Skip to content

SSL certificate verify fails even if disabled in environment file #281

@mikkonie

Description

@mikkonie

I ran into an issue with SSL certificate verification. We had a problem with the certificate on an iRODS server, so as a temporary workaround I set "irods_ssl_verify_server": "none" in my environment file.

After this I'm able to successfully run iinit from icommands and bypass the verification.

However, if I try to create an iRODSSession with python-irodsclient using the same environment file, I end up with the following error:

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1131)

This makes me suspect there is either a bug in bypassing the verification in the python client, or something wrong with my environment file which only affects the client.

I'm using python-irodsclient v1.0.0. My icommands and the server are both at v4.2.10.

My environment looks as follows:

{
  "irods_host": "server-host-here",
  "irods_port": 1247,
  "irods_authentication_scheme": "PAM",
  "irods_client_server_negotiation": "request_server_negotiation",
  "irods_client_server_policy": "CS_NEG_REQUIRE",
  "irods_ssl_verify_server": "none",
  "irods_ssl_certificate_file": "server.crt",
  "irods_zone_name": "ourZone",
  "irods_user_name": "user-name-here",
  "irods_cwd": "/ourZone/home/user-name-here",
  "irods_home": "/ourZone/home/user-name-here",
  "irods_default_hash_scheme": "MD5",
  "irods_encryption_algorithm": "AES-256-CBC",
  "irods_encryption_key_size": 32,
  "irods_encryption_num_hash_rounds": 16,
  "irods_encryption_salt_size": 8
}

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions