SSL for Tornado

[Fabio[mbutubuntu]Buda]

hello folks! is there any way to use SSL with tornado without using a
reverse Proxy?

best regards,

Fabio Buda
Web Developer/Designer @ netdesign
http://www.netd.it/

[JohnMudd]

From: https://github.com/facebook/tornado/blob/master/tornado/httpserver.py


HTTPServer can serve HTTPS (SSL) traffic with Python 2.6+ and OpenSSL.
To make this server serve SSL traffic, send the ssl_options dictionary
argument with the arguments required for the ssl.wrap_socket() method,
including "certfile" and "keyfile":

HTTPServer(applicaton, ssl_options={
"certfile": os.path.join(data_dir, "mydomain.crt"),
"keyfile": os.path.join(data_dir, "mydomain.key"),
})



On Nov 12, 2:03 pm, "Fabio[mbutubuntu]Buda" <mbutubu...@yahoo.it>
wrote:

[abdullah mohamed mohamed abdelrhim]

please indicate where expactly i but this code
thanks

[JohnMudd]

Here's more code.


if __name__ == "__main__":
application = tornado.web.Application([
(r"/", MainHandler),
])
http_server = tornado.httpserver.HTTPServer(applicaton,

ssl_options={
"certfile": os.path.join(data_dir, "mydomain.crt"),
"keyfile": os.path.join(data_dir, "mydomain.key"),

})

http_server.listen(8888)
tornado.ioloop.IOLoop.instance().start()



On Nov 21, 5:32 pm, abdullah mohamed mohamed abdelrhim

<eng.abod...@gmail.com> wrote:
> please indicate where expactly i but this code
> thanks
>

[Ben Darnell]

For testing purposes you can make a certificate using the openssl
command line tool, but these certificates will cause warnings in the
browser. For actual use you'll need a certificate signed by a CA.

-Ben

On Sat, Sep 15, 2012 at 11:40 AM, ESP <in...@ischematics.com> wrote:
> does the certificate have to be one from a cert authority, or can we make
> one somehow with python?

[aliane abdelouahab]

and for HTTPS, the developpement must be in port 443 and not 80?

[aliane abdelouahab]

sorry, i mean Deployement

[Ben Darnell]

Yes. You can develop on any port you like, but for deployment you
will (usually) want to use 80 for http and 443 for https.

-Ben

[ischematics.com]

Does anyone know if there are some standard ports that are generally open .. i have an application where it seems some people have issues at work, etc .. usually on port 8082, but 8080 is fine .. i would use 80 but i don't know how to release it on the mac, it is always in use by something ... 

[Frank Smit]

Only a root user can use ports below 1024.

And Nginx is usually put in front of Tornado as a proxy. In this case
Nginx is on port 80 (or 443 for HTTPS) and proxies requests for
Tornado to port 8080 for example.

[ischematics.com]

What is nginx, is it built into tornado?

ed

[Frank Smit]

Nginx is a webserver.

http://en.wikipedia.org/wiki/Nginx

[aliane abdelouahab]

tornado is built on python, and python suffers from GIL (it is not
good for threading), so to get maximum response on a server, they use
a load balancer, think about this exemple: you have 10 kids every one
wants some sweeties, and you have in your hand 100 sweeties, so
instead of giving the first one 10 and let all the other stay untill
you finish the 10, just give them all 1 (one) and you make what is
called a "round robbin"
so it's the same thing with nginx and tornado; you start for example 4
instances of tornado (you make a copy of the application 4 times,
everytime you change the file with a different port number (for
exemple: 8001, 8002, 8003, 8004) and then you tell nginx to make the
"link" between them.
nginx is also a good solution for serving your static files (css,
images...) so tornado will handle dynamic requests (building the
webpage) and nginx will fill them will colors ;)
hope i was right.

On 16 sep, 21:55, "ischematics.com" <i...@ischematics.com> wrote:
> What is nginx, is it built into tornado?
>
> ed
>
>
>
>
>
>
>
> On Sun, Sep 16, 2012 at 3:45 PM, Frank Smit <fr...@61924.nl> wrote:
> > Only a root user can use ports below 1024.
>
> > And Nginx is usually put in front of Tornado as a proxy. In this case
> > Nginx is on port 80 (or 443 for HTTPS) and proxies requests for
> > Tornado to port 8080 for example.
>

> > On Sun, Sep 16, 2012 at 9:47 PM, ischematics.com <i...@ischematics.com>

[aliane abdelouahab]

thank you, because never uses the https.
maybe this is why i dont get the HTML5 <keygen> element?

[Srini Kommoori]

@ed as others mentioned best practice is to have nginx(web server) in front of tornado(app server).

Here is the docs page with sample nginx settings. http://www.tornadoweb.org/documentation/overview.html#running-tornado-in-production

On the SSL, even though tornado can handle SSL, I would go with nginx as SSL endpoint. There are multiple cipher options that could be part of the SSL and some are good for handling max connections. With nginx you get full control of the cipher settings.

I would recommend to read http://matt.io/technobabble/hivemind_devops_alert:_nginx_does_not_suck_at_ssl for nginx ssl_cipher settings and how it impacts on supporting max connections.

hth

[Ed Pataky]

well it sounds interesting but i load tested my servers and they do just fine with tornado for hundreds of simultaneous connections .. not sure what the benefit is .. i put different machines on different ports and balance that way as well assigning users to different ports (machines) 

[Srini Kommoori]

@ed use whatever works and you are comfortable with. 

On SSL, Here is summary from the link I sent earlier:

1. Find what cipher your server is using. openssl s_client -host HOSTNAME -port 443

2. I would recommend to go with AES256-SHA for maximum speed and max connections. 

On, reverse proxy, it allows you to run multiple tornado servers to make use of multiple cores your machine might have. 

[Ed Pataky]

i see ok thank you 

[mert gokkaya]

Not sure if anybody is still around and still have vivid memories of this discussion, but this was the closest approach to a nice python, tornado design.  Someone asked where to put this code, and Im sure I put the code to the right place, but I am guessing so many things changed with CORS and other browser technologies I wonder if the code need an upgrade.

Just a shot to 7 years ago, see what happens

[John Mudd]

Sorry, I don't recall. 

--
You received this message because you are subscribed to a topic in the Google Groups "Tornado Web Server" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/python-tornado/CKsG1Tk2iPI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to python-tornad...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/python-tornado/edaef79d-d2b7-447d-bb68-900b74d47ae0%40googlegroups.com.