Skip to content

Commit 4a2d9d4

Browse files
authored
Add troubleshooting guide for self-signed SSL cert related error (#2346)
Add troubleshooting guide in README for self-signed SSL certification and proxy server related error.
1 parent cdc136b commit 4a2d9d4

File tree

1 file changed

+29
-0
lines changed

1 file changed

+29
-0
lines changed

README.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1417,6 +1417,35 @@ enabled clusters. If you have different proxy settings for each, then
14171417
please update the necessary proxies (eg. with init scripts) for each
14181418
cluster type.
14191419

1420+
**Local machine to Databricks Account and Workspace connection failed due to proxy and self-signed cert:**
1421+
When customer uses web proxy and self-singed certification, UCX may not be able to connect to Account and Workspace
1422+
with following errors:
1423+
```
1424+
File "/Users/userabc/.databricks/labs/ucx/state/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 466, in _make_request
1425+
self._validate_conn(conn)
1426+
File "/Users/userabc/.databricks/labs/ucx/state/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 1095, in _validate_conn
1427+
conn.connect()
1428+
File "/Users/userabc/.databricks/labs/ucx/state/venv/lib/python3.10/site-packages/urllib3/connection.py", line 652, in connect
1429+
sock_and_verified = _ssl_wrap_socket_and_match_hostname(
1430+
File "/Users/userabc/.databricks/labs/ucx/state/venv/lib/python3.10/site-packages/urllib3/connection.py", line 805, in _ssl_wrap_socket_and_match_hostname
1431+
ssl_sock = ssl_wrap_socket(
1432+
File "/Users/userabc/.databricks/labs/ucx/state/venv/lib/python3.10/site-packages/urllib3/util/ssl_.py", line 465, in ssl_wrap_socket
1433+
ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
1434+
File "/Users/userabc/.databricks/labs/ucx/state/venv/lib/python3.10/site-packages/urllib3/util/ssl_.py", line 509, in _ssl_wrap_socket_impl
1435+
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
1436+
File "/opt/homebrew/Cellar/[email protected]/3.10.14/Frameworks/Python.framework/Versions/3.10/lib/python3.10/ssl.py", line 513, in wrap_socket
1437+
return self.sslsocket_class._create(
1438+
File "/opt/homebrew/Cellar/[email protected]/3.10.14/Frameworks/Python.framework/Versions/3.10/lib/python3.10/ssl.py", line 1104, in _create
1439+
self.do_handshake()
1440+
File "/opt/homebrew/Cellar/[email protected]/3.10.14/Frameworks/Python.framework/Versions/3.10/lib/python3.10/ssl.py", line 1375, in do_handshake
1441+
self._sslobj.do_handshake()
1442+
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1007)
1443+
```
1444+
1445+
**Solution:** set both `REQUESTS_CA_BUNDLE` and `CURL_CA_BUNDLE`
1446+
[to force requests library to set verify=False](https://github.com/psf/requests/blob/8c211a96cdbe9fe320d63d9e1ae15c5c07e179f8/requests/sessions.py#L718)
1447+
as well as set `SSL_CERT_DIR` env var pointing to the proxy CA cert for the urllib3 library.
1448+
14201449
[[back to top](#databricks-labs-ucx)]
14211450

14221451
### Insufficient Privileges

0 commit comments

Comments
 (0)