Pyopenssl, twisted: server's certificate chain is incomplete

twisted.internet.ssl.CertificateOptions : API documentation :

extraCertChain List of certificates that complete your verification chain if the certificate authority that signed your certificate isn't widely supported. Do not add certificate to it. (type: list of OpenSSL.crypto.X509)

Apparently, the certificate option can only load the end leaf certificate (cert.pem). You should add the chain (chain.pem) manually.

So this should work, I think:

from OpenSSL import crypto

from twisted.internet import ssl

privkey=open('/etc/letsencrypt/live/mindolia.com/privkey.pem', 'rt').read()
certif=open('/etc/letsencrypt/live/mindolia.com/cert.pem', 'rt').read()
chain=open('/etc/letsencrypt/live/mindolia.com/chain.pem', 'rt').read()

privkeypyssl=crypto.load_privatekey(crypto.FILETYPE_PEM,privkey)
certifpyssl=crypto.load_certificate(crypto.FILETYPE_PEM,certif)
chainpyssl=crypto.load_certificate(crypto.FILETYPE_PEM,chain)
contextFactory=ssl.CertificateOptions(privateKey=privkeypyssl,certificate=certifpyssl,extraCertChain=chainpyssl)

Good luck!

2 Likes