How to Mock an mTLS Client Certificate in Python

import ssl
import socket
import subprocess
import tempfile
from pathlib import Path

def create_mock_certificates():
    """Generate self-signed client certificate and key for mTLS testing."""
    with tempfile.TemporaryDirectory() as tmpdir:
        cert_path = Path(tmpdir) / "client.crt"
        key_path = Path(tmpdir) / "client.key"
        
        subprocess.run([
            "openssl", "req", "-x509", "-newkey", "rsa:2048",
            "-keyout", str(key_path), "-out", str(cert_path),
            "-days", "365", "-nodes",
            "-subj", "/CN=mock-client"
        ], check=True, capture_output=True)
        
        return cert_path, key_path

def create_mtls_context(cert_file, key_file):
    """Create a TLS client context with client certificate for mTLS."""
    context = ssl.create_default_context()
    context.load_cert_chain(certfile=str(cert_file), keyfile=str(key_file))
    context.verify_mode = ssl.CERT_REQUIRED
    context.check_hostname = False
    return context

def mock_mtls_connection():
    """Simulate an mTLS client connection attempt."""
    cert_file, key_file = create_mock_certificates()
    context = create_mtls_context(cert_file, key_file)
    
    try:
        # Attempt connection to a test server (will fail but demonstrates context)
        with socket.create_connection(("127.0.0.1", 9443), timeout=0.5) as sock:
            with context.wrap_socket(sock, server_hostname="mock-server") as tls_sock:
                return f"Connected with cert: {tls_sock.getpeercert()}"
    except (ConnectionRefusedError, socket.timeout):
        return f"Connection refused (expected) - mTLS context ready with cert: {cert_file.name}"

if __name__ == "__main__":
    result = mock_mtls_connection()
    print(result)