S3 Data Source - SSLError

[remchuk]

In Netbox 4.5, I'm trying to set Data Source;

Type: Amazon S3

I have set the Access Key and the Secret Key.
But I receive the error:

SSLError(SSL validation failed for <url>?prefix=&encoding=type=url'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')) 

I have a custom CA which I save in /run/secrets/netbox/ca.crt.
Is there a way to use this CA instead of the built-in CA?

I run the netbox-docker image on Openshift.

[cruse1977]

In what environment ? VM, k8s ?

[remchuk]

It's on openshift

[Christophoclese]

Try using the REQUESTS_CA_BUNDLE environment variable:

https://docs.python-requests.org/en/latest/user/advanced/
https://stackoverflow.com/a/43935319

[remchuk]

Try where? it is not a python script that I run.

[Christophoclese]

This would be an environment variable in the same context that NetBox runs in. You are not using Python, but NetBox definitely does.

If you're running in Docker you can put these in ./env/netbox.env, for example:

LDAP_CA_CERT_DIR=/etc/ssl/certs
REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

I use these variables in conjunction with docker compose override files that volume mount the OS certificates into the running container. This way I just need to install custom CAs to OS standard location, which means tools using OS SSL methods get trust too.

@markkuleinio provided a link to another discussion which goes into much more detail, Thanks Markku!

[Christophoclese]

Here's an example docker compose override file. Ours is configured to build a custom image for plugin support, extend the startup healthcheck, volume mount CA certs, tell the netbox-worker service to also use the custom image, and disable the netbox-housekeeping service which was deprecated at some point.

docker-compose.override.yml:

---
services:
  netbox:
    image: netbox:latest-plugins
    pull_policy: never
    build:
      context: .
      dockerfile: Dockerfile-Plugins
    healthcheck:
      start_period: 300s
    volumes:
      - /etc/ssl/certs:/etc/ssl/certs:ro

  netbox-worker:
    image: netbox:latest-plugins
    pull_policy: never
  netbox-housekeeping: !reset null

[markkuleinio]

Does #12774 help you?