I am using JiraClient.py see: * https://community.atlassian.com/t5/Jira-questions/How-to-get-list-of-worklogs-through-JIRA-REST-API/qaq-p/533633 * https://gist.github.com/dblanchette/b8ed8cf42431f56024c1c70ed5137e0f When I first ran it, after generating a JIRA API Token, it worked fine. However, now I am getting an error like this: * urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='XXXXX.atlassian.net', port=443): Max retries exceeded with url: /rest/api/3/worklog/updated?since=1601801936618 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1076)'))) I even tried generating a brand new token, and it doesn't work with that either. Any ideas? Thanks, Larry

Hi @Larry Weisberg , If I understand correctly you are trying to call a Jira Cloud REST API endpoint using jira_client.py and this is now returning an SSL error, while it was working fine before. If this is correct, can you please check the following: * In the script you have only entered your email address as the username and the API Token associated to it. You left all the other values set to "none" * You are able to call the same endpoint successfully using Curl. If this does not work please add the -D- argument and paste the response in here (replace : , , and with the appropriate values):curl -u : -D- -X GET "http:// .atlassian.net/rest/api/3/worklog/updated?since= " Cheers, Dario

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

REST api using token ow gives SSL error

Larry Weisberg

I am using JiraClient.py

see:

When I first ran it, after generating a JIRA API Token, it worked fine. However, now I am getting an error like this:

urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='XXXXX.atlassian.net', port=443): Max retries exceeded with url: /rest/api/3/worklog/updated?since=1601801936618 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1076)')))

I even tried generating a brand new token, and it doesn't work with that either.

Any ideas?

Thanks,

Larry

Accepted answers

Dario B

Hi @Larry Weisberg ,

If I understand correctly you are trying to call a Jira Cloud REST API endpoint using jira_client.py and this is now returning an SSL error, while it was working fine before.

If this is correct, can you please check the following:

In the script you have only entered your email address as the username and the API Token associated to it. You left all the other values set to "none"
You are able to call the same endpoint successfully using Curl. If this does not work please add the -D- argument and paste the response in here (replace : <EMAIL-ADDRESS>, <API-TOKEN>, <NAME> and <TIMESTAMP> with the appropriate values):
```
curl -u <EMAIL-ADDRESS>:<API-TOKEN> -D- -X GET "http://<NAME>.atlassian.net/rest/api/3/worklog/updated?since=<TIMESTAMP&gt;"
```

Cheers,
Dario

All comments

Nic Brough -Adaptavist-

The SSL certificate your call is presenting to the server is not valid. You will need to change to a valid certificate.

Larry Weisberg

Thanks Nic!

I am using JiraClient from https://gist.github.com/dblanchette/b8ed8cf42431f56024c1c70ed5137e0f and basically my code does this:

    client = JiraClient("larry.weisberg@pragroup.com", "XYXYXYX") # Token value
    recent_worklogs = client.retrieve_worklogs_updated_since(datetime.now() - timedelta(days=14))

JiraClient constructor does this:

class JiraClient:
def __init__(
    self,
    username: str = None,
    api_token: str = None,
    access_token: str = None,
    access_token_secret: str = None,
    consumer_key: str = None,
    key_cert: str = None,
):
self._user_url = os.getenv("JIRA_SERVER", "").rstrip("/")
self._base_url = f"{self._user_url}/rest/api/3"

if username and api_token:
    self._session = requests.Session()
    self._session.auth = (username, api_token)
    return

And retrieve worklogs :

   response = self._session.get(url)

This is where failure occurs, where URL is just a REST api that does work from Browser; Also it used to work from this script.

Basically - where is the ssl Cert created, used in the code? Why/How would it have changed?

Dario B

Hi @Larry Weisberg ,

If I understand correctly you are trying to call a Jira Cloud REST API endpoint using jira_client.py and this is now returning an SSL error, while it was working fine before.

