"--no-verify" option doesn't work

[rganz]

When I try to connect to my cluster on Azure using sfctl I get an error. I assume it is because of the self-signed certificates.

sfctl cluster select --endpoint https://cluster.region.cloudapp.azure.com:19080 --pem ./cluster.pem
Error occurred in request., SSLError: HTTPSConnectionPool(host='cluster.region.cloudapp.azure.com', port=19080): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

Then I pass the --no-verify option, I just get another error that this is not recomended. But then nothing happens.

sfctl cluster select --endpoint https://cluster.region.cloudapp.azure.com:19080 --pem ./cluster.pem --no-verify
c:\program files\python36\lib\site-packages\urllib3\connectionpool.py:858: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
  InsecureRequestWarning)

I reach the SF Explorer page with Chrome without any problems.
curl of https://cluster.region.cloudapp.azure.com:19080 works als well, when I pass the certificate and the --insecure option.

sfctl version is 3.0.0.
sf runtime version is 6.1.456.9494
hosting on Azure

[samedder]

@rganz what doesn't work? Can you run sfctl node list? The warning will always be displayed, it's a reminder that you're performing an insecure operation.

[rganz]

Oh, that works. I was expecting some feedback to cluster select like a "sucessfully selected".

[paolosalvatori]

Is there any way to eliminate the warning? It's very annoying, thanks

[Christina-Kang]

Thank you for the feedback, @paolosalvatori ! We can look into an option to suppress the warnings when explicitly requested.

@suhuruli for visibility

[samedder]

The warning is meant to be annoying. It's also not coming from our CLI, but a warning from the underlying SSL library. It is meant to warn you. One option is to start securing your cluster with certificates that are trusted by the root CA bundle.

…

________________________________ From: Christina Kang - MSFT <notifications@github.com> Sent: Thursday, September 6, 2018 10:45 To: Microsoft/service-fabric-cli Cc: Edward Samson; Comment Subject: Re: [Microsoft/service-fabric-cli] "--no-verify" option doesn't work (#65) Thank you for the feedback, @paolosalvatori<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fpaolosalvatori&data=02%7C01%7Cedwardsa%40microsoft.com%7C54344189c35847d7df9708d614207b30%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636718527069183921&sdata=INnWyWzGnVbcqe%2BKjpNZZ74UXYOdJ7IWPvK5nRCMtoA%3D&reserved=0> ! We can look into an option to suppress the warnings when explicitly requested. @suhuruli<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fsuhuruli&data=02%7C01%7Cedwardsa%40microsoft.com%7C54344189c35847d7df9708d614207b30%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636718527069183921&sdata=3YS3URCMt0KTVXUwUHfqA4bHqLA3732oeFALXzZpLUI%3D&reserved=0> for visibility — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMicrosoft%2Fservice-fabric-cli%2Fissues%2F65%23issuecomment-419181915&data=02%7C01%7Cedwardsa%40microsoft.com%7C54344189c35847d7df9708d614207b30%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636718527069183921&sdata=t01%2BmNEgWgpPKkftsUwALg9xpjGGE1xPm1J%2B6eX6qdw%3D&reserved=0>, or mute the thread<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAZgr0tvPH2INrbtDPFW6nQC-P3Ns_Wqzks5uYV8hgaJpZM4R7SOQ&data=02%7C01%7Cedwardsa%40microsoft.com%7C54344189c35847d7df9708d614207b30%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636718527069183921&sdata=yorrtd1qOTOiw2f18MvKMOAFc19RnVLIAjCItbGrSR8%3D&reserved=0>.

[suhuruli]

There are two good pieces of feedback on this thread.

1. @rganz, brought up a good point of having a message letting users know the connection was successful.

2. @paolosalvatori, your point of getting rid of that warning is valid. Instead of spamming the user's terminal, we can just display the warning once and then not show it for future commands.