Connection refused when trying to connect via SSL

[jafber]

On my VPS, I have a simple flask server using SSL:

import flask
import flask_socketio

app = flask.Flask(__name__)
socketio = flask_socketio.SocketIO(logger=True, engineio_logger=True)
socketio.init_app(app)

@socketio.on('connect')
def on_connect():
	print('connected')

@app.route('/')
def main():
	return 'Hello World'

app.run(host='0.0.0.0', ssl_context=('namecom.crt', 'namecom.key'))

It is not behind a firewall. Opening https;//[my domain]:5000/ in the browser returns a friendly 'Hello World'. However, the server does not log anything and I get my Connection refused by the server when trying to connect via SocketIO:

import socketio

sio = socketio.Client()
sio.connect('https://[my domain]:5000/')

It works when I tell the client not to check any certificates (ssl_verify=False), but I'd rather not have that in production. But specifying my certificate like that:

import socketio
import requests

with requests.Session() as sess:
	sess.verify = 'namecom.crt'
	sio = socketio.Client(http_session=sess)
	sio.connect('https://[my domain]:5000/')

also leads to a refused connection :(

This seems similar to this issue, but it only says that the problem was fixed in an update.

[miguelgrinberg]

I'm sorry but I don't understand. Are you using a self-signed certificate in your server? If you are, how do you expect this certificate to be verified by your clients?

[jafber]

Thank you for your quick reply! I generated the key and certificate signing request myself using openssh, the certificate however is signed by name.com. My browser recognizes it just fine without any manual configuration:

The python-socketio documentation says that http-session is

an initialized requests.Session object to be used when sending requests to the server. Use it if you need to add special client options such as proxy servers, SSL certificates, etc.

So I copied the ssl certificate over to my client machine and used its filename as the sess.verify attribute, which, as far as I understand, makes the client recognize it as a valid certificate.

[miguelgrinberg]

The reason this package accepts an initialized HTTP Session object from the Requests package is so that you have complete freedom to add any options that you need. Have you tested sending requests with this package and verified that are being validated? That's what you need to fix.

So I copied the ssl certificate over to my client machine

This sounds wrong. This is a server certificate, correct? It has nothing to do in the client. The client needs to be configured to trust certificates from the CA that you are using. You may need to review the SSL options for the requests package.

[jafber]

I checked on https://whatsmychaincert.com/ and discovered my server's SSL certificate was misconfigured (oops 😬). As you suggested, one actually has to specify the whole certificate chain including the CA. My browser simply seems to do this automatically and ignore the error. Now I can connect just fine even without specifying the chain using the requests.Session.