# Example of a dynamic key and cert.datastore_record_k=ndb.Key('Employee','asalieri','Address',1)datastore_record=datastore_record_k.get()key_str=datastore_record.key_strcert_str=datastore_record.certssl_server=ssl.wrap_socket(server_sock,server_side=False,keyfile=StringIO.StringIO(key_str),certfile=StringIO.StringIO(cert_str),cert_reqs=ssl.CERT_REQUIRED,ssl_version=ssl.PROTOCOL_SSLv23,ca_certs=CERTIFICATE_FILE)
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003ePython SSL library version 2.7 is deprecated, and users should use the latest version, currently 2.7.11.\u003c/p\u003e\n"],["\u003cp\u003eApp Engine supports the native Python SSL library for the Python 2.7 runtime, requiring the \u003ccode\u003essl\u003c/code\u003e library to be specified in the application's \u003ccode\u003eapp.yaml\u003c/code\u003e configuration file.\u003c/p\u003e\n"],["\u003cp\u003eTo perform an SSL handshake, users need a file containing concatenated certificate authority certificates, either by uploading their own or using App Engine's provided file at \u003ccode\u003e/etc/ca-certificates.crt\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eApp Engine's \u003ccode\u003ewrap_socket\u003c/code\u003e method allows for "file-like" objects for \u003ccode\u003ecertfile\u003c/code\u003e and \u003ccode\u003ekeyfile\u003c/code\u003e parameters, enabling storage of certificates and keys dynamically outside of uploaded application files.\u003c/p\u003e\n"],["\u003cp\u003eCertificates should be validated to prevent security vulnerabilities, either by setting the \u003ccode\u003ePYTHONHTTPSVERIFY\u003c/code\u003e environment variable to \u003ccode\u003e1\u003c/code\u003e in \u003ccode\u003eapp.yaml\u003c/code\u003e or by explicitly calling \u003ccode\u003essl.match_hostname\u003c/code\u003e after a successful handshake.\u003c/p\u003e\n"]]],[],null,["# Using Python SSL\n\nVersion `2.7` of the Python SSL library has been\ndeprecated.\nInstead, use the latest version, currently `2.7.11`.\n\nApp Engine supports the native Python SSL library for the Python 2.7 runtime via\nthe SSL library, which you must add to your app.\n| **Note:** You can pickle App Engine socket objects, but SSL-wrapped sockets do not support pickling.\n\nSpecifying the SSL library\n--------------------------\n\nIf you want to use native Python SSL, you must enable it by specifying `ssl` for\nthe `libraries` configuration in your application's `app.yaml`. You should use\nthe latest library version, which is currently\n[version 2.7.11](https://docs.python.org/release/2.7.11/library/ssl.html). This\nversion supports TLS versions 1.0, 1.1, and 1.2 and corresponds to the SSL\nversions from Python 2.7.11 and onwards: \n\n libraries:\n - name: ssl\n version: latest\n\nProviding authority certificates\n--------------------------------\n\nIn order to perform an SSL handshake, you must have file that contains\nconcatenated certificate authority certificates. You can\nupload your own file with your application, or you can use the\nfile provided by App Engine: `/etc/ca-certificates.crt`.\n\nPerforming an SSL handshake\n---------------------------\n\nThe Python 2.7 `wrap_socket` method takes two file name\nparameters that contain the client's key and certificate. In the App Engine\nenvironment, this is limiting since the application is not able to write files\nto dynamically provide different keys and certificates. To get around this\nlimitation, the `certfile` and `keyfile` parameters for\nthe `ssl.wrap_socket` method can be \"file-like\" objects that allow\nthe application to store certificates and keys in other ways than in just\nuploaded application files. (A \"file-like\" object is one that has a \"read\"\nmethod returning the entire certificate as a string.) \n\n # Example of a dynamic key and cert.\n datastore_record_k = ndb.Key('Employee', 'asalieri', 'Address', 1)\n datastore_record = datastore_record_k.get()\n key_str = datastore_record.key_str\n cert_str = datastore_record.cert\n ssl_server = ssl.wrap_socket(server_sock,\n server_side=False,\n keyfile=StringIO.StringIO(key_str),\n certfile=StringIO.StringIO(cert_str),\n cert_reqs=ssl.CERT_REQUIRED,\n ssl_version=ssl.PROTOCOL_SSLv23,\n ca_certs=CERTIFICATE_FILE)\n\nYou don't need to specify the `ssl_version` parameter. If you omit it, the\n2.7.11 library defaults to `PROTOCOL_SSLv23`. You can also specify\n`PROTOCOL_TLSv1`, `PROTOCOL_TLSv1_1`, or `PROTOCOL_TLSv1_2`.\n\nThe App Engine implementation of the `wrap_socket` method includes the\nrequired parameter `ca_certs`, which is used to specify the special file containing\nconcatenated certificate authority certificates.\n\nValidating certificates\n-----------------------\n\nYour app should validate certificates to prevent certain\n[security vulnerabilities](https://docs.python.org/release/2.7.11/library/ssl.html#ssl-security)\nsuch as \"man in the middle\" attacks.\n\nTo do this:\n\n1. Edit your `app.yaml` file, adding the environment variable\n `PYTHONHTTPSVERIFY` set to `1`:\n\n env_variables:\n PYTHONHTTPSVERIFY: 1\n\n2. Redeploy your app.\n\nAlternatively to specifying cert validation in your `app.yaml`, you could\nexplicitly call the SSL library to do the validation, after you've performed a\nsuccessful SSL handshake, as follows: \n\n ssl.match_hostname(ssl_server.getpeercert(), 'a.hostname.com')\n\nThe above code uses the `match_hostname` feature, backported from Python 3.2 to\nbe part of the App Engine Python 2.7.11 SSL module. This call makes sure the\ncertificate supplied by the peer matches one of the designated hosts in the\npeer's certificate.\n\nWorking on dev_appserver\n------------------------\n\nYou can issue HTTPS requests using the [urlfetch](/appengine/docs/legacy/standard/python/issue-requests)\nAPI, Dev_server's certificate validation behaviour using `httplib` using urlfetch\nis identical to the production App Engine environment. Dev_appserver\ndoes not support requests using [sockets](/appengine/docs/legacy/standard/python/sockets)."]]