If this is correct, can you please check the following:

In the script you have only entered your email address as the username and the API Token associated to it. You left all the other values set to "none"
You are able to call the same endpoint successfully using Curl. If this does not work please add the -D- argument and paste the response in here (replace : <EMAIL-ADDRESS>, <API-TOKEN>, <NAME> and <TIMESTAMP> with the appropriate values):
```
curl -u <EMAIL-ADDRESS>:<API-TOKEN> -D- -X GET "http://<NAME>.atlassian.net/rest/api/3/worklog/updated?since=<TIMESTAMP&gt;"
```

Cheers,
Dario

Larry Weisberg

Thanks @Dario B

Correct - I just call:
client = JiraClient("my.email.address@company.com", "TOKEN_XYXYXYXYX")
If I add verify=False in the call to
```
self._session.get(url) ...
```
then it works.

If I just do the http portion from Browser:

https://company.atlassian.net/rest/api/3/worklog/updated?since=1601798047737

then it works fine; but doing curl:

curl -u my.email.address@company.com:TOKEN_XYXYXYXYX -D- -X GET "https://company.atlassian.net/rest/api/3/worklog/updated?since=1601798047737"

fails with:

curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

I guess not so surprising that curl behaves same way that Python does; what is most surprising is that when I ran it the first few times, I did not get errors..

Thanks,

Larry

Dario B

Hi @Larry Weisberg,

This is super weird and a bit concerning at the same time, since we don't have any self-signed certificate in the certificate chain for Atlassian Cloud products.

You can double check this by using the SSLShopper Certificate Checker or any other tool to check certificates:

SSLShopper:

OpenSSL:

openssl s_client -showcerts -servername XXXXXX.atlassian.net -connect XXXXX.atlassian.net:443

CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "Atlassian Network Services, Inc.", CN = *.atlassian.net
verify return:1
---
Certificate chain
0 s:C = US, ST = California, L = San Francisco, O = "Atlassian Network Services, Inc.", CN = *.atlassian.net
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
...
...

Now, if this error is only happening from the command line but not from the browser, there are chances your OS is using some old/outdated CA store (maybe an old version of openssl was installed recently).

In order to doble-check this, please do the following:

Compare the certificate you get from the browser with the one you get from command line (you can use the openssl command in above example) in order to make sure that's the same one and exclude there is anything weird going on.
Once verified the certificate is correct/the same, you should update the CA store used by your OS (or by python, if it's not the same).

For further details, you might want to see below links:

Cheers,
Dario

Larry Weisberg

Thanks @Dario B - that sounds promising... Might not get to it till next week but I'll take a look, (assuming instructions on the links are clear enough :-), or maybe my IT guy can help out).

Thanks!
Larry

Ian Jia Ern Khoo

@Dario B @Nic Brough -Adaptavist- Hi Nic and Dario,

I'm having some issues with accessing JIRA Cloud using my python script. I am using the bearer token authentication method. Previously, it also showed a 401 authentication error because of the SSL certification. Was wondering if you could help me with this. Thank you.

import jira.client

from jira.client import JIRA

jira_client = JIRA(options={'server':'my-site.com','request':False}, basic_auth=('jira_username', 'bearer_token_here'))

issue = jira_client.issue('XXXX-191')

print(issue.fields.summary)

Dario B

Hi @Ian Jia Ern Khoo ,

Please notice that adding an unrelated reply a thread from 2 years ago that is marked as resolved (answer accepted) is not the best way to get help.

However, in short:

There's no such thing as bearer token authentication for Jira Cloud REST API. The allowed authentication methods are the ones listed in: https://developer.atlassian.com/cloud/jira/platform/security-overview/
From what I see your script is (indeed) using basic authentication and not bearer token authentication.
In order to use basic authentication you have to provide an Atlassian account email address and API token, as explained in the following page: Basic auth for REST APIs
The code snippet you attached seems to have some generic placeholders data instead of real data and therefore there's not much I can say, other that 'my-site.com' is not a valid Jira Cloud URL and that you should provide email address and api token instead of username and bearer token.
As suggested/mentioned many times in this thread you may want to send the same request with CURL in order to double check whether the issue is with your code or with the data you are providing

Finally, if nothing helps, I strongly advise to create a new thread providing more details on what you are doing together with the error message as well as the same request sent using Curl (removing the sensitive data like email address and api token).

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

jira-software

jira-software-cloud

atl-gruland