modify tellupdater mTLS certificates

src/aare/daq/aaredb.py

@@ -46,14 +46,19 @@ class AareWrapper:
     ):
         configuration = aareDB.Configuration(host=host)
 
-
-        # Point this to the CA bundle that signed the server's certificate
+        # --- mTLS & SSL CONFIGURATION ---
+        # 1. Trust the Server (CA that signed mx-aaredb-dmz-01)
         configuration.verify_ssl = True
         configuration.ssl_ca_cert = "/etc/ssl/certs/secrets/mx-aaredb-dmz-01_Full_Chain_CA.pem"
-        configuration.cert_file =  "/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.crt"
-        configuration.key_file = "/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.key"
 
+        # 2. Present Machine Identity (The certs that worked in curl)
+        configuration.cert_file = "/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.crt"
+        configuration.key_file  = "/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.key"
+
+        # 3. Initialize the Client with this config
         self.client = aareDB.ApiClient(configuration)
+
+        # Identity Forwarding (Optional now that mTLS is active, but safe to keep)
         self.client.default_headers["X-Shared-Password"] = os.getenv("AAREDB_SHARED_PASSWORD")
         self.__host = host
         self.__tell_api = aareDB.TellsRunnerApi(self.client)

src/aare/daq/tellupdater.py

@@ -167,22 +167,28 @@ def main():
     sse_thread = threading.Thread(target=listen_to_sse, daemon=True)
     sse_thread.start()
 
-    # Main thread runs websocket client loop
+    """
+        Main function to initiate WebSocket connection with mTLS.
+        """
     while True:
         try:
             import ssl
-            # 1. Create a proper SSL Context
+            # 1. Create a modern SSL Context for a TLS Client
             context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
 
-            # 2. Load the CA to trust the server
+            # 2. Load the CA to verify the NGINX server's identity
             context.load_verify_locations(cafile="/etc/ssl/certs/secrets/mx-aaredb-dmz-01_Full_Chain_CA.pem")
 
-            # 3. Load the Client Certificate (mTLS)
+            # 3. Load the Client Certificate and Key (mTLS)
+            # Using the 'dmz-01' paths that worked in your curl
             context.load_cert_chain(
                 certfile="/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.crt",
                 keyfile="/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.key"
             )
 
+            # Optional: Ensure hostname matching is active (recommended)
+            context.check_hostname = True
+
             ws = websocket.WebSocketApp(
                 WS_URL,
                 header=WS_HEADERS,
@@ -192,13 +198,14 @@ def main():
                 on_open=on_open,
             )
 
-            # 4. Pass the context object to run_forever
+            # 4. Pass the context directly via sslopt
+            print(f"[WS][INFO] Connecting to {WS_URL} using mTLS...")
             ws.run_forever(sslopt={"context": context})
 
         except Exception as e:
-            print(f"[MAIN][ERROR] ws.run_forever() crashed with: {e}")
+            print(f"[MAIN][ERROR] WebSocket connection failed: {e}")
 
-        print("[WS][INFO] WebSocket connection lost. Reconnecting in 5 seconds...")
+        print("[WS][INFO] Reconnecting in 5 seconds...")
         time.sleep(5)
 
 if __name__ == "__main__":