way to have it installed?

Thanks

Daniel

[Laszlo Nagy]

Re: Secure XMLRPC Server / PEM Files

Daniel Crespo írta:

Laszlo Nagy wrote:
>

>>If you have OpenSSL installed, you can do the following:
>>>
>>1. Create a new directory and place the two attached files in it
>>(openssl.cn f and generate.sh)
>>2. Run "chmod +x gen_cert.sh ; ./gen_cert.sh yourdomain.com"
>>>

>I meant generate.sh instead of gen_cert.sh.
>>
>Under windows it won't work. But you can easily convert generate.sh into
>generate.bat . :-)
>>
> Laszlo
>>

>
I'm on Windows...
I'm also trying to get OpenSSL installed, but I need compilers and all
that stuff. Before getting involved in that, do you know of a faster
way to have it installed?
>

Yes. Read the recipe once more. Especially, the first document string in
that program. ;-)

"""For windows users: http://webcleaner.sour ceforge.net/pyOpenSSL-0.6.win32-py2.4.exe"""

(You will also need the openssl binaries for windows, but they are very easy to find.)


Laszlo

[Daniel Crespo]

Re: Secure XMLRPC Server / PEM Files

Hi Laszlo,

I have read that. It's the wrapper for the usage of OpenSSL, so I have
to install it. I have downloaded the Borland C++ compiler, and I'm
doing so right now, but I'm not getting good results yet.

I tried to import OpenSSL, it seems to work.

Now, I want to try the code I submited earlier, but I need the .pem
files. You told me to change generate.sh to generate.bat. How can I do
that?

Many thanks,

Daniel


Laszlo Nagy wrote:

Daniel Crespo írta:

Laszlo Nagy wrote:

>If you have OpenSSL installed, you can do the following:
>>
>1. Create a new directory and place the two attached files in it
>(openssl.cnf and generate.sh)
>2. Run "chmod +x gen_cert.sh ; ./gen_cert.sh yourdomain.com"
>>
I meant generate.sh instead of gen_cert.sh.
>
Under windows it won't work. But you can easily convert generate.sh into
generate.bat. :-)
>
Laszlo
>

I'm on Windows...
I'm also trying to get OpenSSL installed, but I need compilers and all
that stuff. Before getting involved in that, do you know of a faster
way to have it installed?

Yes. Read the recipe once more. Especially, the first document string in
that program. ;-)
>
"""For windows users: http://webcleaner.sour ceforge.net/pyOpenSSL-0.6.win32-py2.4.exe"""
>
(You will also need the openssl binaries for windows, but they are very easy to find.)


Laszlo

[Laszlo Nagy]

Re: Secure XMLRPC Server / PEM Files

Daniel Crespo írta:

Hi Laszlo,
>
I have read that. It's the wrapper for the usage of OpenSSL, so I have
to install it. I have downloaded the Borland C++ compiler, and I'm
doing so right now, but I'm not getting good results yet.
>

You do not need any compiler. You just need to install the openssl
binaries and the wrapper.

I tried to import OpenSSL, it seems to work.
>

Great.

Now, I want to try the code I submited earlier, but I need the .pem
files. You told me to change generate.sh to generate.bat. How can I do
that?
>

Basically, use "del" instead of "rm" and use "move" instead of "mv". Use
<yourdomain.com instead of $1. Moreover, openssl.exe must be on your
path. That's all.

Try this (untested):

openssl req -config openssl.cnf -new -out my-server.csr
openssl rsa -in privkey.pem -out my-server.key
openssl x509 -in my-server.csr -out my-server.cert -req -signkey my-server.key -days 1500
openssl x509 -in my-server.cert -out my-server.der.crt -outform DER

move my-server.csr yourdomain.com. csr
move my-server.cert yourdomain.com. cert.pem
move my-server.key yourdomain.com. key.pem
move my-server.der.crt yourdomain.com. der.crt

del privkey.pem


Laszlo

[Daniel Crespo]

Re: Secure XMLRPC Server / PEM Files

Hi Laszlo,

Try this (untested):
>
openssl req -config openssl.cnf -new -out my-server.csr
openssl rsa -in privkey.pem -out my-server.key

Here's what I tried:

C:\OpenSSL\bin> openssl req -config openssl.cnf -new -out my-server.csr
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
..............+ +++++
............... ............... .............++ ++++
writing new private key to 'privkey.pem'
Enter PEM pass phrase: PASSWORD
Verifying - Enter PEM pass phrase: PASSWORD
-----
You are about to be asked to enter information that will be
incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a
DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:DF
Locality Name (eg, city) []:CITY
Organization Name (eg, company) [Internet Widgits Pty Ltd]:COMPANY
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:PASSWORD
An optional company name []:COMPANY

C:\OpenSSL\bin> openssl rsa -in privkey.pem -out my-server.key
Enter pass phrase for privkey.pem: PASSWORD
unable to load Private Key
3688:error:0606 5064:digital envelope routines:EVP_De cryptFinal_ex:b ad
decrypt:.\
crypto\evp\evp_ enc.c:461:
3688:error:0906 A065:PEM routines:PEM_do _header:bad
decrypt:.\crypt o\pem\pem_lib.
c:425:

Any help?

Thanks in advance

Daniel

[Daniel Crespo]

Resolved: Secure XMLRPC Server / PEM Files

Hi everybody,

For those who want to implement a SecureXMLRPCSer ver (HTTPS), here is
what I finally found in the Internet. I will summarise everything for
the people like me that need extra help just to get running an HTTPS
XMLRPC Server :)

This summary is not intended to be exhaustive, but just to give the
minimum steps to get running our server.

