SSLError CERTIFICATE_VERIFY_FAILED from script

Question

I run this issue when trying to access Jira tickets from script (https://github.com/paulkass/jira-vim/issues/45). can anyone give any suggestion? appreciate it. ``` WARNING:root:HTTPSConnectionPool(host='contrail-jws.atlassian.net', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate ve rify failed (_ssl.c:852)'),)) while doing GET http://contrail-jws.atlassian.net/rest/api/2/serverInfo [{'params': None, 'headers': {'User-Agent': 'python-requests/2.18.4', 'Accept-Encoding': 'gzip, deflate', 'Acce pt': 'application/json,*.*;q=0.9', 'Connection': 'keep-alive', 'Cache-Control': 'no-cache', 'Content-Type': 'application/json', 'X-Atlassian-Token': 'no-check'}}] WARNING:root:Got ConnectionError [HTTPSConnectionPool(host='contrail-jws.atlassian.net', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_F AILED] certificate verify failed (_ssl.c:852)'),))] errno:None on GET http://contrail-jws.atlassian.net/rest/api/2/serverInfo {'response': None, 'request': }\{'response': None, 'request': } WARNING:root:Got recoverable error from GET http://contrail-jws.atlassian.net/rest/api/2/serverInfo, will retry [1/3] in 4.73581502661891s. Err: HTTPSConnectionPool(host='contrail-jws.atlassian.net', port=443): Ma x retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),)) WARNING:root:HTTPSConnectionPool(host='contrail-jws.atlassian.net', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate ve rify failed (_ssl.c:852)'),)) while doing GET http://contrail-jws.atlassian.net/rest/api/2/serverInfo [{'params': None, 'headers': {'User-Agent': 'python-requests/2.18.4', 'Accept-Encoding': 'gzip, deflate', 'Acce pt': 'application/json,*.*;q=0.9', 'Connection': 'keep-alive', 'Cache-Control': 'no-cache', 'Content-Type': 'application/json', 'X-Atlassian-Token': 'no-check'}}] WARNING:root:Got ConnectionError [HTTPSConnectionPool(host='contrail-jws.atlassian.net', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_F AILED] certificate verify failed (_ssl.c:852)'),))] errno:None on GET http://contrail-jws.atlassian.net/rest/api/2/serverInfo {'response': None, 'request': }\{'response': None, 'request': } WARNING:root:Got recoverable error from GET http://contrail-jws.atlassian.net/rest/api/2/serverInfo, will retry [2/3] in 26.081873285053465s. Err: HTTPSConnectionPool(host='contrail-jws.atlassian.net', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),)) WARNING:root:HTTPSConnectionPool(host='contrail-jws.atlassian.net', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate ve rify failed (_ssl.c:852)'),)) while doing GET http://contrail-jws.atlassian.net/rest/api/2/serverInfo [{'params': None, 'headers': {'User-Agent': 'python-requests/2.18.4', 'Accept-Encoding': 'gzip, deflate', 'Acce pt': 'application/json,*.*;q=0.9', 'Connection': 'keep-alive', 'Cache-Control': 'no-cache', 'Content-Type': 'application/json', 'X-Atlassian-Token': 'no-check'}}] WARNING:root:Got ConnectionError [HTTPSConnectionPool(host='contrail-jws.atlassian.net', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_F AILED] certificate verify failed (_ssl.c:852)'),))] errno:None on GET http://contrail-jws.atlassian.net/rest/api/2/serverInfo {'response': None, 'request': }\{'response': None, 'request': } WARNING:root:Got recoverable error from GET http://contrail-jws.atlassian.net/rest/api/2/serverInfo, will retry [3/3] in 34.15810895544876s. Err: HTTPSConnectionPool(host='contrail-jws.atlassian.net', port=443): M ax retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),)) WARNING:root:HTTPSConnectionPool(host='contrail-jws.atlassian.net', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate ve rify failed (_ssl.c:852)'),)) while doing GET http://contrail-jws.atlassian.net/rest/api/2/serverInfo [{'params': None, 'headers': {'User-Agent': 'python-requests/2.18.4', 'Accept-Encoding': 'gzip, deflate', 'Acce pt': 'application/json,*.*;q=0.9', 'Connection': 'keep-alive', 'Cache-Control': 'no-cache', 'Content-Type': 'application/json', 'X-Atlassian-Token': 'no-check'}}] Traceback (most recent call last): File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 601, in urlopen chunked=chunked) File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 346, in _make_request self._validate_conn(conn) File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 852, in _validate_conn conn.connect() File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 326, in connect ssl_context=context) File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 329, in ssl_wrap_socket return context.wrap_socket(sock, server_hostname=server_hostname) File "/usr/lib/python3.6/ssl.py", line 407, in wrap_socket _context=self, _session=session) File "/usr/lib/python3.6/ssl.py", line 817, in __init__ self.do_handshake() File "/usr/lib/python3.6/ssl.py", line 1077, in do_handshake self._sslobj.do_handshake() File "/usr/lib/python3.6/ssl.py", line 689, in do_handshake self._sslobj.do_handshake() ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/requests/adapters.py", line 440, in send timeout=timeout File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 639, in urlopen _stacktrace=sys.exc_info()[2]) File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 388, in increment raise MaxRetryError(_pool, url, error or ResponseError(cause)) ```

Dave Theodore [Coyote Creek Consulting] · Answer

You're using a self-signed or otherwise untrusted CA for your cert. You will either need to make your script trust the cert or ignore the CA check. You could also purchase a SSL cert from a Commercial CA and set Jira up to use that. I hope that helps.

ping song · Answer

curl gives:

```

* Rebuilt URL to: https://contrail-jws.atlassian.net/
* Trying 18.234.32.173...
* TCP_NODELAY set
* Connected to contrail-jws.atlassian.net (18.234.32.173) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS Unknown, Certificate Status (22):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS Unknown, Certificate Status (22):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (OUT), TLS alert, Server hello (2):
* SSL certificate problem: self signed certificate in certificate chain
* stopped the pause stream!
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

```

curl -k works...

I don't want to ignore this error, but I can't find a clue..

Dave Theodore [Coyote Creek Consulting] · Answer

Not much to go by here.  Try connecting with `curl` Things I would verify:

* Self-signed cert?
* Expired cert?
* Missing intermediate cert?
* Hostname mismatch.

You'll either need to figure out what the SSL problem is or tell your script to ignore SSL errors (potentially dangerous.)