proper TLS configuration

Author: dimaqq

ops/_tracing/export.py

@@ -119,30 +119,22 @@ def ssl_context(self, ca: str | None) -> ssl.SSLContext:
         return context
 
     def _ssl_context(self, ca: str | None) -> ssl.SSLContext:
-        # FIXME: What should our protocol range be?
-        # this means TLS {v1, v1.1, v1.2}
-        # Do we need to set v1_2 or v1_3 explicitly?
-        # Py 3.10 update the secure cipher list
-        # Do we need to set ciphers explicitly for Py 3.8?
-        # We'd match https://wiki.mozilla.org/Security/Server_Side_TLS "Modern".
-        # FIXME SSLContext(args) or create_default_context(args)?
+        # NOTE: ssl.create_default_context() doesn't allow setting the context.protocol in a way
+        # that's the same across Python 3.8 and 3.10 onwards. Whip the context up by hand.
         context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        context.minimum_version = ssl.TLSVersion.TLSv1_3
+        context.set_alpn_protocols(['http/1.1'])
+        context.verify_flags |= ssl.VERIFY_X509_STRICT
+        if (partial_chain := getattr(ssl, "VERIFY_X509_PARTIAL_CHAIN", None)):
+            # Available starting from Python 3.10. The partial chain flag allows trusting the
+            # intermediate CAs in the CA list without the matching root CA
+            context.verify_flags |= partial_chain
 
-        if ca:
+        if ca is not None:
             context.load_verify_locations(cadata=ca)
         else:
-            # FIXME: we should probably allow ca=None
-            # and then we'd pick up system or certifi certs?
-            raise ValueError(f'FIXME: unsupported {ca=}')
-
-        # FIXME: what's recommended?
-        # context.set_ciphers(...)
-        # FIXME: we need to set NPN if we're setting ALPN?
-        # Does this work the same way across Py 3.8~3.13?
-        context.set_npn_protocols('http/1.1')
-        context.set_alpn_protocols(['http/1.1'])
-        # TODO: check that we don't need these:
-        # .set_sni_callback
+            context.load_default_certs()
+
         return context
 
     def do_export(self, buffered_id: int, data: bytes, mime: str) -> None:

ops/charm.py

@@ -1222,8 +1222,11 @@ def set_destination(self, *, url: Optional[str], ca: Optional[str] = None) -> No
         Args:
             url: The URL of the "collector", the destination for tracing data.
                  Example: 'http://localhost:4318/v1/traces'
-            ca: The PEM-formatted server certificate authority list.
+            ca: The PEM-formatted server certificate authority list content.
                 This argument is in effect only if the ``url`` is an HTTPS URL.
+
+        To use the system CA list, supply ``ca=None``. To use the Mozilla CA list distributed in
+        the ``certifi`` package, use ``ca=Path(certifi.where()).read_text()``.
         """
         with tracer.start_as_current_span('ops.SetupTracingEvent.set_destination') as span:
             span.set_attribute('url', url or '')