commit 0b6822804eb4fdeefc6143fbe72478c7309be7b7
author Dmytro Shteflyuk <kpumuk@kpumuk.info> Wed Feb 04 16:26:46 2026 -0500
committer Jens Geyer <Jens-G@users.noreply.github.com> Fri Feb 20 00:15:37 2026 +0100
tree 345c63f99bc7bb35505c0767d529253831f0ee6a
parent 697910f23fc5b21d21fad20499e2a43dd0496092

Wire TLS keys in Python for cross-tests

Configure Python test client/server to use shared test keys and CA for SSL.
Remove Python SSL entries from known failures to re-enable SSL coverage.

test/py/TestClient.py

diff --git a/test/py/TestClient.py b/test/py/TestClient.py
index d80ddf4..9971e42 100755
--- a/test/py/TestClient.py
+++ b/test/py/TestClient.py
@@ -20,6 +20,7 @@
 #
 
 import os
+import ssl
 import sys
 import time
 import unittest
@@ -40,7 +41,7 @@
                                             options.port,
                                             (options.http_path if options.http_path else '/'))
             if options.ssl:
-                __cafile = os.path.join(os.path.dirname(SCRIPT_DIR), "keys", "CA.pem")
+                __cafile = os.path.join(os.path.dirname(SCRIPT_DIR), "keys", "server.pem")
                 __certfile = os.path.join(os.path.dirname(SCRIPT_DIR), "keys", "client.crt")
                 __keyfile = os.path.join(os.path.dirname(SCRIPT_DIR), "keys", "client.key")
                 self.transport = THttpClient.THttpClient(uri, cafile=__cafile, cert_file=__certfile, key_file=__keyfile)
@@ -49,7 +50,20 @@
         else:
             if options.ssl:
                 from thrift.transport import TSSLSocket
-                socket = TSSLSocket.TSSLSocket(options.host, options.port, validate=False)
+                keys_dir = os.path.join(os.path.dirname(SCRIPT_DIR), "keys")
+                ca_certs = os.path.join(keys_dir, "server.pem")
+                certfile = os.path.join(keys_dir, "client.crt")
+                keyfile = os.path.join(keys_dir, "client.key")
+                ssl_version = getattr(ssl, "PROTOCOL_TLS_CLIENT", ssl.PROTOCOL_TLSv1)
+                socket = TSSLSocket.TSSLSocket(
+                    options.host,
+                    options.port,
+                    certfile=certfile,
+                    keyfile=keyfile,
+                    ca_certs=ca_certs,
+                    cert_reqs=ssl.CERT_REQUIRED,
+                    ssl_version=ssl_version,
+                )
             else:
                 socket = TSocket.TSocket(options.host, options.port, options.domain_socket)
             # frame or buffer depending upon args

test/py/TestServer.py

diff --git a/test/py/TestServer.py b/test/py/TestServer.py
index c2723e5..3b93841 100755
--- a/test/py/TestServer.py
+++ b/test/py/TestServer.py
@@ -21,6 +21,7 @@
 import logging
 import os
 import signal
+import ssl
 import sys
 import time
 from optparse import OptionParser
@@ -310,12 +311,23 @@
 
     # set up server transport and transport factory
 
-    abs_key_path = os.path.join(os.path.dirname(SCRIPT_DIR), 'keys', 'server.pem')
-
     host = None
     if options.ssl:
         from thrift.transport import TSSLSocket
-        transport = TSSLSocket.TSSLServerSocket(host, options.port, certfile=abs_key_path)
+        keys_dir = os.path.join(os.path.dirname(SCRIPT_DIR), 'keys')
+        ca_certs = os.path.join(keys_dir, 'client.pem')
+        certfile = os.path.join(keys_dir, 'server.crt')
+        keyfile = os.path.join(keys_dir, 'server.key')
+        ssl_version = getattr(ssl, 'PROTOCOL_TLS_SERVER', ssl.PROTOCOL_TLSv1)
+        transport = TSSLSocket.TSSLServerSocket(
+            host,
+            options.port,
+            certfile=certfile,
+            keyfile=keyfile,
+            ca_certs=ca_certs,
+            cert_reqs=ssl.CERT_REQUIRED,
+            ssl_version=ssl_version,
+        )
     else:
         transport = TSocket.TServerSocket(host, options.port, options.domain_socket)
     tfactory = TTransport.TBufferedTransportFactory()