包含证书的Python请求

Question

我正在尝试让汇丰银行开放银行的沙箱工作起来。只有当我禁用-k验证时，他们documentation中的curl命令才会给我一个访问令牌。请注意，我从我的HSBC开发人员dashboard下载了xyz.der和server.key。

curl -v -k -X POST \
--cert hsbc/qwac_PSP_PI,PSP_AS,PSP_IC,PSP_AI_27_10_2020.der \
--cert-type DER \
--key hsbc/server.key \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Accept: application/json" \
-H "x-fapi-financial-id: test" \
-H "Cache-Control: no-cache" \
-d 'grant_type=client_credentials&scope=accounts&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=xyz' \
"https://sandbox.hsbc.com/psd2/obie/v3.1/as/token.oauth2"

由于这是有效的，我正在尝试用requests做同样的事情，但我在如何使用证书上苦苦挣扎。我知道requests支持cert关键字，但似乎我还需要添加其他参数。有没有办法可以指定证书类型和对应的密钥？

import requests

headers = {
    "Content-Type": "application/x-www-form-urlencoded",
    "Accept": "application/json",
    "x-fapi-financial-id": "test",
    "Cache-Control": "no-cache",
}
params = {
    "grant_type": "client_credentials",
    "scope": "accounts",
    "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
    "client_assertion": "xyz",
}
url = "https://sandbox.hsbc.com/psd2/obie/v3.1/as/token.oauth2"

requests.post(url=url,
              headers=headers,
              params=params,
              cert="hsbc/qwac_PSP_PI,PSP_AS,PSP_IC,PSP_AI_27_10_2020.der",
              verify=False).json()

Answer 1

感谢@KlausD。在使用openssl将.der转换为.pem后，现在可以使用此功能

openssl x509 -inform der -in qwac_xyz.der -out qwac_xyz.pem

import requests

headers = {
    "Content-Type": "application/x-www-form-urlencoded",
    "Accept": "application/json",
    "x-fapi-financial-id": "test",
    "Cache-Control": "no-cache",
}
params = {
    "grant_type": "client_credentials",
    "scope": "accounts",
    "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
    "client_assertion": "xyz",
}
url = "https://sandbox.hsbc.com/psd2/obie/v3.1/as/token.oauth2"

requests.post(url=url,
              headers=headers,
              params=params,
              cert=("hsbc/qwac_xyz.pem", "hsbc/server.key"),
              verify=False).json()