WLCGAccountingHTTPJson doesn't work with RAL-HEP
- Dominant language
- Python
- Stars
- 126
- Forks
- 191
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 33
Description
In LHCb Prod:
```python
import DIRAC.Resources.Storage.GFAL2_StorageBase
DIRAC.initialize(log_level="DEBUG")
from DIRAC.Resources.Storage.StorageElement import StorageElement
se = StorageElement("RAL-HEP-DST")
se.getOccupancy()
```
Looking at the debug logs you can see `CERTIFICATE_VERIFY_FAILED`:
```log
2025-04-23T11:14:41,314660Z Framework/DIRAC.Resources.Storage.StorageElement/SE[RAL-HEP-DST]/WLCGAccountingHTTPJson DEBUG: Exception while copying SSLError(MaxRetryError("HTTPSConnectionPool(host='monitor.pp.rl.ac.uk', port=443): Max retries exceeded with url: /api/v1/srr (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)')))"))
```
The underlying cause is that RAL-HEP has started using Let's Encrypt but DIRAC is passing the grid CA bundle to requests:
```bash
$ openssl s_client -connect monitor.pp.rl.ac.uk:443 < /dev/null
...
Certificate chain
0 s:CN=monitor.pp.rl.ac.uk
i:C=US, O=Let's Encrypt, CN=E6
a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA384
v:NotBefore: Apr 7 07:39:41 2025 GMT; NotAfter: Jul 6 07:39:40 2025 GMT
1 s:C=US, O=Let's Encrypt, CN=E6
i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
a:PKEY: id-ecPublicKey, 384 (bit); sigalg: RSA-SHA256
v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT
```
Contributor guide
Assessment
This issue has not been assessed yet.