title: Doing SSL client authentication is python
body: <p>OK, I am trying to use client certificates to authenticate a python client to an Nginx server. Here is what I tried so far:</p>
  
  <p>Created a local CA</p>
  
  <pre>
  openssl genrsa -des3 -out ca.key 4096
  openssl req -new -x509 -days 365 -key ca.key -out ca.crt
  </pre>
  
  <p>Created server key and certificate</p>
  
  <pre>
  openssl genrsa -des3 -out server.key 1024
  openssl rsa -in server.key -out server.key
  openssl req -new -key server.key -out server.csr
  openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt
  </pre>
  
  <p>Used similar procedure to create a client key and certificate</p>
  
  <pre>
  openssl genrsa -des3 -out client.key 1024
  openssl rsa -in client.key -out client.key
  openssl req -new -key client.key -out client.csr
  openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
  </pre>
  
  <p>Add these lines to my nginx config</p>
  
  <pre>
  server {
      listen 443;
      ssl on;
      server_name dev.lightcloud.com;
      keepalive_timeout 70;
  
      access_log /usr/local/var/log/nginx/lightcloud.access.log;
      error_log /usr/local/var/log/nginx/lightcloud.error.log;
  
      ssl_certificate /Users/wombat/Lightcloud-Web/ssl/server.crt;
      ssl_certificate_key /Users/wombat/Lightcloud-Web/ssl/server.key;
      ssl_client_certificate /Users/wombat/Lightcloud-Web/ssl/ca.crt;
      ssl_verify_client on;
  
      location / {
          uwsgi_pass unix:///tmp/uwsgi.socket;
          include uwsgi_params;
      }
  }
  </pre>
  
  <p>created a PEM client file</p>
  
  <pre>cat client.crt client.key ca.crt > client.pem</pre>
  
  <p>created a test python script</p>
  
  <pre>
  import ssl
  import http.client
  
  context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
  context.load_verify_locations("ca.crt")
  context.load_cert_chain("client.pem")
  
  conn = http.client.HTTPSConnection("localhost", context=context)
  conn.set_debuglevel(3)
  
  conn.putrequest('GET', '/')
  conn.endheaders()
  response = conn.getresponse()
  print(response.read())
  </pre>
  
  <p>And now I get 400 The SSL certificate error from the server. What am I doing wrong?</p>