MagicStack / MagicStack/asyncpg
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.1k
- Forks
- 468
- PR merge metrics
- No merged PRs in 30d
Description
* **asyncpg version**: 0.18.3
* **PostgreSQL version**: N/A
* **Do you use a PostgreSQL SaaS? If so, which? Can you reproduce
the issue with a local PostgreSQL install?**:
* **Python version**: 3.7.4
* **Platform**: Docker python:3.7-slim (issue is as of python 3.7.4 release 3 days ago)
* **Do you use pgbouncer?**:
* **Did you install asyncpg with pip?**: yes
* **If you built asyncpg locally, which version of Cython did you use?**:
* **Can the issue be reproduced under both asyncio and
[uvloop](https://github.com/magicstack/uvloop)?**:
An issue very similar to #238 started occuring 3 days ago after python 3.7.4 was released. Pinning my docker to 3.7.3-slim fixed the issue.
```
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak (_ssl.c:1076)
The above exception was the direct cause of the following exception:
asyncpg.exceptions.ConnectionDoesNotExistError: connection was closed in the middle of operation
Future exception was never retrieved
future:
Traceback (most recent call last):
File "/home/mydirectory/app/__init__.py", line 13, in register_db
app.pool = await asyncpg.create_pool(**Config.DATABASE_CONFIG, loop=loop, max_size=100)
File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 400, in _async__init__
await self._initialize()
File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 417, in _initialize
await first_ch.connect()
File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 125, in connect
self._con = await self._pool._get_new_connection()
File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 463, in _get_new_connection
**self._connect_kwargs)
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connection.py", line 1688, in connect
max_cacheable_statement_size=max_cacheable_statement_size)
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 551, in _connect
raise last_error
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 543, in _connect
connection_class=connection_class)
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 513, in _connect_addr
connector, timeout=timeout, loop=loop)
File "/usr/local/lib/python3.7/asyncio/tasks.py", line 442, in wait_for
return fut.result()
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 606, in _create_ssl_connection
ssl_is_advisory=ssl_is_advisory)
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 592, in _negotiate_ssl_connection
return await conn_factory(sock=sock) # Must come after tr.close()
File "uvloop/loop.pyx", line 1945, in create_connection
File "uvloop/loop.pyx", line 1942, in uvloop.loop.Loop.create_connection
File "uvloop/sslproto.pyx", line 500, in uvloop.loop.SSLProtocol._on_handshake_complete
File "uvloop/sslproto.pyx", line 484, in uvloop.loop.SSLProtocol._do_handshake
File "/usr/local/lib/python3.7/ssl.py", line 774, in do_handshake
self._sslobj.do_handshake()
```
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the connection and SSL paths named in asyncpg/connect_utils.py, especially _connect_addr, _create_ssl_connection, and _negotiate_ssl_connection, then compare behavior on Python 3.7.4 and 3.7.3 as reported. Check the uvloop SSL traceback and establish a reproducible case; done means the affected version combination and expected handling are clearly identified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- database, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100