0

I’m writing a Python script that will monitor our Tesla PowerWall Gateway, but am stuck on this SSL problem.

HTTPSConnectionPool(host='powerwall', port=443): Max retries exceeded with url: /api/system_status/soe (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)')))

import json
import os
import requests
import sys
from requests.auth import HTTPDigestAuth

if __name__ == "__main__":

    scriptPath = os.path.split(os.path.abspath(__file__))[0] # Where am I, and the local copy of the cert
    #scriptPath = os.path.split(requests.certs.where(),)[0]  # Where is requests looking for certs?
    
    cert = os.path.join(scriptPath, 'PW2.pem')
    #os.environ['REQUESTS_CA_BUNDLE'] = cert
    #os.environ['REQUESTS_CA_BUNDLE'] = scriptPath
        
    try:
        response = None
        query = "https://powerwall/api/system_status/soe"   
        with requests.Session() as session:
            session.auth = (HTTPDigestAuth('myEmail', 'PW_PWD'))
            session.timeout = 20
            session.verify = True
            #session.verify = cert
            #session.load_cert_chain = "PW2.pem"
            #session.load_cert_chain = cert
            response = session.get(query)
    except Exception as e:
        print(str(e))

Despite all I’ve tried I still can’t get past this error. Yes, setting verify=False is an obvious work-around, but I’m trying to do this the ‘right’ way.

Setup:

  • Windows 10 PC
  • Python 3.8.2

I’ve downloaded the certificate from the Gateway and added it to the Local Machine store on my PC, in the Trusted Root Certification Authorities folder.

Windows can open it OK, showing the various SANs, including “powerwall”, which is how I’m addressing it in my call to requests.get. That says to me the integrity of the cert is good. (Its 'intended purposes' are Server Authentication & Client Authentication.)

I’ve installed python-certifi-win32, then later uninstalled it and installed pip-system-certs as per this SO answer to no avail.

I’ve added the PW’s cert to cacert.pem in the folder returned by requests.certs.where(): C:\Python38\lib\site-packages\certifi\cacert.pem

The commented-out code are variations I’ve performed along the way.

In the doco for ‘requests’ is a mention of this issue: “For example: Self-signed SSL certificates specified in REQUESTS_CA_BUNDLE will not be taken into account.” and a way around it, but that wasn’t successful either.

What have I missed?

Please don’t tell me it’s the 2047 expiry date of the cert…

TIA.

greiginsydney
  • 23
  • 5

0 Answers0