Tornado HTTPS包错误

Question

我有一个简单的Python (3.6) Tornado (4.5.2)服务器示例，我正在尝试添加ssl证书以进行测试。我已确定它正在查找密钥和csr文件。下面是我的代码看起来是什么样子，后面有一个堆栈跟踪，后面详细描述了错误。有没有人遇到过这个问题或者解决过这个问题？

import tornado.httpserver
import tornado.ioloop
import tornado.web


class indexHandler(tornado.web.RequestHandler):

    def get(self):
        self.write("hello")


application = tornado.web.Application([
    (r'/', indexHandler),
])

if __name__ == '__main__':
    http_server = tornado.httpserver.HTTPServer(application, ssl_options={
        "certfile": "cert/ig.csr",
        "keyfile": "cert/ig.key",
    })
    http_server.listen(443)
    tornado.ioloop.IOLoop.instance().start()

运行在Python3.6.4上，服务器运行，但是当页面作为https://localhost访问时，它抛出以下异常。我遗漏了什么？

ERROR:asyncio:Exception in callback BaseAsyncIOLoop._handle_events(5, 1) 
handle: <Handle BaseAsyncIOLoop._handle_events(5, 1)> 

Traceback (most recent call last):   
  File "/<python path>/asyncio/events.py", line 145, in _run
    self._callback(*self._args)   
  File "/<python path>/site-packages/tornado/platform/asyncio.py", line 102, in _handle_events
    handler_func(fileobj, events)   
  File "/<python path>/site-packages/tornado/stack_context.py", line 276, in null_wrapper
    return fn(*args, **kwargs)   
  File "/<python path>/site-packages/tornado/netutil.py", line 252, in accept_handler
    callback(connection, address)   
  File "/<python path>/site-packages/tornado/tcpserver.py", line 264, in _handle_connection
    do_handshake_on_connect=False)   
  File "/<python path>/site-packages/tornado/netutil.py", line 551, in ssl_wrap_socket
    context = ssl_options_to_context(ssl_options)   
  File "/<python path>/site-packages/tornado/netutil.py", line 526, in ssl_options_to_context
    context.load_cert_chain(ssl_options['certfile'], ssl_options.get('keyfile', None)) 
    ssl.SSLError: [SSL] PEM lib (_ssl.c:3337)

在上面的错误消息中，/<python path>/等于：

"/usr/local/Cellar/python3/3.6.4_2/Frameworks/Python.framework/Versions/3.6/lib/python3.6/"

Answer 1

这是因为you证书的签名和密钥不匹配。

Answer 2

好的-我找到了！！有几个联机资源可用于确定您的证书文件和密钥是否匹配。我使用了THIS，它们并不匹配。快速调用Comodo (证书是通过Namecheap，然后通过它们)，他们修复了它。

教训:首先验证密钥和证书！