Mercurial Mercurial > mercurial / changeset
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | raw | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
sslutil: show fingerprint when cacerts validation fails
authorMads Kiilerich <mads@kiilerich.com>
Mon, 09 Jan 2012 14:43:24 +0100
changeset 15814 c3e958b50a22
parent 15813 3ae04eb5e38a
child 15815 edc3a901a63d
sslutil: show fingerprint when cacerts validation fails
mercurial/sslutil.py file | annotate | diff | comparison | revisions
tests/test-https.t file | annotate | diff | comparison | revisions 
--- a/mercurial/sslutil.py	Mon Jan 09 14:43:23 2012 +0100
+++ b/mercurial/sslutil.py	Mon Jan 09 14:43:24 2012 +0100
@@ -110,18 +110,19 @@
             self.ui.warn(_("warning: certificate for %s can't be verified "
                            "(Python too old)\n") % host)
             return
+        peercert = sock.getpeercert(True)
+        peerfingerprint = util.sha1(peercert).hexdigest()
+        nicefingerprint = ":".join([peerfingerprint[x:x + 2]
+            for x in xrange(0, len(peerfingerprint), 2)])
         if cacerts and not hostfingerprint:
             msg = _verifycert(sock.getpeercert(), host)
             if msg:
-                raise util.Abort(_('%s certificate error: %s '
-                                   '(use --insecure to connect '
-                                   'insecurely)') % (host, msg))
+                raise util.Abort(_('%s certificate error: %s') % (host, msg),
+                                 hint=_('configure hostfingerprint %s or use '
+                                        '--insecure to connect insecurely') %
+                                      nicefingerprint)
             self.ui.debug('%s certificate successfully verified\n' % host)
         else:
-            peercert = sock.getpeercert(True)
-            peerfingerprint = util.sha1(peercert).hexdigest()
-            nicefingerprint = ":".join([peerfingerprint[x:x + 2]
-                for x in xrange(0, len(peerfingerprint), 2)])
             if hostfingerprint:
                 if peerfingerprint.lower() != \
                         hostfingerprint.replace(':', '').lower():
--- a/tests/test-https.t	Mon Jan 09 14:43:23 2012 +0100
+++ b/tests/test-https.t	Mon Jan 09 14:43:24 2012 +0100
@@ -180,7 +180,8 @@
 cacert mismatch
 
   $ hg -R copy-pull pull --config web.cacerts=pub.pem https://127.0.0.1:$HGPORT/
-  abort: 127.0.0.1 certificate error: certificate is for localhost (use --insecure to connect insecurely)
+  abort: 127.0.0.1 certificate error: certificate is for localhost
+  (configure hostfingerprint 91:4f:1a:ff:87:24:9c:09:b6:85:9b:88:b1:90:6d:30:75:64:91:ca or use --insecure to connect insecurely)
   [255]
   $ hg -R copy-pull pull --config web.cacerts=pub.pem https://127.0.0.1:$HGPORT/ --insecure
   warning: 127.0.0.1 certificate with fingerprint 91:4f:1a:ff:87:24:9c:09:b6:85:9b:88:b1:90:6d:30:75:64:91:ca not verified (check hostfingerprints or web.cacerts config setting)
mercurial