etcd certificate validation failure on trixie - urllib3 edition
ActivePublic
Actions

Authored by Scott_French on Fri, Oct 2, 4:15 PM.

Project Tags

None

Referenced Files

	F105850876: etcd certificate validation failure on trixie - urllib3 edition
	Fri, Oct 2, 4:15 PM

Subscribers

None

	swfrench@deploy1003:~$ cat test.py
	try:
	from urllib3.contrib import pyopenssl
	pyopenssl.inject_into_urllib3()
	except ImportError:
	print("No pyopenssl.inject_into_urllib3()")
	pass

	import urllib3

	kw = {'maxsize': 10, 'timeout': 60}
	http = urllib3.PoolManager(num_pools=10, **kw)
	print(http.request("GET", "https://conf1009.eqiad.wmnet:4001/v2/machines").status)
	swfrench@deploy1003:~$ python3 test.py
	No pyopenssl.inject_into_urllib3()
	200

	# switch hosts

	swfrench@cumin2003:~$ python3 test.py
	Traceback (most recent call last):
	File "/usr/lib/python3/dist-packages/urllib3/contrib/pyopenssl.py", line 510, in wrap_socket
	cnx.do_handshake()
	~~~~~~~~~~~~~~~~^^
	File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 2373, in do_handshake
	self._raise_ssl_error(self._ssl, result)
	~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
	File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1990, in _raise_ssl_error
	_openssl_assert(
	~~~~~~~~~~~~~~~^
	reason == _lib.SSL_R_UNEXPECTED_EOF_WHILE_READING
	^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
	)
	^
	File "/usr/lib/python3/dist-packages/OpenSSL/_util.py", line 76, in openssl_assert
	exception_from_error_queue(error)
	~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^
	File "/usr/lib/python3/dist-packages/OpenSSL/_util.py", line 62, in exception_from_error_queue
	raise exception_type(errors)
	OpenSSL.SSL.Error: [('SSL routines', '', 'certificate verify failed')]

	[ ... snip ... ]

	swfrench@cumin2003:~$ cat test_fixed.py
	try:
	from urllib3.contrib import pyopenssl
	pyopenssl.inject_into_urllib3()
	except ImportError:
	print("No pyopenssl.inject_into_urllib3()")
	pass

	import urllib3
	import ssl

	kw = {'maxsize': 10, 'timeout': 60, 'cert_reqs': ssl.CERT_NONE}
	urllib3.disable_warnings()
	http = urllib3.PoolManager(num_pools=10, **kw)
	print(http.request("GET", "https://conf1009.eqiad.wmnet:4001/v2/machines").status)
	swfrench@cumin2003:~$ python3 test_fixed.py
	200

Event Timeline

Scott_French created this paste.Fri, Oct 2, 4:15 PM

Scott_French mentioned this in T440009: etcd client fails on debian trixie with urllib3.exceptions.SSLError when appropriate CA certs are not provided.Fri, Oct 2, 4:28 PM

etcd certificate validation failure on trixie - urllib3 editionActivePublicActions

Event Timeline

etcd certificate validation failure on trixie - urllib3 edition
ActivePublic
Actions