From 25163a5b4dfc17c27d185247af510f5de600ddd7 Mon Sep 17 00:00:00 2001
From: GotthardG <51994228+GotthardG@users.noreply.github.com>
Date: Wed, 25 Mar 2026 14:10:17 +0100
Subject: [PATCH] modify spreadsheetupdater.py mTLS certificates

---
 src/aare/daq/spreadsheetupdater.py | 41 +++++++++++++++++-------------
 1 file changed, 24 insertions(+), 17 deletions(-)

diff --git a/src/aare/daq/spreadsheetupdater.py b/src/aare/daq/spreadsheetupdater.py
index c1cd28af..204a8102 100644
--- a/src/aare/daq/spreadsheetupdater.py
+++ b/src/aare/daq/spreadsheetupdater.py
@@ -2,6 +2,7 @@ import os
 import json
 import websocket
 import time
+import ssl
 from aareDB.models import PuckWithTellPosition
 from aare.common.models import SampleShortInfoList, SampleShortInfo, DewarAddress
 from config import BeamlineConfig
@@ -136,6 +137,25 @@ def main():
     """
     while True:
         try:
+            # 1. Create the Context
+            # Use PROTOCOL_TLS_CLIENT as it's the modern standard
+            context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+
+            # 2. Load the Server Trust (CA)
+            context.load_verify_locations(cafile="/etc/ssl/certs/secrets/mx-aaredb-dmz-01_Full_Chain_CA.pem")
+
+            # 3. Load the Client Identity (The key/cert that worked in curl)
+            context.load_cert_chain(
+                certfile="/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.crt",
+                keyfile="/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.key"
+            )
+
+            # 4. Critical: If NGINX is using a self-signed or internal CA,
+            # and the hostname doesn't perfectly match the Cert SN/SAN,
+            # you might need to toggle this, but keep it True for now.
+            context.check_hostname = True
+            context.verify_mode = ssl.CERT_REQUIRED
+
             ws = websocket.WebSocketApp(
                 WS_URL,
                 header=WS_HEADERS,
@@ -145,26 +165,13 @@ def main():
                 on_open=on_open,
             )
 
-            # --- mTLS CONFIGURATION ---
-            import ssl
-            ssl_settings = {
-                # This is the "Machine Certificate" NGINX will verify
-                "certfile": "/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_aaredb-dmz-01.crt",
-                "keyfile": "/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_aaredb-dmz-01.key",
+            # 5. Connect using ONLY the context
+            # We remove other keys to ensure websocket-client uses our pre-configured context
+            ws.run_forever(sslopt={"context": context})
 
-                # This allows Python to trust the Server (NGINX/PSI)
-                "ca_certs": "/etc/ssl/certs/secrets/mx-aaredb-dmz-01_Full_Chain_CA.pem",
-
-                # Standard TLS requirements
-                "cert_reqs": ssl.CERT_REQUIRED,
-                "check_hostname": True,
-            }
-
-            ws.run_forever(sslopt=ssl_settings)
         except Exception as e:
-            print(f"[MAIN][ERROR] ws.run_forever() crashed with: {e}")
+            print(f"[MAIN][ERROR] WebSocket setup failed: {e}")
 
-        print("[WS][INFO] WebSocket connection lost. Reconnecting in 5 seconds...")
         time.sleep(5)
 
 if __name__ == "__main__":