Breaks Tornado's (`Async`)`HTTPClient`

[thijsvandien]

import truststore  # 0.10.4
truststore.inject_into_ssl()

from tornado.httpclient import HTTPClient, HTTPRequest  # 6.5.3

request = HTTPRequest('https://github.com')
HTTPClient().fetch(request)

On macOS 15.7.3 (M1 Pro), using either Python 3.13.11 or 3.14.2:

  File ".../site-packages/truststore/_macos.py", line 273, in _handle_osstatus
    raise ssl.SSLError(message)
ssl.SSLError: (b'One or more parameters passed to a function were not valid.',)

On Windows 11 24H2 (ARM), using Python 3.14.2 (AMD64):

  File "...\site-packages\truststore\_windows.py", line 333, in _verify_peercerts_impl
    raise ssl.SSLCertVerificationError("Peer sent no certificates to verify")
ssl.SSLCertVerificationError: ('Peer sent no certificates to verify',)

[rpoelstra]

I've been digging a bit deeper into this issue.
I found that, when the cert_chain is empty, calling sslobj.getpeercert(True) inside _get_unverified_chain_bytes, which is called from _verify_peercerts, results in: ValueError: handshake not done yet.
So it looks to me like the verify is either happening too soon or shouldn't fail with an exception when the chain is empty, as it might be retried later on when the connection progresses. I'm not familiar enough with TLS to make this distinction.

[rpoelstra]

This patch makes my app continue just fine:

--- a/src/truststore/_api.py
+++ b/src/truststore/_api.py
@@ -336,7 +336,13 @@
     cert_bytes = _get_unverified_chain_bytes(sslobj)
 
+    if not cert_bytes:
+        try:
+            sslobj.getpeercert(True)
+        except ValueError:
+            # The TLS handshake isn't performed yet, which is probably the reason why there are no certificates
+            return
+        else:
             # If the peer didn't send any certificates then
             # we can't do verification. Raise an error.
-    if not cert_bytes:
             raise ssl.SSLCertVerificationError("Peer sent no certificates to verify")
 

But I'm not sure that this won't break security somewhere.

[achapkowski]

truststore.inject_into_ssl() causes a lot of issue I find, you should create the context object directly and inject it into your workflow if possible. See the finer grained approach example on the github page.

[thijsvandien]

Note that in this case it doesn't help much:

import ssl
import truststore
from tornado.httpclient import HTTPClient, HTTPRequest

ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
request = HTTPRequest('https://github.com', ssl_options=ctx)
HTTPClient().fetch(request)

Still results in:

Traceback (most recent call last):
  File "<python-input-18>", line 1, in <module>
    client.fetch(request)
    ~~~~~~~~~~~~^^^^^^^^^
  File ".../site-packages/tornado/httpclient.py", line 134, in fetch
    response = self._io_loop.run_sync(
        functools.partial(self._async_client.fetch, request, **kwargs)
    )
  File ".../site-packages/tornado/ioloop.py", line 547, in run_sync
    return future_cell["future"].result()
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File ".../site-packages/tornado/simple_httpclient.py", line 338, in run
    stream = await self.tcp_client.connect(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    ...<6 lines>...
    )
    ^
  File ".../site-packages/tornado/tcpclient.py", line 292, in connect
    stream = await stream.start_tls(
                   ~~~~~~~~~~~~~~~~^
        False, ssl_options=ssl_options, server_hostname=host
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File ".../site-packages/tornado/iostream.py", line 1252, in start_tls
    socket = ssl_wrap_socket(
        socket,
    ...<3 lines>...
        do_handshake_on_connect=False,
    )
  File ".../site-packages/tornado/netutil.py", line 668, in ssl_wrap_socket
    return context.wrap_socket(
           ~~~~~~~~~~~~~~~~~~~^
        socket, server_hostname=server_hostname, server_side=server_side, **kwargs
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File ".../site-packages/truststore/_api.py", line 128, in wrap_socket
    _verify_peercerts(ssl_sock, server_hostname=server_hostname)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../site-packages/truststore/_api.py", line 337, in _verify_peercerts
    _verify_peercerts_impl(
    ~~~~~~~~~~~~~~~~~~~~~~^
        sock_or_sslobj.context, cert_bytes, server_hostname=server_hostname
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File ".../site-packages/truststore/_macos.py", line 428, in _verify_peercerts_impl
    Security.SecTrustCreateWithCertificates(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        certs, policies, ctypes.byref(trust)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File ".../site-packages/truststore/_macos.py", line 273, in _handle_osstatus
    raise ssl.SSLError(message)
ssl.SSLError: (b'One or more parameters passed to a function were not valid.',)