MagicStack / MagicStack/asyncpg

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak

Abierto
#466 5 comentarios 1 reacción 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Lenguaje dominante
Python
Estrellas
8.1k
Forks
468
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

  • asyncpg version: 0.18.3
  • PostgreSQL version: N/A
  • Do you use a PostgreSQL SaaS? If so, which? Can you reproduce
    the issue with a local PostgreSQL install?
    :
  • Python version: 3.7.4
  • Platform: Docker python:3.7-slim (issue is as of python 3.7.4 release 3 days ago)
  • Do you use pgbouncer?:
  • Did you install asyncpg with pip?: yes
  • If you built asyncpg locally, which version of Cython did you use?:
  • Can the issue be reproduced under both asyncio and
    uvloop?
    :

An issue very similar to #238 started occuring 3 days ago after python 3.7.4 was released. Pinning my docker to 3.7.3-slim fixed the issue.

	ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak (_ssl.c:1076)
	The above exception was the direct cause of the following exception:
	asyncpg.exceptions.ConnectionDoesNotExistError: connection was closed in the middle of operation
	Future exception was never retrieved
	future: <Future finished exception=ConnectionDoesNotExistError('connection was closed in the middle of operation')>
	Traceback (most recent call last):
	  File "/home/mydirectory/app/__init__.py", line 13, in register_db
	    app.pool = await asyncpg.create_pool(**Config.DATABASE_CONFIG, loop=loop, max_size=100)
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 400, in _async__init__
	    await self._initialize()
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 417, in _initialize
	    await first_ch.connect()
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 125, in connect
	    self._con = await self._pool._get_new_connection()
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 463, in _get_new_connection
	    **self._connect_kwargs)
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connection.py", line 1688, in connect
	    max_cacheable_statement_size=max_cacheable_statement_size)
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 551, in _connect
	    raise last_error
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 543, in _connect
	    connection_class=connection_class)
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 513, in _connect_addr
	    connector, timeout=timeout, loop=loop)
	  File "/usr/local/lib/python3.7/asyncio/tasks.py", line 442, in wait_for
	    return fut.result()
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 606, in _create_ssl_connection
	    ssl_is_advisory=ssl_is_advisory)
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 592, in _negotiate_ssl_connection
	    return await conn_factory(sock=sock)  # Must come after tr.close()
	  File "uvloop/loop.pyx", line 1945, in create_connection
	  File "uvloop/loop.pyx", line 1942, in uvloop.loop.Loop.create_connection
	  File "uvloop/sslproto.pyx", line 500, in uvloop.loop.SSLProtocol._on_handshake_complete
	  File "uvloop/sslproto.pyx", line 484, in uvloop.loop.SSLProtocol._do_handshake
	  File "/usr/local/lib/python3.7/ssl.py", line 774, in do_handshake
	    self._sslobj.do_handshake()

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Línea de trabajo

Comienza con las rutas de conexión y SSL indicadas en asyncpg/connect_utils.py, especialmente _connect_addr, _create_ssl_connection y _negotiate_ssl_connection, y luego compara el comportamiento en Python 3.7.4 y 3.7.3 según lo reportado. Comprueba el traceback de SSL de uvloop y establece un caso reproducible; se considera terminado cuando la combinación de versiones afectada y el manejo esperado estén claramente identificados.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
python
Área
database, security
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Necesita aclaración
Aptitud para principiantes
25/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.