Skip to main content

How to disable default certificate verification in Python 2.7.9 and above permanently on Mac?

Python from 2.7.9 and above now verifies the SSL certificate prior establishing the connection to server. This might cause problem in few servers which do not support certificate validation yet. In these circumstances the HTTPS connection requests fails due to new changes in python. For more information on the new changes please read more at : https://www.python.org/dev/peps/pep-0476/. This link describes the ways to establish ssl connection without certificate verification. In my case i was not using the httplib modules API directly hence i had to find out a crude approach to disable the SSL certificate  verification. I would not recommend the below change unless it is really required to do it as you might be opening a set of vulnerabilities as specified in this article.  However the below sample code tells you how disable SSL certificate  verification completely on your system. 

1. Open Terminal
2. Open with sudo privileges the following file [ Note: You may be required to disable System Integrity Protection(SIP) on your mac to edit these files if your system is running OS X 10.11 + , Please read my post on How to Disable System Integrity Protection(SIP) ]


    sudo vim /System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py


Look for following Piece of Code:

class HTTPSConnection(HTTPConnection):
        "This class allows communication via SSL."

        default_port = HTTPS_PORT

        def __init__(self, host, port=None, key_file=None, cert_file=None,
                     strict=None, timeout=socket._GLOBAL_DEFAULT_TIMEOUT,
                     source_address=None, context=None):
            HTTPConnection.__init__(self, host, port, strict, timeout,
                                    source_address)
            self.key_file = key_file
            self.cert_file = cert_file
            if context is None:
                context = ssl._create_default_https_context()
            if key_file or cert_file:
                context.load_cert_chain(cert_file, key_file)
            self._context = context


Comment the highlighted line and add following line below the commented line.

                context = ssl._create_unverified_context()



Finally the change should be reflected as below:


class HTTPSConnection(HTTPConnection):
        "This class allows communication via SSL."

        default_port = HTTPS_PORT

        def __init__(self, host, port=None, key_file=None, cert_file=None,
                     strict=None, timeout=socket._GLOBAL_DEFAULT_TIMEOUT,
                     source_address=None, context=None):
            HTTPConnection.__init__(self, host, port, strict, timeout,
                                    source_address)
            self.key_file = key_file
            self.cert_file = cert_file
            if context is None:
                #Comment the below line and un-comment the commented line to revert to original state.
                context = ssl._create_unverified_context()
                #context = ssl._create_default_https_context()
            if key_file or cert_file:
                context.load_cert_chain(cert_file, key_file)
            self._context = context




Note: Above change to the python source is not recommended unless required. Proceed with caution. 



Comments

Popular posts from this blog

How to find firmware or boot ROM version in Mac OS X

Firmware and boot ROM version of your mac can be found in two ways.
Way 1 :
1. From "Apple" menu , choose "About This Mac" menu item. 2. Click " More Info " to open "System Profiler" application. 3. Under Contents -> Select Hardware Tree item.
On the right side panel Under hardware overview section, we can see Boot ROM Version and SMC (Firmware) Version.








Way 2 :
Run the below command in terminal to get boot ROM version and SMC(firmware) version :
$ system_profiler SPHardwareDataType | grep -i "Version" | awk -F ':' '{print $1 $2}'

How to decrypt the Filevault encrypted volume using Recovery HD ?

There might be a time where you want decrypt the FileVault encrypted mac, but you are facing issues in logging into Mac to perform decryption using system preferences. In such cases the following steps will help you in decrypting the disk using Recovery HD. Reboot the Mac, Go to recovery HD partition of the system. (To start your computer from Recovery, restart your Mac and hold down the Command and R keys at startup.)Open Terminal application from Utilities -> Application. First will need to identify the Logical Volume UUID of the encrypted drive using the diskutil corestorage list command: diskutil corestorage list

      4.  Once you have the UUID of the logical volume as shown in above picture, you can then either             unlock or decrypt the encrypted volume using the following commands.
      a) Using the password of an authorised account or the recovery key ( Provided by the                                FileVault at the time of enabling it) on the command line            …