ssl certificate verify apparently works with ssl client but not with urllib3

Question

I am having a very similar problem to that discussed here

I am using python 3.4 with urllib3 library.

When I test the code below, i get:

Traceback (most recent call last):
File "/home/julimatt/zibawa3/zib3/lib/python3.4/site-packages/requests/packages/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/home/julimatt/zibawa3/zib3/lib/python3.4/site-packages/requests/packages/urllib3/connectionpool.py", line 345, in _make_request
    self._validate_conn(conn)
  File "/home/julimatt/zibawa3/zib3/lib/python3.4/site-packages/requests/packages/urllib3/connectionpool.py", line 844, in _validate_conn
    conn.connect()
  File "/home/julimatt/zibawa3/zib3/lib/python3.4/site-packages/requests/packages/urllib3/connection.py", line 326, in connect
    ssl_context=context)
  File "/home/julimatt/zibawa3/zib3/lib/python3.4/site-packages/requests/packages/urllib3/util/ssl_.py", line 324, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/lib/python3.4/ssl.py", line 364, in wrap_socket
    _context=self)
  File "/usr/lib/python3.4/ssl.py", line 578, in __init__
    self.do_handshake()
  File "/usr/lib/python3.4/ssl.py", line 805, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/julimatt/zibawa3/zib3/lib/python3.4/site-packages/requests/adapters.py", line 423, in send
    timeout=timeout
  File "/home/julimatt/zibawa3/zib3/lib/python3.4/site-packages/requests/packages/urllib3/connectionpool.py", line 630, in urlopen
    raise SSLError(e)
requests.packages.urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/julimatt/workspace2/zibawa/stack_configs/tests.py", line 44, in test_bind_grafana
    result=getFromGrafanaApi(apiurl, data,'GET')
  File "/home/julimatt/workspace2/zibawa/stack_configs/models.py", line 317, in getFromGrafanaApi
    verify=ca_certs,
  File "/home/julimatt/zibawa3/zib3/lib/python3.4/site-packages/requests/sessions.py", line 609, in send
    r = adapter.send(request, **kwargs)
  File "/home/julimatt/zibawa3/zib3/lib/python3.4/site-packages/requests/adapters.py", line 497, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)

My code is:

from requests import Request, Session
ca_certs='/path/to/letsencypt/fullchain.pem'  
url= 'https://myserver.com:3000/api/org'

username= settings.DASHBOARD['user']
password= settings.DASHBOARD['password']

headers = {'Accept': 'application/json',
               'Content-Type' : 'application/json',}

s = Session()
req = Request('GET',  url, data=data, headers=headers, auth=(username,password))

prepped = s.prepare_request(req)

resp = s.send(prepped,
verify=ca_certs,

)

print(resp.status_code)
return resp

If I test my code with 'verify=False' in the request, then it works fine but that is obviously not a secure solution.

I tried to test my ssl connection from a terminal on the same machine using:

openssl s_client -connect myserver.com:3000 -CAfile /path/to/letsencypt/fullchain.pem

Then I get a succesful handshake.

So I cannot understand why I get this error.

Thanks in advance for any help you can provide.

score 0 · Answer 1 · answered Apr 11 '17 at 11:20

I had not understood which root certificate to use and had been using the intermediate certs instead.

SOLUTION:

Following help from the letsencrypt community I copied the DST Root CA X3 from https://www.identrust.com/certificates/trustid/root-download-x3.html. I also had to add the lines "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" to my file. Then saving this file I was able to set "ca_certs" to point to this file when calling the apis from python and "verify_certs" now works.

ssl certificate verify apparently works with ssl client but not with urllib3

1 Answers1