diff --git a/tests/test_client.py b/tests/test_client.py index 9e265c3..1f529c5 100644 --- a/tests/test_client.py +++ b/tests/test_client.py @@ -25,6 +25,8 @@ import pytest import wolfssl +from wolfssltestserver import wolfSSLTestServer +from threading import Thread HOST = "www.python.org" PORT = 443 @@ -89,3 +91,64 @@ def test_get_version(ssl_server, ssl_version, tcp_socket): assert secure_socket.version() == protocol_name secure_socket.write(b'hello wolfssl') secure_socket.read(1024) + + +def test_client_cert_verification_failure(): + """ + Test that a connection fails when the server requires client certificates + but the server's CA (globalsign) does not verify the client's certificate. + """ + import socket + import time + + # Create a server with CERT_REQUIRED and globalsign CA + # This server will require client certificates but won't accept + # certificates signed by a different CA + port = 11111 + with wolfSSLTestServer( + ('localhost', port), + version=wolfssl.PROTOCOL_TLS, + verify=wolfssl.CERT_REQUIRED + ) as server: + server_thread = Thread(target=server.handle_request) + server_thread.daemon = True + server_thread.start() + + # Give the server a moment to start + time.sleep(0.1) + + # Create a client socket + client_tcp_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + + # Create a client context + client_ctx = wolfssl.SSLContext(wolfssl.PROTOCOL_TLS) + + # Wrap the socket with the client context + # Set do_handshake_on_connect=False so we can explicitly call do_handshake() + # and catch the error + client_socket = client_ctx.wrap_socket( + client_tcp_socket, + do_handshake_on_connect=False + ) + + # Connect the TCP socket first + client_socket.connect(('127.0.0.1', port)) + + # Attempt handshake - this should fail because the client does not + # send a cert/key. + with pytest.raises(wolfssl.SSLError) as exc_info: + client_socket.do_handshake() + # Handshake appeared to succeed, try to read/write to trigger the error + # The server should reject the connection due to certificate verification failure + client_socket.write(b'hello') + client_socket.read(1024) + + # Clean up (errors during close are expected if connection failed) + try: + client_socket.close() + except Exception: + pass + try: + client_tcp_socket.close() + except Exception: + pass