Allow to disable SSL certificate validation

[letmaik]

2020-12-01 11:19:31.668: 'Exception Creating Socket: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)'

I'm trying to test an SSL-only API locally where the certificate is self-signed. I couldn't find an option to disable certificate validation.

[rifiles]

Hi Maik,

I believe the command-line option you're looking for is --no_ssl

[letmaik]

no_ssl: bool (default False)

Set to True to disable SSL for requests

Doesn't sound like it to be honest. Are you sure?

[rifiles]

I'm sorry, I believe you're correct - I answered too quickly. At the moment RESTler doesn't have an option to disable Python's default certificate validation.

The entirety of the SSL code in RESTler can be found in messaging.py and the HttpSock constructor:

            self._sock = None
            host = Settings().host
            target_ip = self.connection_settings.target_ip or host
            target_port = self.connection_settings.target_port
            if Settings().use_test_socket:
                self._sock = TestSocket(Settings().test_server)
            elif self.connection_settings.use_ssl:
                context = ssl.create_default_context()
                with socket.create_connection((target_ip, target_port or 443)) as sock:
                    self._sock = context.wrap_socket(sock, server_hostname=host)
            else:
                self._sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                self._sock.connect((target_ip, target_port or 80))

The ssl.create_default_context call performs the certificate checks by default. I think it should be possible to use ssl._create_unverified_context() or ssl._create_unverified_https_context() here, which hopefully could resolve your issue?

[rifiles]

Hi Maik,

I made a quick update on branch rifiles/92. Would you mind giving it a try on your API when you get a chance?

To disable you'll just need to add "disable_cert_validation": true to the settings file.

Thanks a lot

[stishkin]

@letmaik - Are you running on Linux or Windows ? We are using RESTler on Linux container and using these instructions to add certificates to Linux store worked for us.

https://askubuntu.com/questions/645818/how-to-install-certificates-for-command-line

[letmaik]

The certs are temporary and I'd like to avoid adding them system-wide. A CLI flag to define the cert to use or alternatively an option to disable cert validation sounds more attractive to me.

[marina-p]

Since the flag to disable cert validation has been added, closing this issue.