saltstack / saltstack/salt

ext_pillar: netbox SSL: CERTIFICATE_VERIFY_FAILED

Open
#67,907 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Hello,
I have a problem to use netbox in the ext_pillar

My configuration:

ext_pillar:
  - netbox:
      api_url: https://netboxserver.example.com/api/
      api_token: 123456789etc

Logs of master

21-03-2025 12:13:59,826 [salt.pillar      :1279][CRITICAL][200168] Pillar render error: Failed to load ext_pillar netbox: 'status'
21-03-2025 12:13:59,889 [tornado.general  :1332][WARNING ][200172] SSL Error on 143 ('10.10.10.10', 443): [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: CA signature digest algorithm too weak (_ssl.c
:1007)
21-03-2025 12:13:59,889 [salt.pillar      :1221][ERROR   ][200172] Exception caught loading ext_pillar 'netbox':
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/pillar/__init__.py", line 1213, in ext_pillar
    ext = self._external_pillar_data(pillar, val, key)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/pillar/__init__.py", line 1133, in _external_pillar_data
    ext = self.ext_pillars[key](self.minion_id, pillar, **val)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 159, in __call__
    ret = self.loader.run(run_func, *args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1245, in run
    return self._last_context.run(self._run_as, _func_or_method, *args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1260, in _run_as
    ret = _func_or_method(*args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/pillar/netbox.py", line 1118, in ext_pillar
    nodes.extend(_get_devices(api_url, minion_id, headers, api_query_result_limit))
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/pillar/netbox.py", line 716, in _get_devices
    device_ret["status"],

Maybe, is there a way to disable SSL verification ?

# salt --versions-report
Salt Version:
          Salt: 3006.10

Python Version:
        Python: 3.10.16 (main, Mar  6 2025, 02:23:15) [GCC 11.2.0]

Dependency Versions:
          cffi: 1.17.1
      cherrypy: unknown
  cryptography: 42.0.5
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: 4.0.12
     gitpython: 3.1.44
        Jinja2: 3.1.6
       libgit2: 1.8.1
  looseversion: 1.0.2
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.0.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 22.0
     pycparser: 2.21
      pycrypto: Not Installed
  pycryptodome: 3.19.1
        pygit2: 1.15.0
  python-gnupg: 0.4.8
        PyYAML: 6.0.1
         PyZMQ: 23.2.0
        relenv: 0.18.1
         smmap: 5.0.2
       timelib: 0.2.4
       Tornado: 4.5.3
           ZMQ: 4.3.4

System Versions:
          dist: debian 12 bookworm
        locale: utf-8
       machine: x86_64
       release: 6.1.0-32-amd64
        system: Linux
       version: Debian GNU/Linux 12 bookworm

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in salt/pillar/netbox.py at ext_pillar around line 1118 and _get_devices around line 716, using the supplied configuration and SSL traceback to trace the failure. Determine how certificate verification is currently handled and what supported configuration behavior would satisfy the request; done should include a clear way for netbox ext_pillar users to control verification without the observed error.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.