Changing the DigiD-configuration shows certificate verify failed

[joeribekker]

Version 2.5.4

Sentry 353824

Kon de metadata niet verwerken. De fout is: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1007)>

Saving the DigiD configuration with a valid configuration (and PKIO cert) leads to the above error for both pre-prod as prod. I suspect this has to do with version 2.5.3 which updated to DigiD-library version 0.12.0.

This worked - configuration was saved - in an earlier version of Open Forms.

[sergei-maertens]

Probably this worked because the configuration never attempted to load the metadata from URL before, since this error can be traced back to: https://github.com/maykinmedia/django-digid-eherkenning/blob/57d68ad456fbe3f27031706830e641f77087b190/digid_eherkenning/models/base.py#L210

which comes because the python3-saml tooling is used to retrieve the metadata: https://github.com/maykinmedia/django-digid-eherkenning/blob/57d68ad456fbe3f27031706830e641f77087b190/digid_eherkenning/models/base.py#L200

and that thing itself is using urllib2.Request rather than requests, so it's not making use of our patched root certificate store which includes the G1 certificate. Looking at the code, the only option is to either validate the cert without being able to specify a bundle, or not validate the certificate at all :/

[sergei-maertens]

I created an upstream issue SAML-Toolkits/python3-saml#403 - but next week I can work on a fix in our python3-saml fork.

[sergei-maertens]

Needs to be backported as far as stable/2.4.x