Not able to authenticate using certificate and key files

[roopeshsn]

I've used transport as http_certs. My .conf file looks like below where I've provided path to signed certificate and private key files,

[connection:dut]
host: 10.10.10.1
transport: https_certs
cert_file: "/Users/roopesh/Desktop/projects/pyapi-test/cert.pem"
key_file: "/Users/roopesh/Desktop/projects/pyapi-test/key.pem"

Also here's my simple python script,

import pyeapi

pyeapi.load_config('nodes.conf')
node = pyeapi.connect_to('dut')

config = node.get_config('running-config')
print(config)

When I ran the above script, I got the following error,

roopesh:pyapi-test/ $ /Users/roopesh/Desktop/projects/pyapi-test/.venv/bin/python /Users/roopesh/Desktop/projects/pyapi-test/main.py                                             [10:03:14]
Traceback (most recent call last):
  File "/Users/roopesh/Desktop/projects/pyapi-test/main.py", line 4, in <module>
    node = pyeapi.connect_to('dut')
           ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/roopesh/Desktop/projects/pyapi-test/.venv/lib/python3.12/site-packages/pyeapi/client.py", line 1046, in connect_to
    node = connect(return_node=True, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/roopesh/Desktop/projects/pyapi-test/.venv/lib/python3.12/site-packages/pyeapi/client.py", line 453, in connect
    connection = make_connection(transport, host=host, username=username,
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/roopesh/Desktop/projects/pyapi-test/.venv/lib/python3.12/site-packages/pyeapi/client.py", line 391, in make_connection
    return klass(**kwargs)
           ^^^^^^^^^^^^^^^
  File "/Users/roopesh/Desktop/projects/pyapi-test/.venv/lib/python3.12/site-packages/pyeapi/eapilib.py", line 708, in __init__
    self.transport = HTTPSCertConnection(path, host, int(port),
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/roopesh/Desktop/projects/pyapi-test/.venv/lib/python3.12/site-packages/pyeapi/eapilib.py", line 222, in __init__
    HTTPSConnection.__init__(self, host, key_file=key_file,
TypeError: HTTPSConnection.__init__() got an unexpected keyword argument 'key_file'

It seems key_file argument is not properly handled.

[roopeshsn]

@dlyssenko

[roopeshsn]

@dlyssenko suggested to use the SSL context way. The below code snippet works if the certificates and key files are properly created and configured in the client and the switch,

import pyeapi
import ssl

host="10.10.10.1"
path_to_key_file="/Users/roopesh/key.pem"
path_to_cert_file="/Users/roopesh/cert.pem"

ctx = ssl.create_default_context()
ctx.set_ciphers('DEFAULT') 
ctx.load_cert_chain(certfile=path_to_cert_file, keyfile=path_to_key_file)       
ctx.check_hostname = False  
ctx.verify_mode = ssl.CERT_NONE 

node = pyeapi.client.connect(host=host, context=ctx, return_node=True)
config = node.enable(commands=['show version'])
print(config)

Sharing it here so that it might be helpful for someone who is looking for the same thing.

[dlyssenko]

Hi @roopeshsn
are you sure you used the latest pyeapi version?

I cannot repro your issue with the latest devel branch, plus I see in the source that the exception is thrown in your example is no longer applicable there, i.e., it was fixed ~3 month ago with for the issue #290 (PR #311)

repro steps:

bash $ cat nodes.conf 
[connection:dut]
host: smm212
transport: https_certs
cert_file: /.../cert.pem
key_file: /.../key.pem

bash $ python3
Python 3.9.12 (main, Aug 11 2022, 23:31:21) 
[Clang 13.0.0 (clang-1300.0.29.30)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> 
>>> import pyeapi
>>> pyeapi.__version__
'1.0.4'
>>> 
>>> pyeapi.load_config( 'nodes.conf' )
>>> node = pyeapi.connect_to( 'dut' )
>>> 
>>> config = node.enable( 'show version' )
>>> print(config)
[{'command': 'show version', 'result': {'mfgName': 'Arista', 'modelName': 'DCS-7280CR3MK-32P4-F', 'hardwareRevision': '12.01', 'serialNumber': 'JPE20173687', 'systemMacAddress': 'c0:d6:82:23:39:af', 'hwMacAddress': 'c0:d6:82:23:39:af', 'configMacAddress': '00:00:00:00:00:00', 'version': '4.34.0F-41138442.nikunjmplsUdpEncapTamperTestCases (engineering build)', 'architecture': 'x86_64', 'internalVersion': '4.34.0F-41138442.nikunjmplsUdpEncapTamperTestCases', 'internalBuildId': '6b8aff10-8db8-49c7-b50f-8312d77bb4dd', 'imageFormatVersion': '3.0', 'imageOptimization': 'Default', 'bootupTimestamp': 1742379237.6435325, 'uptime': 6736.28, 'memTotal': 65734472, 'memFree': 61410288, 'isIntlVersion': False}, 'encoding': 'json'}]
>>> 

[dlyssenko]

Duplicate of the issue #290 (PR #311)

[dlyssenko]

Some more important notice on the issue:

key_file and cert_file were deprecated in http.client lib since python 3.6 in favor of SSL context. It appears that these parameters were completely dropped in python 3.12.

Thus, starting from python 3.12 onwards, only SSL context should be used to pass certificates to the pyeapi connection.