0

I'm attempting to create a local web server using Flask, a Python microframework, that uses the PKIs on a DoD CAC.

I've created the self-signed root CA and server certificate and key following this set of instructions. I then downloaded the necessary CA files from here which were:

  • DOD ID CA-49
  • DOD EMAIL CA-50

From there I've loaded up the following basic "hello world" application:

import ssl
from flask import Flask

app = Flask(__name__)

@app.route("/")
def main():
    return "Hello World"

if __name__ == '__main__':
    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
    ctx.verify_mode = ssl.CERT_REQUIRED
    ctx.load_verify_locations('DODIDCA_49.pem')
    ctx.load_cert_chain('localhost.crt', 'localhost.key')
    app.run(ssl_context=ctx)

This runs on https://127.0.0.1:5000/ and when I visit it through Microsoft Edge it prompts me for my CAC credentials (which I can pick either certificate to use and enter my PIN). Once my PIN is input, the page reloads and says the website is not secure. If I removedd the verify_mode and load_verify_locations lines, I'm no longer prompted for my CAC credentials and the website loads to print the text.

I desire the previous sequence which requires me to pick a valid credential, but I cannot figure out how to get the browsers to trust the server certificates in conjuncture with the DoD CAs provided.

How can I accomplish this on Windows 10?

9
  • Self signed certs will not be trusted; they are intended for testing, not production use, and will always be recognized as not originating from the same certificate chain as the DOD files. If you want everything to be trusted, you need an actual DOD server certificate with the full certificate chain. – pmdba Jul 17 '20 at 2:48
  • @pmdba Which is fine and is what I figured I would need to do. I would need to generate a CSR and have the DOD provide server certificates. But for testing, how would I get the browser to not complain about it? I want to test accessing the certificate information – pstatix Jul 17 '20 at 12:02
  • Depends on the specific browser. IE and Edge will generally not allow you to ignore "bad" certificates for any reason. Firefox has an option to accept risk and ignore future warnings. Chrome may still prompt you but allow you to proceed. – pmdba Jul 17 '20 at 14:27
  • @pmdba Exploring all this certificate stuff in depth for the first time, I've mostly just used PKIs to extract the certificate/key into PEM format to send via API requests. I was reading this article explaining the chain. Now I have no access to root, just the PKIs which are signed by the intermediate. For the intermediate though, I only have the certificate so therefore the server doesnt fill the DoD chain. Is the chain: PKI (verified with CA/intermediate) > Server (once signed) > Root? – pstatix Jul 17 '20 at 18:40
  • @pmdba In other words, what role does the intermediate CA certificate play here? I cannot use it to sign the server certificates (no private key), but is it used to verify the certificates against it? – pstatix Jul 17 '20 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.