MagicStack / MagicStack/asyncpg
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak
Nessuno ha ancora preso questa issue.
- Lingua principale
- Python
- Stelle
- 8.1k
- Fork
- 468
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
- asyncpg version: 0.18.3
- PostgreSQL version: N/A
- Do you use a PostgreSQL SaaS? If so, which? Can you reproduce
the issue with a local PostgreSQL install?: - Python version: 3.7.4
- Platform: Docker python:3.7-slim (issue is as of python 3.7.4 release 3 days ago)
- Do you use pgbouncer?:
- Did you install asyncpg with pip?: yes
- If you built asyncpg locally, which version of Cython did you use?:
- Can the issue be reproduced under both asyncio and
uvloop?:
An issue very similar to #238 started occuring 3 days ago after python 3.7.4 was released. Pinning my docker to 3.7.3-slim fixed the issue.
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak (_ssl.c:1076)
The above exception was the direct cause of the following exception:
asyncpg.exceptions.ConnectionDoesNotExistError: connection was closed in the middle of operation
Future exception was never retrieved
future: <Future finished exception=ConnectionDoesNotExistError('connection was closed in the middle of operation')>
Traceback (most recent call last):
File "/home/mydirectory/app/__init__.py", line 13, in register_db
app.pool = await asyncpg.create_pool(**Config.DATABASE_CONFIG, loop=loop, max_size=100)
File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 400, in _async__init__
await self._initialize()
File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 417, in _initialize
await first_ch.connect()
File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 125, in connect
self._con = await self._pool._get_new_connection()
File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 463, in _get_new_connection
**self._connect_kwargs)
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connection.py", line 1688, in connect
max_cacheable_statement_size=max_cacheable_statement_size)
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 551, in _connect
raise last_error
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 543, in _connect
connection_class=connection_class)
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 513, in _connect_addr
connector, timeout=timeout, loop=loop)
File "/usr/local/lib/python3.7/asyncio/tasks.py", line 442, in wait_for
return fut.result()
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 606, in _create_ssl_connection
ssl_is_advisory=ssl_is_advisory)
File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 592, in _negotiate_ssl_connection
return await conn_factory(sock=sock) # Must come after tr.close()
File "uvloop/loop.pyx", line 1945, in create_connection
File "uvloop/loop.pyx", line 1942, in uvloop.loop.Loop.create_connection
File "uvloop/sslproto.pyx", line 500, in uvloop.loop.SSLProtocol._on_handshake_complete
File "uvloop/sslproto.pyx", line 484, in uvloop.loop.SSLProtocol._do_handshake
File "/usr/local/lib/python3.7/ssl.py", line 774, in do_handshake
self._sslobj.do_handshake()
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Direzione di ricerca
Inizia con i percorsi di connessione e SSL indicati in asyncpg/connect_utils.py, in particolare _connect_addr, _create_ssl_connection e _negotiate_ssl_connection, quindi confronta il comportamento su Python 3.7.4 e 3.7.3 come riportato. Controlla il traceback SSL di uvloop e stabilisci un caso riproducibile; il lavoro è completato quando la combinazione di versioni interessata e la gestione prevista sono chiaramente identificate.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- python
- Ambito
- database, security
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Da chiarire
- Idoneità per principianti
- 25/100