Создание центра сертификации с использованием python - проблема с аутентификацией

Question

Я пытаюсь создать центр сертификации, используя python. Мне удается создать личный ключ клиента, запрос сертификата (CSR), отправить его на сервер и получить сертификат. что я не могу сделать, это зарегистрировать пользователя с его сертификатом

вот как я создаю закрытый ключ и CSR

def create_request_cert():
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
    backend=default_backend()
)

builder = x509.CertificateSigningRequestBuilder()
builder = builder.subject_name(x509.Name([
    x509.NameAttribute(NameOID.COMMON_NAME, u'USER:khlil'),
    x509.NameAttribute(NameOID.COUNTRY_NAME, u'TN'),
    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, u'Tunis'),
    x509.NameAttribute(NameOID.LOCALITY_NAME, u'Tunis'),
]))

builder = builder.add_extension(
    x509.BasicConstraints(ca=False, path_length=None),
    critical=True
)

request = builder.sign(
    private_key,
    hashes.SHA256(),
    default_backend()
)

csr = request.public_bytes(Encoding.PEM)
key = private_key.private_bytes(Encoding.PEM, PrivateFormat.TraditionalOpenSSL, NoEncryption())
return key, csr

вот я даю пользователю сертификат

    client, client_address = cert_emitter_socket.accept()
    print("sending certificate to %s:%s." % client_address)

    csv = client.recv(buff_size)
    # print(csv)
    cert, ca = (create_cert(csv))

    with open('khlil.crt', 'wb')as f:
        f.write(bytes(cert))
    # print('server cert')
    # print(ca)
    client.send(bytes(cert))
    client.send(bytes(ca))
    # client.send(bytes(create_cert(csv)))
    client.close()

и это

csr = x509.load_pem_x509_csr(pem_csr, default_backend())

pem_cert = open('ca.crt', 'rb').read()
ca = x509.load_pem_x509_certificate(pem_cert, default_backend())
pem_key = open('ca.key', 'rb').read()
ca_key = serialization.load_pem_private_key(pem_key, password=None, backend=default_backend())

builder = x509.CertificateBuilder()
builder = builder.subject_name(csr.subject)
builder = builder.issuer_name(ca.subject)
builder = builder.not_valid_before(datetime.datetime.now() - datetime.timedelta(hours=2))
builder = builder.not_valid_after(datetime.datetime.now() + datetime.timedelta(7))
builder = builder.public_key(csr.public_key())
builder = builder.serial_number(int(uuid.uuid4()))
for ext in csr.extensions:
    builder = builder.add_extension(ext.value, ext.critical)

certificate = builder.sign(
    private_key=ca_key,
    algorithm=hashes.SHA256(),
    backend=default_backend()
)
return certificate.public_bytes(serialization.Encoding.PEM), ca.public_bytes(serialization.Encoding.PEM)

проблема, я думаю, находится внутри этих блоков в файле client.py

cert = x509.load_pem_x509_certificate(cert, default_backend())
    client_socket = socket(AF_INET, SOCK_STREAM)
    context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH, cafile='ca.crt')
    context.load_cert_chain('khlil.crt', 'khlil.key')
    context.check_hostname = False
    conn = context.wrap_socket(client_socket, server_side=False)
    conn.connect(chat_addr)
    client_socket.connect(chat_addr)

в файле server.py

context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
context.verify_mode = ssl.CERT_REQUIRED
context.load_cert_chain(certfile='ca.crt', keyfile='ca.key')
# context.load_verify_locations(cafile='khlil.crt')
while True:
    print("Waiting for client")
    newsocket, fromaddr = chat_socket.accept()
    print("Client connected: {}:{}".format(fromaddr[0], fromaddr[1]))
    conn = context.wrap_socket(newsocket, server_side=True)
    print("SSL established. Peer: {}".format(conn.getpeercert()))

I всегда получаю эту ошибку

Exception in thread Thread-2:
Traceback (most recent call last):
  File "C:\Users\User\AppData\Local\Programs\Python\Python38-32\lib\threading.py", line 932, in _bootstrap_inner
    self.run()
  File "C:\Users\User\AppData\Local\Programs\Python\Python38-32\lib\threading.py", line 870, in run
    self._target(*self._args, **self._kwargs)
  File "C:/Users/User/Documents/projects/projet securité/server/ssl-server.py", line 72, in chat
    conn = context.wrap_socket(newsocket, server_side=True)
  File "C:\Users\User\AppData\Local\Programs\Python\Python38-32\lib\ssl.py", line 500, in wrap_socket
    return self.sslsocket_class._create(
  File "C:\Users\User\AppData\Local\Programs\Python\Python38-32\lib\ssl.py", line 1040, in _create
    self.do_handshake()
  File "C:\Users\User\AppData\Local\Programs\Python\Python38-32\lib\ssl.py", line 1309, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1108)