adding parameter --ssl-password to decrypt ssl key file

[remster85]

Add parameter --ssl-password to be able to decrypt the ssl key
If provided, this parameter will be passed to load_cert_chain as password.

The password argument may be a function to call to get the password for decrypting the private key. It will only be called if the private key is encrypted and a password is necessary. It will be called with no arguments, and it should return a string, bytes, or bytearray. If the return value is a string it will be encoded as UTF-8 before using it to decrypt the key. Alternatively a string, bytes, or bytearray value may be supplied directly as the password argument. It will be ignored if the private key is not encrypted and no password is needed.

https://docs.python.org/3.3/library/ssl.html#ssl.SSLContext.load_cert_chain

This issue required a pull request #581

Fixes #581

[remster85]

Let's go! Could you please merge?

[florimondmanca]

Sounds like an acceptable feature to add, yup. I left a naming suggestion which I think we should address before merging this.

Also, looks like we should add a test to our test suite, at least to verify that the config ingestion logic works well?

Eg we've got fixtures for a certfile and a keyfile in conftest.py. So we can probably add an ENCRYPTED_PRIVATE_KEY that's an encrypted version of PRIVATE_KEY, and then make sure our config is able to load that properly into the ssl_context, by updating test_config.py?

[florimondmanca]

Thoughts on naming this --ssl-keyfile-password? Both for extra explicitness that this is related to --ssl-keyfile, as well as visually hinting that "this is a more advanced option, since its name is longer" :-)

Suggested change

	--ssl-password TEXT SSL key file password
	--ssl-keyfile-password TEXT SSL key file password

[florimondmanca]

(Nit) Dunno if we could go for a more compact form - hopefully this is readable enough? Or can we not pass None as the password argument? (The Python docs aren't very explicit about that.)

Suggested change

	if password:
	def getpassword():
	return password
	ctx.load_cert_chain(certfile, keyfile, getpassword)
	else:
	ctx.load_cert_chain(certfile, keyfile)
	password = (lambda: password) if password else None
	ctx.load_cert_chain(certfile, keyfile, password)

[florimondmanca]

Marking as "Changes requested" since I don't think this should be merged as-is for now, at least not without a basic test to prevent future regressions. :-)

[remster85]

Thanks @florimondmanca for the review , allow me some time to get back to you.

[euri10]

thanks a lot @remster85, I built on your PR in #808 and added the tests etc using trustme.

[remster85]

Thanks so much @euri10 !