[PATCH 3 of 6] sslutil: show fingerprint when cacerts validation fails
Mads Kiilerich
mads at kiilerich.com
Mon Jan 9 08:00:47 CST 2012
# HG changeset patch
# User Mads Kiilerich <mads at kiilerich.com>
# Date 1326116604 -3600
# Node ID 6ce058b7926290d410276154ffc5b0587ec56957
# Parent 360017b25242c7ac6f48ddf7f34246a8147d24b4
sslutil: show fingerprint when cacerts validation fails
diff --git a/mercurial/sslutil.py b/mercurial/sslutil.py
--- a/mercurial/sslutil.py
+++ b/mercurial/sslutil.py
@@ -110,18 +110,19 @@
self.ui.warn(_("warning: certificate for %s can't be verified "
"(Python too old)\n") % host)
return
+ peercert = sock.getpeercert(True)
+ peerfingerprint = util.sha1(peercert).hexdigest()
+ nicefingerprint = ":".join([peerfingerprint[x:x + 2]
+ for x in xrange(0, len(peerfingerprint), 2)])
if cacerts and not hostfingerprint:
msg = _verifycert(sock.getpeercert(), host)
if msg:
- raise util.Abort(_('%s certificate error: %s '
- '(use --insecure to connect '
- 'insecurely)') % (host, msg))
+ raise util.Abort(_('%s certificate error: %s') % (host, msg),
+ hint=_('configure hostfingerprint %s or use '
+ '--insecure to connect insecurely') %
+ nicefingerprint)
self.ui.debug('%s certificate successfully verified\n' % host)
else:
- peercert = sock.getpeercert(True)
- peerfingerprint = util.sha1(peercert).hexdigest()
- nicefingerprint = ":".join([peerfingerprint[x:x + 2]
- for x in xrange(0, len(peerfingerprint), 2)])
if hostfingerprint:
if peerfingerprint.lower() != \
hostfingerprint.replace(':', '').lower():
diff --git a/tests/test-https.t b/tests/test-https.t
--- a/tests/test-https.t
+++ b/tests/test-https.t
@@ -180,7 +180,8 @@
cacert mismatch
$ hg -R copy-pull pull --config web.cacerts=pub.pem https://127.0.0.1:$HGPORT/
- abort: 127.0.0.1 certificate error: certificate is for localhost (use --insecure to connect insecurely)
+ abort: 127.0.0.1 certificate error: certificate is for localhost
+ (configure hostfingerprint 91:4f:1a:ff:87:24:9c:09:b6:85:9b:88:b1:90:6d:30:75:64:91:ca or use --insecure to connect insecurely)
[255]
$ hg -R copy-pull pull --config web.cacerts=pub.pem https://127.0.0.1:$HGPORT/ --insecure
warning: 127.0.0.1 certificate with fingerprint 91:4f:1a:ff:87:24:9c:09:b6:85:9b:88:b1:90:6d:30:75:64:91:ca not verified (check hostfingerprints or web.cacerts config setting)
More information about the Mercurial-devel
mailing list