Here's the code (taken from

http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/496786):

"""SecureXMLRPC Server.py - simple XML RPC server supporting SSL.

Based on this article:

http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/81549

For windows users:

http://webcleaner.sourceforge.net/pyOpenSSL-0.6.win32-py2.4.exe

"""

# Configure below
LISTEN_HOST='12 7.0.0.1' # You should not use '' here, unless you have a
real FQDN.
LISTEN_PORT=443

KEYFILE='your.k ey.pem' # Replace with your PEM formatted key file
CERTFILE=your.c ert.pem' # Replace with your PEM formatted certificate
file
# Configure above

import SocketServer
import BaseHTTPServer
import SimpleHTTPServe r
import SimpleXMLRPCSer ver

import socket, os
from OpenSSL import SSL

class
SecureXMLRPCSer ver(BaseHTTPSer ver.HTTPServer, SimpleXMLRPCSer ver.SimpleXMLRP CDispatcher):
def __init__(self, server_address, HandlerClass, logRequests=Tru e):
"""Secure XML-RPC server.

It it very similar to SimpleXMLRPCSer ver but it uses HTTPS for
transporting XML data.
"""
self.logRequest s = logRequests

SimpleXMLRPCSer ver.SimpleXMLRP CDispatcher.__i nit__(self)
SocketServer.Ba seServer.__init __(self, server_address,
HandlerClass)
ctx = SSL.Context(SSL .SSLv23_METHOD)
ctx.use_private key_file (KEYFILE)
ctx.use_certifi cate_file(CERTF ILE)
self.socket = SSL.Connection( ctx,
socket.socket(s elf.address_fam ily,

self.socket_typ e))
self.server_bin d()
self.server_act ivate()

class
SecureXMLRpcReq uestHandler(Sim pleXMLRPCServer .SimpleXMLRPCRe questHandler):
"""Secure XML-RPC request handler class.

It it very similar to SimpleXMLRPCReq uestHandler but it uses HTTPS
for transporting XML data.
"""
def setup(self):
self.connection = self.request
self.rfile = socket._fileobj ect(self.reques t, "rb",
self.rbufsize)
self.wfile = socket._fileobj ect(self.reques t, "wb",
self.wbufsize)

def do_POST(self):
"""Handles the HTTPS POST request.

It was copied out from SimpleXMLRPCSer ver.py and modified to
shutdown the socket cleanly.
"""

try:
# get arguments
data = self.rfile.read (int(self.heade rs["content-length"]))
# In previous versions of SimpleXMLRPCSer ver, _dispatch
# could be overridden in this class, instead of in
# SimpleXMLRPCDis patcher. To maintain backwards
compatibility,
# check to see if a subclass implements _dispatch and
dispatch
# using that method if present.
response = self.server._ma rshaled_dispatc h(
data, getattr(self, '_dispatch', None)
)
except: # This should only happen if the module is buggy
# internal error, report as HTTP server error
self.send_respo nse(500)
self.end_header s()
else:
# got a valid XML RPC response
self.send_respo nse(200)
self.send_heade r("Content-type", "text/xml")
self.send_heade r("Content-length", str(len(respons e)))
self.end_header s()
self.wfile.writ e(response)

# shut down the connection
self.wfile.flus h()
self.connection .shutdown() # Modified here!

def test(HandlerCla ss = SecureXMLRpcReq uestHandler,Ser verClass =
SecureXMLRPCSer ver):
"""Test xml rpc over https server"""
class xmlrpc_register s:
def __init__(self):
import string
self.python_str ing = string

def add(self, x, y):
return x + y

def mult(self,x,y):
return x*y

def div(self,x,y):
return x//y

server_address = (LISTEN_HOST, LISTEN_PORT) # (address, port)
server = ServerClass(ser ver_address, HandlerClass)
server.register _instance(xmlrp c_registers())
sa = server.socket.g etsockname()
print "Serving HTTPS on", sa[0], "port", sa[1]
server.serve_fo rever()


if __name__ == '__main__':
test()


# Here is the client for testing:
import xmlrpclib

server = xmlrpclib.Serve r('https://localhost:443')
print server.add(1,2)
print server.div(10,4 )

------------------------------------------------------------

Now, here are the steps to get running it:

1. Install OpenSSL from www.openssl.org. If you are using Windows, go
to http://www.slproweb.com/products/Win32OpenSSL.html and install the
binary.

2. In order to have our required .pem files, put the following in a
batch file (.sh or .bat) and run it from the directory where openssl is
(unless it is set as an environment variable):

openssl req -config openssl.cnf -new -out my-server.csr
openssl rsa -in privkey.pem -out my-server.key
openssl x509 -in my-server.csr -out my-server.cert -req -signkey
my-server.key -days 1500
openssl x509 -in my-server.cert -out my-server.der.crt -outform DER

mv my-server.csr $1.csr
mv my-server.cert $1.cert.pem
mv my-server.key $1.key.pem
mv my-server.der.crt $1.der.crt

rm privkey.pem
rm -f .rnd

(for .bat, just ignore the last line and use "move" instead of "mv",
"del" instead of "rm" and "yourdomain.com " instead of "$1")

It will generate 4 files. Take the two with .pem extension, and put it
on the same directory as the SecureXMLRPCSer ver code.

3. In order for get running the code, install pyOpenSSL available at
http://pyopenssl.sourceforge.net/. For Windows you may prefer

http://webcleaner.sourceforge.net/pyOpenSSL-0.6.win32-py2.4.exe

That's it.

Special thanks to Laszlo Nagy

Enjoy!

Daniel Crespo