MagicStack / MagicStack/asyncpg

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak

Aperta
#466 5 commenti 1 reazione 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Lingua principale
Python
Stelle
8.1k
Fork
468
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

  • asyncpg version: 0.18.3
  • PostgreSQL version: N/A
  • Do you use a PostgreSQL SaaS? If so, which? Can you reproduce
    the issue with a local PostgreSQL install?
    :
  • Python version: 3.7.4
  • Platform: Docker python:3.7-slim (issue is as of python 3.7.4 release 3 days ago)
  • Do you use pgbouncer?:
  • Did you install asyncpg with pip?: yes
  • If you built asyncpg locally, which version of Cython did you use?:
  • Can the issue be reproduced under both asyncio and
    uvloop?
    :

An issue very similar to #238 started occuring 3 days ago after python 3.7.4 was released. Pinning my docker to 3.7.3-slim fixed the issue.

	ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak (_ssl.c:1076)
	The above exception was the direct cause of the following exception:
	asyncpg.exceptions.ConnectionDoesNotExistError: connection was closed in the middle of operation
	Future exception was never retrieved
	future: <Future finished exception=ConnectionDoesNotExistError('connection was closed in the middle of operation')>
	Traceback (most recent call last):
	  File "/home/mydirectory/app/__init__.py", line 13, in register_db
	    app.pool = await asyncpg.create_pool(**Config.DATABASE_CONFIG, loop=loop, max_size=100)
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 400, in _async__init__
	    await self._initialize()
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 417, in _initialize
	    await first_ch.connect()
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 125, in connect
	    self._con = await self._pool._get_new_connection()
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/pool.py", line 463, in _get_new_connection
	    **self._connect_kwargs)
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connection.py", line 1688, in connect
	    max_cacheable_statement_size=max_cacheable_statement_size)
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 551, in _connect
	    raise last_error
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 543, in _connect
	    connection_class=connection_class)
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 513, in _connect_addr
	    connector, timeout=timeout, loop=loop)
	  File "/usr/local/lib/python3.7/asyncio/tasks.py", line 442, in wait_for
	    return fut.result()
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 606, in _create_ssl_connection
	    ssl_is_advisory=ssl_is_advisory)
	  File "/opt/venv/lib/python3.7/site-packages/asyncpg/connect_utils.py", line 592, in _negotiate_ssl_connection
	    return await conn_factory(sock=sock)  # Must come after tr.close()
	  File "uvloop/loop.pyx", line 1945, in create_connection
	  File "uvloop/loop.pyx", line 1942, in uvloop.loop.Loop.create_connection
	  File "uvloop/sslproto.pyx", line 500, in uvloop.loop.SSLProtocol._on_handshake_complete
	  File "uvloop/sslproto.pyx", line 484, in uvloop.loop.SSLProtocol._do_handshake
	  File "/usr/local/lib/python3.7/ssl.py", line 774, in do_handshake
	    self._sslobj.do_handshake()

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Direzione di ricerca

Inizia con i percorsi di connessione e SSL indicati in asyncpg/connect_utils.py, in particolare _connect_addr, _create_ssl_connection e _negotiate_ssl_connection, quindi confronta il comportamento su Python 3.7.4 e 3.7.3 come riportato. Controlla il traceback SSL di uvloop e stabilisci un caso riproducibile; il lavoro è completato quando la combinazione di versioni interessata e la gestione prevista sono chiaramente identificate.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
python
Ambito
database, security
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Da chiarire
Idoneità per principianti
25/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.