ext_pillar: netbox SSL: CERTIFICATE_VERIFY_FAILED
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Hello,
I have a problem to use netbox in the ext_pillar
My configuration:
ext_pillar:
- netbox:
api_url: https://netboxserver.example.com/api/
api_token: 123456789etc
Logs of master
21-03-2025 12:13:59,826 [salt.pillar :1279][CRITICAL][200168] Pillar render error: Failed to load ext_pillar netbox: 'status'
21-03-2025 12:13:59,889 [tornado.general :1332][WARNING ][200172] SSL Error on 143 ('10.10.10.10', 443): [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: CA signature digest algorithm too weak (_ssl.c
:1007)
21-03-2025 12:13:59,889 [salt.pillar :1221][ERROR ][200172] Exception caught loading ext_pillar 'netbox':
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/pillar/__init__.py", line 1213, in ext_pillar
ext = self._external_pillar_data(pillar, val, key)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/pillar/__init__.py", line 1133, in _external_pillar_data
ext = self.ext_pillars[key](self.minion_id, pillar, **val)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 159, in __call__
ret = self.loader.run(run_func, *args, **kwargs)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1245, in run
return self._last_context.run(self._run_as, _func_or_method, *args, **kwargs)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1260, in _run_as
ret = _func_or_method(*args, **kwargs)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/pillar/netbox.py", line 1118, in ext_pillar
nodes.extend(_get_devices(api_url, minion_id, headers, api_query_result_limit))
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/pillar/netbox.py", line 716, in _get_devices
device_ret["status"],
Maybe, is there a way to disable SSL verification ?
# salt --versions-report
Salt Version:
Salt: 3006.10
Python Version:
Python: 3.10.16 (main, Mar 6 2025, 02:23:15) [GCC 11.2.0]
Dependency Versions:
cffi: 1.17.1
cherrypy: unknown
cryptography: 42.0.5
dateutil: 2.8.1
docker-py: Not Installed
gitdb: 4.0.12
gitpython: 3.1.44
Jinja2: 3.1.6
libgit2: 1.8.1
looseversion: 1.0.2
M2Crypto: Not Installed
Mako: Not Installed
msgpack: 1.0.2
msgpack-pure: Not Installed
mysql-python: Not Installed
packaging: 22.0
pycparser: 2.21
pycrypto: Not Installed
pycryptodome: 3.19.1
pygit2: 1.15.0
python-gnupg: 0.4.8
PyYAML: 6.0.1
PyZMQ: 23.2.0
relenv: 0.18.1
smmap: 5.0.2
timelib: 0.2.4
Tornado: 4.5.3
ZMQ: 4.3.4
System Versions:
dist: debian 12 bookworm
locale: utf-8
machine: x86_64
release: 6.1.0-32-amd64
system: Linux
version: Debian GNU/Linux 12 bookworm
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in salt/pillar/netbox.py at ext_pillar around line 1118 and _get_devices around line 716, using the supplied configuration and SSL traceback to trace the failure. Determine how certificate verification is currently handled and what supported configuration behavior would satisfy the request; done should include a clear way for netbox ext_pillar users to control verification without the observed error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100