Trying to validate my certificate and getting the following error: failed to open CA file: No such process
when I run in Python
print(ssl.get_default_verify_paths())
Result: cafile: None, capath: None
SSL_CERT_FILE AND SSL_CERT_DIR are shown, but how do i create a ca certificate containing this information in Windows?
Related
I'm trying to Setup webtatic yum source for php-fpm in ansible playbook.
My code is:
- name: Setup webtatic yum source for php-fpm
yum: name=https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
It fails with the error:
fatal: [test.example.com]: FAILED! => {"changed": false, "msg": "**Failed to validate the SSL certificate for mirror.webtatic.com:443. Make sure your managed systems have a valid CA certificate installed. You can use validate_certs=False if you do not need to confirm the servers identity but this is unsafe and not recommended.** Paths checked for this platform: /etc/ssl/certs, /etc/pki/ca-trust/extracted/pem, /etc/pki/tls/certs, /usr/share/ca-certificates/cacert.org, /etc/ansible. The exception msg was: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)."}
How can I write it correctly?
This tends to happen when your managed node does not have the CA root certificate bundle installed.
A possible fix would be to verify it is present before trying to install your rpm:
- name: Setup webtatic yum source for php-fpm
yum:
name: "{{ packages }}"
vars:
packages:
- ca-certificates # This package contains the required CA root certificate bundle
- https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
The problem root might be in your local time if it is not synchronized correctly.
I assume that you have ca-certificates package already installed.
The CA certificate issues are sometimes related to the incorrect time.
openssl s_client -host mirror.webtatic.com -port 443 \
-CAfile /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
Look for Verify return code: 9 (certificate is not yet valid) or notBefore=...
Please, try to install the ntp and ntpdate packages, then synchronize your time. There is an example for CentOS how to do it: https://thebackroomtech.com/2019/01/17/configure-centos-to-sync-with-ntp-time-servers/
This should fix your problem if it was due to unsynchronized time.
I want to use miniconda3 to install a package but it pops that error:
Solving environment: failed
CondaHTTPError: HTTP 000 CONNECTION FAILED for url <https://repo.anaconda.com/pkgs/main/noarch/repodata.json.bz2>
Elapsed: -
An HTTP error occurred when trying to retrieve this URL. HTTP errors are often intermittent, and a simple retry will get you on your way.
If your current network has https://www.anaconda.com blocked, please file a support request with your network engineering team.
SSLError(SSLError(SSLError("bad handshake: SysCallError(104, 'ECONNRESET')",),),)
BTW, the miniconda2 runs wells only miniconda3 has the problem.
PS. I also tried to use wget --no-check-certificate to download the file and got the error too:
wget https://repo.anaconda.com/pkgs/main/linux-64/repodata.json.bz2
--2019-03-14 02:03:44-- https://repo.anaconda.com/pkgs/main/linux-64/repodata.json.bz2
Resolving repo.anaconda.com (repo.anaconda.com)... 104.16.130.3,
104.16.131.3, 2606:4700::6810:8303, ...
Connecting to repo.anaconda.com (repo.anaconda.com)|104.16.130.3|:443... connected.
Unable to establish SSL connection.
The system is CentOS and I have already use sudo yum update to update the sys file and library.
i seem to be unable to upload data into my mongo db hosted on atlas. I have copied the exact steps posted here. https://www.w3schools.com/python/python_mongodb_insert.asp
import pymongo
import requests
url= "mongodb://jordan:*********#jordandb-shard-00-00-ykcna.mongodb.net:27017,jordandb-shard-00-01-ykcna.mongodb.net:27017,jordandb-shard-00-02-ykcna.mongodb.net:27017/test?ssl=true&replicaSet=JordanDB-shard-0&authSource=admin&retryWrites=true"
client = pymongo.MongoClient(url)
mydb = client.test
mycol = mydb["customers"]
mydict = {"name":"John", "adress":"Highway 37"}
x = mycol.insert_one(mydict)
print(client.list_database_names())
I am receiving a timeout error. Every line works until i get to the insert line (x = ....). I am using pycharm and python 3.7. However I have also tried this on jupyter and have received the same error:
pymongo.errors.ServerSelectionTimeoutError: jordandb-shard-00-00-ykcna.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056),jordandb-shard-00-01-ykcna.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056),jordandb-shard-00-02-ykcna.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)
Here are the steps I am following to get the url
There's a couple of reasons for this.
The most obvious one would be that you're missing the certificate chain.
You can get the chain information from issuing:
openssl s_client -showcerts -servername jordandb-shard-00-00-ykcna.mongodb.net -connect jordandb-shard-00-00-ykcna.mongodb.net:27017 </dev/null
Which will tell you that it's from DigiCert. So either you're missing that certificate chain in your local certificate store (some distro's might need you to install a root ca trust). But if you do have root ca's installed. It's time to check the validation times on the cert.
If you add | openssl x509 -noout -dates you'll get the valid dates for this certificate:
openssl s_client -showcerts -servername jordandb-shard-00-00-ykcna.mongodb.net -connect jordandb-shard-00-00-ykcna.mongodb.net:27017 </dev/null | openssl x509 -noout -dates
Which tells you the certificate is from DigiCert.
And the certificate is valid from 7/02-19 00:00 GMT to 11/2-19 12:00 GMT.
