-
Notifications
You must be signed in to change notification settings - Fork 532
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Docker option to pass CA file (for self-signed CA) #479
Comments
Having the same issue, haven't found a solution yet... |
Yes. This seems related to #471 Hope to get this patched this week. |
@royrusso thanks for closing this issue and i am running Docker image
Me to facing the same issue and looking for the fix or workaround |
This also does not work for me either with the latest version.
|
Also getting a [SSL: CERTIFICATE_VERIFY_FAILED] error. Specified a HQ_CA_CERTS var when running the container and this can be seen in the output from 'env' within the container, but it doesn't appear that the custom CA cert location passed by the var is being read when a connection is attempted. Ran opensnoop on the container host and observed which files were being opened in the container when attempting to access a https enabled cluster -
The default cacert.pem bundle is opened, but the custom ca cert is not accessed. Haven't looked into it further, but as a dirty workaround have replaced the container CMD with a chain of commands that will cat the custom ca cert to the default ca bundle before ElasticHQ is started. Docker compose file looks something like this -
|
@royrusso can this issue please be reopened? not being able to test elastichq atm due to this |
I see the bug now: elasticsearch-HQ/application.py Line 27 in e61695a
The internal name used in code is simply |
@royrusso i tried using VERIFY_CERTS also that didnt work, should it? |
Working on a new release. I'll update this when it's out. |
v3.5.6 is released and merged to master. Cross your fingers, because I can't exactly test this feature. ;-) |
I can test it tomorrow and feedback you here if there is a docker container update for it also (on the phone at the moment so cant check) but will feedback tomorrow if so :) |
@royrusso I'm still getting the same: options im using |
Are you setting the |
Yes, here is some more debugging info that might help
|
Make sure you are running 3.5.6. The stack trace I think should include info messages like "SSL is True". Can you post that or the whole log file? |
The version on the gui says it is correct: "You are on the current version: 3.5.6" here you go the full log
|
I added more logging and a new docker is being built. I may have found the problem, but again... difficult for me to test locally. |
Im guessing this is the part you are looking for?
|
Yeah. I just added that. So that's the most recent code changes. Is it working? If not, stack trace? |
I had to run with :development on the docker image to be able to pull this one But no luck yet :(
|
Can you post your ENV vars? Looks like you're running with |
Yes i am, posted them here previously, here they are again
|
Hi, I'm having the problem above with 3.5.12 Passing ENV:
|
Please reopen I have the same problem with latest version |
I am trying to test this now, and can't get the docker to read my cert or turn off verification. |
General information
Issue Description
running ElasticHQ in docker container and passed both HQ_ENABLE_SSL & HQ_CA_CERTS as docker run -p 5000:5000 -e HQ_ENABLE_SSL=true -e HQ_CA_CERTS=/certs/ca.crt -v /config/certs/ca/ca.crt:/certs/ca.crt elastichq/elasticsearch-hq
Source Code / Logs
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='elastic.local', port=9200): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/src/elastichq/service/ConnectionService.py", line 71, in create_connection
response = requests.get(scheme + "://" + ip + ":" + port, timeout=REQUEST_TIMEOUT)
File "/usr/local/lib/python3.6/site-packages/requests/api.py", line 75, in get
return request('get', url, params=params, **kwargs)
File "/usr/local/lib/python3.6/site-packages/requests/api.py", line 60, in request
return session.request(method=method, url=url, **kwargs)
File "/usr/local/lib/python3.6/site-packages/requests/sessions.py", line 533, in request
resp = self.send(prep, **send_kwargs)
File "/usr/local/lib/python3.6/site-packages/requests/sessions.py", line 646, in send
r = adapter.send(request, **kwargs)
File "/usr/local/lib/python3.6/site-packages/requests/adapters.py", line 514, in send
raise SSLError(e, request=request)
The text was updated successfully, but these errors were encountered: