modify spreadsheetupdater.py mTLS certificates

src/aare/daq/spreadsheetupdater.py

@@ -137,19 +137,23 @@ def main():
     while True:
         try:
             import ssl
-            # Initialize with the modern client protocol
-            context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+            import websocket
 
-            # Trust the PSI DMZ CA
+            # FORCE a clean context
+            context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
             context.load_verify_locations(cafile="/etc/ssl/certs/secrets/mx-aaredb-dmz-01_Full_Chain_CA.pem")
-
-            # Load your machine identity
             context.load_cert_chain(
                 certfile="/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.crt",
                 keyfile="/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.key"
             )
 
-            context.check_hostname = True
+            # Explicitly set the SNI hostname to match NGINX server_name
+            # This is often what's missing when NGINX says "No cert sent"
+            ssl_opt = {
+                "context": context,
+                "server_hostname": "mx-aaredb-dmz-01.psi.ch",
+                "check_hostname": True
+            }
 
             ws = websocket.WebSocketApp(
                 WS_URL,
@@ -160,11 +164,11 @@ def main():
                 on_open=on_open,
             )
 
-            print(f"[WS][INFO] Connecting to {WS_URL} using mTLS...")
-            ws.run_forever(sslopt={"context": context})
+            print(f"[WS][INFO] Connecting to {WS_URL}...")
+            ws.run_forever(sslopt=ssl_opt)
 
         except Exception as e:
-            print(f"[MAIN][ERROR] WebSocket setup failed: {e}")
+            print(f"[MAIN][ERROR] WebSocket connection failed: {e}")
 
         time.sleep(5)