Running date in any terminal should hopefully tell you that you're in between these two dates.
In any other case, I would say this is due to a self signed certificate.
In which case you would need to do one of two things:
MongoClient(..., ssl_ca_certs='/path/to/ca.pem')
MongoClient(..., ssl_cert_reqs=ssl.CERT_NONE)
To either supply your custom CA or tell Mongo to ignore certificate validation (the later being the worst possible option. Even if you say "I won't forget to fix that later", heh).
You Can Use pymongo default function
connObj = MongoClient(MONGO_HOST, MONGO_PORT)
connObj[MONGO_DB].authenticate(MONGO_UNAME, MONGO_PASSWD)
I set up a Mosquitto broker in a Raspberry Pi and created self-signed TLS server certificate with OpenSSL. Configuration works as I can connect successfully with Moquitto client from terminal, as well as from MQTTBox and MQTT.fx.
However when trying to connect with Python and Paho-MQTT following error
import paho.mqtt.client as mqtt
# SETTINGS & CONSTANTS
(...)
TLS_CA = "./tls/mqtt.crt"
# MQTT CALLBACKS
(...)
# INIT & CONNECT CLIENT
client = mqtt.Client(DEVICE_ID)
(...)
client.tls_set(TLS_CA)
client.username_pw_set(MQTT_USER, MQTT_PSWD)
client.connect(MQTT_HOST, MQTT_PORT, MQTT_KEEPALIVE)
I get the following error:
File "/usr/lib/python3.4/ssl.py", line 804, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:600)
I've tried many things:
1) Insert self-signed certificate into Raspbian ca-certificates
sudo mkdir /usr/local/share/ca-certificates/extra
sudo cp mqtt.crt /usr/local/share/ca-certificates/extra/mqtt.crt
sudo update-ca-certificates
2) Play with Paho's tls_set() options. I think ca_certs=mqtt.crt and tls_version=ssl.PROTOCOL_TLSv1 should be enough.
3) Use tls_insecure_set(True). I know this is not a valid solution, but I just wanted to try if something happen. Result is still CERTIFICATE_VERIFY_FAILED error
4) Use Python 2.7.9 and Python 3.4.2
I've actually run out of ideas
After long time trying and reading everywhere I realized the problem was caused by self-signed certificates. I generated new certificates with different Common Names for CA and broker and everything seems to work fine.
I'm using Windows 10 OS.
I want to count the number of IP Address of AWS.
I use python 2.7.14 and boto 2.6.0
I add a file which name is boto.config locate C:\Users\Administrator folder
The content of the boto.config is:
[Credentials]
aws_access_key_id=******
aws_secret_access_key=*****
The script is :
#!/usr/bin/env python
# -*- encoding: utf8 -*-
import boto.ec2
from pprint import pprint
import ssh
import requests
import urllib3
import certifi
import ssl
conn = boto.ec2.connect_to_region('cn-north-1')
reservations = conn.get_all_instances()
InstanceMap=[]
for reservation in reservations:
for instance in reservation.instances:
if 'env' in instance.tags and instance.tags['env'] == 'test':
InstanceMap.append(instance.ip_address)
f = open('F:\ip.txt','w')
pprint(InstanceMap, f)
When I run this script, it show the error formation:
SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)
What's the method can I solve this problem ?
I was having same issue with boto3 and Python 3.7 on Windows 10 machine. As it turned out, since I was using corporate device with Proxy installed, *.amazonaws.com certificate was getting replaced by the Proxy certificate. This Proxy certificate chain needed to be trusted by Python certifi module. Whether or not, you have a proxy, below method should resolve SSL: CERTIFICATE_VERIFY_FAILED error.
Here is what I did, to resolve the issue -
Find the path where cacert.pem is located -
Install certifi, if you don't have. Command: pip install certifi
import certifi
certifi.where()
C:\\Users\\[UserID]\\AppData\\Local\\Programs\\Python\\Python37-32\\lib\\site-packages\\certifi\\cacert.pem
Set AWS_CA_BUNDLE environment variable to the cacert.pem path -
AWS_CA_BUNDLE=C:\Users\[UserID]\AppData\Local\Programs\Python\Python37-32\Lib\site-packages\certifi\cacert.pem
Download the chain of certificates from amazonaws.com URL. For example: Go to https://sts.amazonaws.com/xyz on a browser and export Root, all the intermediate certificates, domain cert and save as base64 encoded .cer file. Open the certificates in notepad, copy all the contents.
Now open the cacert.pem in a notepad and just add every downloaded certificate contents (---Begin Certificate--- *** ---End Certificate---) at the end.
Restart the command line prompt or PowerShell, SSL verification error should be resolved.
Do not use is_secure = False in your organization's envrionments. This is essentially disabling SSL verification.
Try adding is_secure = False like below, in order to skip ssl verification,
conn = boto.ec2.connect_to_region('cn-north-1',is_secure=False)
Try providing the credentials as so, that way you would know if the keys in boto config are old if this works, and if this returns the same issue then you need to check your api-key and secret on aws.
API_KEY = 'Actual API_KEY'
API_SECRET = 'Actual Secret'
conn = boto.ec2.connect_to_region('us-east-2',aws_access_key_id=API_KEY,aws_secret_access_key=API_SECRET,is_secure=False)