test: add test tls/mtls

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## 1.51.0 [unreleased]
 
+### Documentation
+
+1. [#721](https://github.com/influxdata/influxdb-client-python/pull/721): Add examples for configure TLS/mTLS for the Influxdb client.
+
 ### Bug Fixes
 
 1. [#706](https://github.com/influxdata/influxdb-client-python/pull/706): Use logger instead logging.

README.md

@@ -1535,6 +1535,28 @@ Both HTTP request headers and body will be logged to standard output.
 
 <!-- marker-logging-end -->
 
+### Config TLS/mTLS
+
+<!-- marker-configtls-start -->
+
+Configure TLS/mTLS for InfluxDBClient.
+
+Support both separated certificate and key files or certificate and key bundled in one .pem file. 
+
+-   sources - [config_tls_mtls.py](https://github.com/influxdata/influxdb-client-python/blob/master/examples/config_tls_mtls.py)
+
+``` python
+with InfluxDBClient("https://localhost:8081",
+                    token="my-token",
+                    verify_ssl=True,
+                    ssl_ca_cert="path/to/server-cert.crt",
+                    cert_file="path/to/client-cert.crt",
+                    cert_key_file="path/to/client-key.key") as client:
+    client.version()
+```
+
+<!-- marker-configtls-end -->
+
 ## Local tests
 
 ``` console

examples/README.md

@@ -42,6 +42,7 @@
 - [influxdb_18_example.py](influxdb_18_example.py) - How to connect to InfluxDB 1.8
 - [nanosecond_precision.py](nanosecond_precision.py) - How to use nanoseconds precision
 - [connection_check.py](connection_check.py) - How to check connection configuration
+- [config_tls_mtls.py](config_tls_mtls.py) - How to configure TLS/mTLS
 
 ## Asynchronous
 - [asynchronous.py](asynchronous.py) - How to use Asyncio with InfluxDB client

examples/config_tls_mtls.py

@@ -0,0 +1,36 @@
+import ssl
+
+from influxdb_client import InfluxDBClient
+
+path_client_cert_file = "path/to/cert_file.crt"
+path_client_key_file = "path/to/cert_file.key"
+path_client_cert_file_pem = "path/to/cert_file.pem"
+
+path_server_cert = "path/to/server_cert.crt"
+
+# Config mTLS with client send certificate to the server with separated .crt file and .key file.
+# `ssl_ca_cert` is optional.
+with InfluxDBClient("https://localhost:8081",
+                    token="my-token",
+                    verify_ssl=True,
+                    ssl_ca_cert=path_server_cert,
+                    cert_file=path_client_cert_file,
+                    cert_key_file=path_client_key_file) as client:
+    client.version()
+
+# Config mTLS with client send a certificate to the server with both certificate and key bundled inside a .pem file.
+# `ssl_ca_cert` is optional.
+with InfluxDBClient("https://localhost:8081",
+                    token="my-token",
+                    verify_ssl=True,
+                    ssl_ca_cert=path_server_cert,
+                    cert_file=path_client_cert_file_pem) as client:
+    client.version()
+
+# Configure TLS with SSLContext; omit cert_file, cert_key_file and ssl_ca_cert when supplying a configured context.
+ssl_context = ssl.create_default_context(cafile=path_server_cert)
+with InfluxDBClient("https://localhost:8081",
+                    token="my-token",
+                    verify_ssl=True,
+                    ssl_context=ssl_context) as client:
+    client.version()

scripts/generate-self-signed-cert.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+#
+# The MIT License
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+#
+
+set -e
+
+PKCS12_PASSWORD="changeit"
+INFLUXDB_SERVER_NAME="influxdb"
+OTHER_SERVER_NAME="other-server"
+CERTS_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../tests/test_data/certificates" && pwd)"
+
+# Gen Server .crt and .key with SAN then convert to .p12 file
+for SERVER_NAME in "$INFLUXDB_SERVER_NAME" "$OTHER_SERVER_NAME"; do
+  echo "### Generate server key and certificate for $SERVER_NAME..."
+  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 | openssl pkcs8 -topk8 -nocrypt -out "$CERTS_DIR/${SERVER_NAME}.key"
+
+  openssl req -new -x509 -key "$CERTS_DIR/${SERVER_NAME}.key" -out "$CERTS_DIR/${SERVER_NAME}.crt" -days 3650 \
+    -subj "/CN=localhost/O=Development/C=US" \
+    -addext "subjectAltName = DNS:localhost,IP:127.0.0.1"
+
+  cat "$CERTS_DIR/${SERVER_NAME}.crt" "$CERTS_DIR/${SERVER_NAME}.key" > "$CERTS_DIR/${SERVER_NAME}.pem"
+
+#  openssl pkcs12 -export -in "$CERTS_DIR/${SERVER_NAME}.crt" -inkey "$CERTS_DIR/${SERVER_NAME}.key" \
+#    -out "$CERTS_DIR/${SERVER_NAME}.p12" -name "myalias" -password "pass:$PKCS12_PASSWORD"
+done
+
+# Gen Client .crt and .key then convert to .p12 file
+echo "### Generate client key..."
+openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 | openssl pkcs8 -topk8 -nocrypt -out "$CERTS_DIR/client.key"
+openssl req -new -x509 -key "$CERTS_DIR/client.key" -out "$CERTS_DIR/client.crt" -days 3650 \
+  -subj "/CN=test-client/O=Development/C=US"
+
+cat "$CERTS_DIR/client.crt" "$CERTS_DIR/client.key" > "$CERTS_DIR/client.pem"
+
+#openssl pkcs12 -export -in "$CERTS_DIR/client.crt" -inkey "$CERTS_DIR/client.key" \
+#  -out "$CERTS_DIR/client.p12" -name "myalias" -password "pass:$PKCS12_PASSWORD"