certificate verify failed

[alemsas]

I wrote this python code and i want to connect with my netbox to looking for something:

import pynetbox
import requests
from dotenv import load_dotenv
import os
import csv

load_dotenv()

#requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

session = requests.Session()
session.verify = '/home/sasan/check_health/ca-bundle.pem'
session.cert = ('/home/sasan/check_health/cert.pem', '/home/sasan/check_health/key.pem')
session.timeout = 60


netbox = pynetbox.api(
    os.getenv('NETBOX_URL'),
    token=os.getenv('NETBOX_TOKEN'),
    threading=False
)

devices = netbox.dcim.devices.filter(manufacturer='hpe')

for device in devices:
    print(f"Device : {device.name}")

and i gfet this after running

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/urllib3/contrib/pyopenssl.py", line 485, in wrap_socket
    cnx.do_handshake()
  File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1915, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1647, in _raise_ssl_error
    _raise_current_error()
  File "/usr/lib/python3/dist-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
    raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 666, in urlopen
    httplib_response = self._make_request(
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 377, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 1001, in _validate_conn
    conn.connect()
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 366, in connect
    self.sock = ssl_wrap_socket(
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 383, in ssl_wrap_socket
    return context.wrap_socket(sock)
  File "/usr/lib/python3/dist-packages/urllib3/contrib/pyopenssl.py", line 491, in wrap_socket
    raise ssl.SSLError("bad handshake: %r" % e)
ssl.SSLError: ("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
    resp = conn.urlopen(
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 720, in urlopen
    retries = retries.increment(
  File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 436, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='172.31.0.151', port=8443): Max retries exceeded with url: /api/dcim/devices/?manufacturer=hpe&limit=0 (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "simin_ilo.py", line 26, in <module>
    for device in devices:
  File "/usr/local/lib/python3.8/dist-packages/pynetbox/core/response.py", line 127, in __next__
    next(self.response), self.endpoint.api, self.endpoint
  File "/usr/local/lib/python3.8/dist-packages/pynetbox/core/query.py", line 291, in get
    req = self._make_call(add_params=add_params)
  File "/usr/local/lib/python3.8/dist-packages/pynetbox/core/query.py", line 241, in _make_call
    req = getattr(self.http_session, verb)(
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 548, in get
    return self.request('GET', url, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 535, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 648, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='172.31.0.151', port=8443): Max retries exceeded with url: /api/dcim/devices/?manufacturer=hpe&limit=0 (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))

also if I do

session.verify = False

I get answer from my netbox,but this code will be run into production and i dont want to session.verify be false.
also here is my certificates into my path:

-rw-r--r-- 1 root root 1.9K Jun  7 13:05 ca-bundle.pem
-rw-r--r-- 1 root root 1.9K Jun  7 13:05 cert.pem
-rw------- 1 root root 3.2K Jun  7 13:05 key.pem

and Also I get

openssl verify -CAfile /home/sasan/check_health/ca-bundle.pem /home/sasan/check_health/cert.pem

/home/sasan/check_health/cert.pem: OK

and have this structure for ca-bundle.pem

-----BEGIN CERTIFICATE-----
****************
-----END CERTIFICATE-----

and

openssl s_client -connect 172.31.0.151:8443 -CAfile /home/sasan/check_health/ca-bundle.pem

CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 CN = netbox
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = netbox
verify return:1
---
Certificate chain
 0 s:CN = netbox
   i:CN = netbox
---

where is my problem?please help me!

[markkuleinio]

https://pynetbox.readthedocs.io/en/latest/advanced.html

For example:

    netbox = pynetbox.api(netbox_url, token=netbox_token)
    session = requests.Session()
    session.verify = netbox_ca
    netbox.http_session = session

[alemsas]

@markkuleinio
I change code to this:

import pynetbox
import requests
from dotenv import load_dotenv
import os
import csv

load_dotenv()

#requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

netbox = pynetbox.api(
    os.getenv('NETBOX_URL'),
    token=os.getenv('NETBOX_TOKEN')
)

session = requests.Session()
session.verify = "/home/sasan/check_health/ca-bundle.pem"
netbox.http_session = session

devices = netbox.dcim.devices.filter(manufacturer='hpe')

for device in devices:
    print(f"Device : {device.name}")

and still have same error, also I have tried with this one https://requests.readthedocs.io/en/stable/user/advanced/#ssl-cert-verification

[markkuleinio]

You have a self-signed cert, right, and no separate CA? What is the hostname you are trying to connect to? If it is something else than "netbox" (the CN of your cert), this verify=path setting is not helping because the hostnames don't match.

[alemsas]

yes I use docker container for my nginx,that works on

 netbox-docker-nginx-1

and the hostname on this container is diffrent!
so what can I do?!
@markkuleinio

[markkuleinio]

Just make sure that your self-signed certificate has common name that matches the hostname that you use in your NETBOX_URL

[alemsas]

@markkuleinio thanks mark, I change my local machine hostname and it solved!