Proper way to make django-allauth aware of a private CA root certificate ?

[pandaem0nium]

Hello,

Django-allauth has been integrated to paperless-ngx some time ago, and I'm trying to make OIDC working with my setup (traefik, paperless-ngx, keycloak and step-ca - a private CA from Smallstep - under docker).

I confirm I've added my private CA root certificate to the trust store of the paperless container and I'm able to curl my keycloak's OpenID endpoint from it, but django does not seem to be aware of this certificate, and throws errors when I try to sign in.

[...]
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)`
[...]

I've first opened a discussion here, which might give more infos.

I'd like to know if there is a way to make django-allauth aware of private certificates.

[pennersr]

There is nothing specific in allauth for this. Use one of the approaches sketched here:

https://levelup.gitconnected.com/using-custom-ca-in-python-here-is-the-how-to-for-k8s-implementations-c450451b6019

Note that all requests are made using this adapter method...

    get_requests_session():

...so you can override that to alter the requests session if needed.

[pandaem0nium]

Unfortunately, I am no dev.

But adding the REQUESTS_CA_BUNDLE in my docker-compose.yml solved the issue.

Thank you @pennersr.