From d98769d67ca34b5d976b15ac8cc32524484c9ddf Mon Sep 17 00:00:00 2001 From: GotthardG <51994228+GotthardG@users.noreply.github.com> Date: Wed, 25 Mar 2026 14:32:43 +0100 Subject: [PATCH] modify spreadsheetupdater.py mTLS certificates --- src/aare/daq/spreadsheetupdater.py | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/src/aare/daq/spreadsheetupdater.py b/src/aare/daq/spreadsheetupdater.py index 8f4b1f06..5cad17fb 100644 --- a/src/aare/daq/spreadsheetupdater.py +++ b/src/aare/daq/spreadsheetupdater.py @@ -137,19 +137,23 @@ def main(): while True: try: import ssl - # Initialize with the modern client protocol - context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) + import websocket - # Trust the PSI DMZ CA + # FORCE a clean context + context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH) context.load_verify_locations(cafile="/etc/ssl/certs/secrets/mx-aaredb-dmz-01_Full_Chain_CA.pem") - - # Load your machine identity context.load_cert_chain( certfile="/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.crt", keyfile="/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.key" ) - context.check_hostname = True + # Explicitly set the SNI hostname to match NGINX server_name + # This is often what's missing when NGINX says "No cert sent" + ssl_opt = { + "context": context, + "server_hostname": "mx-aaredb-dmz-01.psi.ch", + "check_hostname": True + } ws = websocket.WebSocketApp( WS_URL, @@ -160,11 +164,11 @@ def main(): on_open=on_open, ) - print(f"[WS][INFO] Connecting to {WS_URL} using mTLS...") - ws.run_forever(sslopt={"context": context}) + print(f"[WS][INFO] Connecting to {WS_URL}...") + ws.run_forever(sslopt=ssl_opt) except Exception as e: - print(f"[MAIN][ERROR] WebSocket setup failed: {e}") + print(f"[MAIN][ERROR] WebSocket connection failed: {e}") time.sleep(5)