Introduction to `service-identity`

The service-identity module is a critical tool that assists in verifying the identity of servers and clients, ensuring the authenticity and security of API interactions. Using this robust tool, developers can protect against man-in-the-middle attacks by validating server certificates against expected host identities.

Core APIs and Explanations

Here are some of the pivotal APIs provided by the service-identity module, complete with code snippets to showcase their implementation.

1. ServiceIdentity Creation

Initializes the `service-identity` components and bindings.

      from service_identity import Certificate, DNS_ID, SRV_ID

      cert = Certificate()
      dns_id = DNS_ID("example.com")
      srv_id = SRV_ID("example.com", "http", "example_service")
    

2. Verifying Certificate Identity

Verify the provided certificate against the expected identities.

      from service_identity import verify_certificate

      cert_to_verify = get_certificate_from_some_source()
      verify_certificate(cert_to_verify, [dns_id, srv_id])
    

3. Setting Up Context

Creating a context with trust anchors to validate server certificates.

      import ssl
      from service_identity import create_context

      context = create_context()
      context.load_verify_locations("path/to/ca_bundle")
    

App Example Using `service-identity`

Here’s a practical example demonstrating how to integrate `service-identity` within a simple client-server application.

Server

      from http.server import HTTPServer, BaseHTTPRequestHandler
      import ssl

      class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):
          def do_GET(self):
              self.send_response(200)
              self.end_headers()
              self.wfile.write(b'Hello, world!')

      httpd = HTTPServer(('localhost', 4443), SimpleHTTPRequestHandler)
      httpd.socket = ssl.wrap_socket(httpd.socket,
                                     server_side=True,
                                     certfile='path/to/server.pem',
                                     keyfile='path/to/key.pem',
                                     ssl_version=ssl.PROTOCOL_TLS)

      httpd.serve_forever()
    

Client

      import ssl
      import urllib.request
      from service_identity import verify_certificate, DNS_ID

      context = ssl.create_default_context(cafile='path/to/ca_bundle')
      
      with urllib.request.urlopen('https://localhost:4443', context=context) as response:
          cert = response.fp.connection.sock.getpeercert(binary_form=True)
          verify_certificate(cert, [DNS_ID("localhost")])
          print(response.read())
    

By leveraging `service-identity`, the above example ensures secure communication between the client and server, with robust certificate verification mechanisms in place.

Hash: 5aed5e4192d498a2e22de31eb9f7c052b0550a9b6dfaba557b56440ac818896b