title: certificates for client side in tls
body: <p>I'm stuck with this for several days and could not figure it out still. I just want to build a simple TLS c/s communication in python. For server I use EC2, client I use my own laptop. I setup and test normal socket communication and everything works fine.</p>
  
  <p>When I try <a href="http://docs.python.org/library/ssl.html#ssl-certificates" rel="nofollow">this tutorial</a> from the official doc, I run into problem. For the following client code:</p>
  
  <pre><code># require a certificate from the server
  ssl_sock = ssl.wrap_socket(s,
                             ca_certs="/etc/ca_certs_file",
                             cert_reqs=ssl.CERT_REQUIRED)
  </code></pre>
  
  <p>As far as I know the part <code>/etc/ca_certs_file</code> should be some certificates from CAs. I am confused where should I look for them. I actually find some .pem files in <code>/etc/ssl/certs</code> on EC2 server but nothing on the client, my laptop.</p>
  
  <p>I also tried to generate a user certificate according to <a href="http://users.dcc.uchile.cl/~pcamacho/tutorial/crypto/openssl/openssl_intro.html" rel="nofollow">this tutorial on openssl</a>, I followed the steps, generating <code>cakey.pem</code>, <code>cacert.pem</code> for the server, <code>userkey.pem</code>, <code>usercert-req.pem</code> for the client, all in a same directory in my EC2 server. When I execute <code>openssl ca -in usercert-req.pem -out usercert.pem</code>, it outputs error:</p>
  
  <pre><code>Using configuration from /usr/lib/ssl/openssl.cnf
  Enter pass phrase for ./demoCA/private/cakey.pem:
  unable to load certificate
  140420412405408:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:696:Expecting: TRUSTED CERTIFICATE
  </code></pre>
  
  <p>So actually how should this cert file get generated? Generate at server side, then wait for client to request them over the air, or generate at client side, or obtain from 3rd party and directly use on client side?</p>
  
  <p>Could anyone give any guidance? Any help is appreciated.</p>