puppetlabs / puppetlabs/puppetlabs-http_request

Unable to connect to TLS end points

Open
#17 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Ruby
Stars
0
Forks
6
Avg merge
8h
Merged PRs (30d)
6

Description

Describe the Bug

Hello,
I am able to connect now to HTTP end points but when I try making a HTTPS connection is when I encounter issues, the following is the typical issue I encounter although I provide it the path to the certificate, can you tell me if you have a solution for this problem, the following is the output I see when I make a TLS connection,

PS C:\WINDOWS\system32> Invoke-BoltTask -Name 'http_request' -Targets 'localhost' base_url=https://esbn12dp:8840/dev1/ json_endpoint=true cacert='C:\git-repo\puppet\certs\BSCROOTCA2.cer' cert='C:\git-repo\puppet\certs\BSCISSUECA2.cer' method=get --log-level debug
Bolt collects data about how you use it. You can opt out of providing this data.
To learn how to disable data collection, or see what data Bolt collects and why,
see http://pup.pt/bolt-analytics
[ID: analytics_opt_out]
Could not write analytics configuration to H:/.puppetlabs/etc/bolt/analytics.yaml. [ID: unwriteable_file]
Failed to initialize analytics client, analytics will be disabled: No such file or directory @ dir_s_mkdir - H:/.puppetlabs
Did not detect Boltdir or bolt-project.yaml at 'C:/WINDOWS/system32'. This directory won't be loaded as a project.
Did not detect Boltdir or bolt-project.yaml at 'C:/WINDOWS'. This directory won't be loaded as a project.
Could not create default project at H:/.puppetlabs/bolt. Continuing without a writeable project. Log and rerun files will not be written. [ID: non_writeable_project]
Loading modules from C:/Program Files/Puppet Labs/Bolt/lib/ruby/gems/2.7.0/gems/bolt-3.15.0/bolt-modules;H:/.puppetlabs/bolt/modules;H:/.puppetlabs/bolt/.modules;C:/Program Files/Puppet Labs/Bolt/lib/ruby/gems/2.7.0/gems/bolt-3.15.0/modules
Tried to load inventory from H:/.puppetlabs/bolt/inventory.yaml, but the file does not exist
Did not find config for localhost in inventory
Started with 100 max thread(s)
Starting: task http_request on localhost
Running task http_request with '{"follow_redirects":true,"json_endpoint":true,"max_redirects":20,"method":"get","base_url":"https://esbn12dp:8840/dev1/","cacert":"C:\git-repo\puppet\certs\BSCROOTCA2.cer","cert":"C:\git-repo\puppet\certs\BSCISSUECA2.cer","_task":"http_request"}' on ["localhost"]
Running task 'http_request' on localhost
{"target":"localhost","action":"task","object":"http_request","status":"failure","value":{"_error":{"kind":"http_request/connect-error","msg":"Failed to connect to https://esbn12dp:8840/dev1/: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)","details":{}}}}
Finished: task http_request with 1 failure in 1.64 sec
Started on localhost...
Failed on localhost:
Failed to connect to https://esbn12dp:8840/dev1/: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)
Failed on 1 target: localhost
Ran on 1 target in 1.75 sec
PS C:\WINDOWS\system32>

Expected Behavior

A clear and concise description of what you expected to happen.

Steps to Reproduce

Steps to reproduce the behavior:

  1. Go to '...'
  2. Click on '....'

Environment

  • Version [e.g. 1.27.0]
  • Platform [e.g. Ubuntu 18.04]

Additional Context

Add any other context about the problem here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reproduced PowerShell Invoke-BoltTask command and its http_request task output, focusing on the SSL certificate verification failure when cacert and cert paths are supplied. Check the task's HTTPS connection handling and reproduce the command in a comparable environment; done means the request connects successfully with the provided certificate paths or reports a clear, actionable configuration error.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.