SSL CERTIFICATE_VERIFY_FAILED aws cli

[daniellewbush]

@awstools
@jamesls
@JordonPhillips

Thanks in advance!!

AWS CLI version 1.15.10
RHEL 7.4

.aws/config:
[default]
output = text
region = us-east-1

Instance has a role associated allowing cloudformation full access.
There are no endpoints configured in the ##VPC.

execute $aws ec2 describe-instances
....no error

execute $aws cloudformation describe-stacks
I get [SSL: CERTIFICATE_VERIFY_FAILED ] certificate verify failed (_ssl.c:579)

When I give --no-verify-ssl, it works.

I know I can set the AWS_CA_BUNDLE variable, and/or use it as a switch, but I don't know what cert to use. Do I have to get the proxy cert off the proxy? And why just for aws cloudformation vs. aws ec2?

#3009
Thanks again very much,

[kyleknap]

Yeah this looks similar to the issue that you linked. I'm not entirely sure why it only happens for CloudFormation. If you are not setting the AWS_CA_BUNDLE environment variable and you are using a proxy, my guess is the issue with proxy not correctly handling SSL certs. For reference, this is the CA certificate that we bundle with the AWS CLI. Maybe comparing this one with the one being used with your proxy will help? It is hard to tell without knowing the behavior of your proxy. Any information you can provide would help.

[daniellewbush]

Hey Kyle,  Thanks for the response.  We are using a Sophos UTM, and I haven't been able to sign onto it yet to verify how it's handling the connections. I read there are two ways the Sophos web proxy can handle SSL connections, Standard and Transparent.  I have to look and see what it's doing. I did manage to figure out the reason between ec2 and cloudformation; ec2 calls go to endpoint ec2.us-east-1.amazonaws.com, which accepts both http and https connections, and cloudformation calls go to cloudformation.us-east-1.amazonaws.com, which only takes https.  I think either it's auto negotiating http, or the ec2 endpoint is whitelisted in the Sophos and the cloudformation endpoint isn't.      When I finally get a chance to look at the Sophos, I will let you know what I find.  We managed to get by using the --no-verify-ssl switch for our scripts this time.   Thanks again and best regards, Danielle  On Monday, April 30, 2018, 7:54:25 PM EDT, Kyle Knapp <notifications@github.com> wrote: Yeah this looks similar to the issue that you linked. I'm not entirely sure why it only happens for CloudFormation. If you are not setting the AWS_CA_BUNDLE environment variable and you are using a proxy, my guess is the issue with proxy not correctly handling SSL certs. For reference, this is the CA certificate that we bundle with the AWS CLI. Maybe comparing this one with the one being used with your proxy will help? It is hard to tell without knowing the behavior of your proxy. Any information you can provide would help. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[daniellewbush]

Found the problem, the Sophos was using web proxy in Standard mode and did not have the endpoint cloudformation.us-east-1.amazonaws.com in the list of excepted domains to allow traffic.

[aegixx]

Same problem here, but Kaspersky was the cause.

Disabling "Check HTTPS connections" fixed.