"""TLS handshake to the actual host; no HTTP/session/database writes or certificate bypass."""
from pathlib import Path
import hashlib,json,socket,ssl
ROOT=Path(__file__).resolve().parent.parent
OUT=ROOT/'outputs/investmoz-country02-https-20261011'
PRIVATE=ROOT/'storage/app/private/investmoz-v2/portal-audit'
expected=json.loads((OUT/'certificado-ativo-proposto.json').read_text())
context=ssl.create_default_context(cafile=str(OUT/'certificados-publicos/portal-investidor.test-fullchain.pem'))
try:
    with socket.create_connection(('portal-investidor.test',443),timeout=10) as raw:
        with context.wrap_socket(raw,server_hostname='portal-investidor.test') as connection:
            digest=hashlib.sha256(connection.getpeercert(binary_form=True)).hexdigest()
            assert digest==expected['leaf_sha256'],'Unexpected actual leaf certificate'
            result={'result':'passed','origin':'https://portal-investidor.test','protocol':connection.version(),
                    'leaf_sha256':digest,'host_chain_validated':True,'actual_browser_trust_still_requires_browser_proof':True,'HTTP_requests':0}
except Exception as error:
    result={'result':'waiting_for_actual_Apache_certificate','origin':'https://portal-investidor.test','error_type':type(error).__name__,'HTTP_requests':0}
(PRIVATE/'country-https-active-tls-20261011.json').write_text(json.dumps(result,indent=2),encoding='utf-8')
print(json.dumps(result))