enable client certificates / two-way SSL #23

Activity

1. nuvoladev commented on Dec 13, 2016

   

   nuvoladev

   on Dec 13, 2016

   More actions

   Hi mxmader,

   I'm interested in this feature enabling client certificates as I got a 'certificate verify failed' error when I try to connet to GitLab using https:

   gitlab_url    = "https://...:8445"
   private_token = "..."
   
   try:
       print "====> version: %s " % gitlab.__version__
       gl = gitlab.Gitlab(gitlab_url, private_token, ssl_verify=True)
       #gl = gitlab.Gitlab(gitlab_url, private_token, ssl_verify=True, headers={"SSL_CERT_FILE": "/products/software/gitlab/ssl/certs/git.ca"})
       gl.enable_debug()
       gl.auth()
       print "[gitlab_authentication: SUCCESS]"
   
   except Exception as e:
       print "**** [ERROR] execution failed. %s" % str(e)
   
   output: 
   ====> version: 0.16 
   INFO:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): ...
   **** [ERROR] execution failed. Can't connect to GitLab server ([SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:765))
   
   ====> version: 0.16 
   **** [ERROR] execution failed. __init__() got an unexpected keyword argument 'headers'
   

   May I ask you when you plan to deliver that feature ?

   I thank you in advance
   nuvoladev
2. mxmader commented on Dec 13, 2016

   

   mxmader

   on Dec 13, 2016

   Author

   More actions

   In some spare time I put together this commit you could try if indeed your web server which serves your GitLab instance requires client certificates. Although, it looks like 1) upstream has wrapped "ssl_verify" and 2) your particular case requires first passing in the path to a list of CA certs that includes the needed portion of the signing chain (I assume you're using a private CA) so that your client side calls work.

   If you're using a self-signed server cert (which is not the same as a server cert signed by a private CA), then you could simply supply the path of that server cert as a string for the "ssl_verify" argument (non-positional) of the GitLab class constructor.

   https://github.com/mxmader/python-gitlab/commit/ae8ccd14f501be827205caa6afb270882427ae47

   I haven't had delved into writing tox style tests for python packages just yet, so I hesitate to make a pull request, unless of course the author comments here with a willingness to advise.
3. nuvoladev commented on Dec 13, 2016

   

   nuvoladev

   on Dec 13, 2016

   More actions

   Hi mxmader,

   thanks a lot for your suggestion, it works!

       gl = gitlab.Gitlab(gitlab_url, private_token, ssl_verify="/products/software/gitlab/ssl/certs/git.ca")
   
       output: 
       ====> version: 0.16 
       INFO:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): …
       /usr/lib/python2.7/site-packages/urllib3/connection.py:251: SecurityWarning: Certificate has no         `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497 for details.)
         SecurityWarning
       send: 'GET /api/v3/user HTTP/1.1\r\nHost: …:8445\r\nPRIVATE-TOKEN: …\r\nAccept-Encoding: gzip, deflate\r\nAccept: */*\r\nUser-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-327.10.1.el7.x86_64\r\nConnection: keep-alive\r\nAuthorization: Basic Tm9uZTpOb25l\r\n\r\n'
       reply: 'HTTP/1.1 200 OK\r\n'
       header: Server: nginx
       header: Date: Tue, 13 Dec 2016 09:48:05 GMT
       header: Content-Type: application/json
       header: Content-Length: 635
       header: Connection: keep-alive
       header: Status: 200 OK
       header: ETag: "2bf86ab074081935d2eb44d7875692e8"
       header: Cache-Control: max-age=0, private, must-revalidate
       header: X-Request-Id: 5e427194-ae16-4340-9fa6-ff2f9c15e453
       header: X-Runtime: 0.161846
       DEBUG:requests.packages.urllib3.connectionpool:"GET /api/v3/user HTTP/1.1" 200 635
       [gitlab_authentication: SUCCESS]
   
4. gpocentek

   closed this as completedin fa89746on Nov 3, 2017
5. github-actions

   locked as resolved and limited conversation to collaborators on Nov 10, 2021