Add testing to confirm that the server fails as expected if CERT_REQUIRED is set and the client doesn't send a cert.

Author: kareem-wolfssl

tests/test_client.py

@@ -25,6 +25,8 @@
 
 import pytest
 import wolfssl
+from wolfssltestserver import wolfSSLTestServer
+from threading import Thread
 
 HOST = "www.python.org"
 PORT = 443
@@ -89,3 +91,64 @@ def test_get_version(ssl_server, ssl_version, tcp_socket):
     assert secure_socket.version() == protocol_name
     secure_socket.write(b'hello wolfssl')
     secure_socket.read(1024)
+
+
+def test_client_cert_verification_failure():
+    """
+    Test that a connection fails when the server requires client certificates
+    but the server's CA (globalsign) does not verify the client's certificate.
+    """
+    import socket
+    import time
+
+    # Create a server with CERT_REQUIRED and globalsign CA
+    # This server will require client certificates but won't accept
+    # certificates signed by a different CA
+    port = 11111
+    with wolfSSLTestServer(
+        ('localhost', port),
+        version=wolfssl.PROTOCOL_TLS,
+        verify=wolfssl.CERT_REQUIRED
+    ) as server:
+        server_thread = Thread(target=server.handle_request)
+        server_thread.daemon = True
+        server_thread.start()
+
+        # Give the server a moment to start
+        time.sleep(0.1)
+
+        # Create a client socket
+        client_tcp_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+
+        # Create a client context
+        client_ctx = wolfssl.SSLContext(wolfssl.PROTOCOL_TLS)
+
+        # Wrap the socket with the client context
+        # Set do_handshake_on_connect=False so we can explicitly call do_handshake()
+        # and catch the error
+        client_socket = client_ctx.wrap_socket(
+            client_tcp_socket,
+            do_handshake_on_connect=False
+        )
+
+        # Connect the TCP socket first
+        client_socket.connect(('127.0.0.1', port))
+
+        # Attempt handshake - this should fail because the client does not
+        # send a cert/key.
+        with pytest.raises(wolfssl.SSLError) as exc_info:
+            client_socket.do_handshake()
+            # Handshake appeared to succeed, try to read/write to trigger the error
+            # The server should reject the connection due to certificate verification failure
+            client_socket.write(b'hello')
+            client_socket.read(1024)
+
+        # Clean up (errors during close are expected if connection failed)
+        try:
+            client_socket.close()
+        except Exception:
+            pass
+        try:
+            client_tcp_socket.close()
+        except Exception:
+            pass