SSL connection to TRINO

[asterixas]

Hello, Could you please help me !
I tried to connect to Trino which is developed on Openshift platform. Whatever i do i get error like -failed to execute: HTTPSConnectionPool(host='dafa-test-trino-dafa-test.apps.ocptest.lbank.lt', port=443): Max retries exceeded with url: /v1/statement (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1002)'))),
I tried to attach python certificate directly to container, i tried disbale ssl validation , nothing helped, the same message. Could you please help us, advise us how we can avoid such kind of error. Disbale SSL verification for me good too, if no other way to solve it.

[wwwy3y3]

Are you using a self-signed certificate ?

[ennox108]

we have the same issue and we are using a self signed certificate. Is there a way to add our self signed certificate to trust store? How do we do it?
Which container file is used as the trust file?

[jesset]

Using self signed certificate in trino should modify wren-engine.

You should add a arg verify= to ibis.trino.connect

Ref:

https://github.com/trinodb/trino-python-client?tab=readme-ov-file#self-signed-certificates

https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification

I simply modified it like this (MY_CA_CERT_PATH mount as volume to ibis-server container):

--- a/ibis-server/app/model/data_source.py
+++ b/ibis-server/app/model/data_source.py
@@ -1,6 +1,7 @@
 from __future__ import annotations

 import base64
+import os
 import ssl
 from enum import Enum, StrEnum, auto
 from json import loads
@@ -201,6 +202,11 @@ class DataSourceExtension(Enum):

     @staticmethod
     def get_trino_connection(info: TrinoConnectionInfo) -> BaseBackend:
+        ca_cert_path = os.environ.get('MY_CA_CERT_PATH')
+        verify = ca_cert_path if ca_cert_path else False
+
         return ibis.trino.connect(
             host=info.host.get_secret_value(),
             port=int(info.port.get_secret_value()),
@@ -208,6 +214,7 @@ class DataSourceExtension(Enum):
             schema=info.trino_schema.get_secret_value(),
             user=(info.user and info.user.get_secret_value()),
             password=(info.password and info.password.get_secret_value()),
+            verify=verify,
         )

     @staticmethod

[rara011088]

@jesset I am trying to add the verify= variable as well, since this change occurs in ibis-server, does that mean I only need to rebuild the ibis-server image and not the wren-engine image?

[jesset]

yes , indeed On Apr 28, 2025, at 11:50, rara011088 ***@***.***> wrote: rara011088 left a comment (Canner/WrenAI#1502) @jesset I am trying to add the verify= variable as well, since this change occurs in ibis-server, does that mean I only need to rebuild the ibis-server image and not the wren-engine image? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>