ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] cer

问题:

I'm currently working on python to QlikSense server connection using websocket-client. for authentication, I have used certificates which are generated by Qlik sense server.

Even I followed the same logic of code mentioned at this link, but still getting an error.

from websocket import create_connection

def conn(senseHost, userDirectory, userId, privateKeyPath):

    # self.url = "wss://" + senseHost + ":4747/app/" # invalid
    url = "wss://" + senseHost + ":4747/app"  # valid
    ca = open(privateKeyPath + "root.pem").read()
    cer = open(privateKeyPath + "client.pem").read()
    key = open(privateKeyPath + "client_key.pem").read()
    certs = ({"ca": ca,
              "cert": cer,
              "key": key})
    # import pdb
    # pdb.set_trace()
    # ERROR raised here.
    ws = create_connection(url, sslopt=certs,
                                header={'X-Qlik-User: UserDirectory=%s; UserId=%s' % (userDirectory, userId)})
    session = self.ws.recv()
    return session

# below code has specific perameters.
c = conn("blablah.com","XYZ","ME","path/to/cert/")

I traced an error using pdb,

-> ws = create_connection(url,sslopt=certs,header={'X-Qlik-User: UserDirectory=%s; UserId=%s' % (userDirectory, userId)})
(Pdb) n
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)

回答1:

I found a solution after 4 hours of effort.

def conn(senseHost, userDirectory, userId, privateKeyPath):
    url = "wss://" + senseHost + ":4747/app"  # valid
    certs = ({"ca_certs": privateKeyPath + "root.pem",
              "certfile": privateKeyPath + "client.pem",
              "keyfile": privateKeyPath + "client_key.pem",
              "cert_reqs":ssl.CERT_REQUIRED,
              "server_side": False
              })
    ssl.match_hostname = lambda cert, hostname: True
    ws = create_connection(url, sslopt=certs,
                                header={'X-Qlik-User: UserDirectory=%s; UserId=%s'% (userDirectory, userId)})