Skip to content

SystemError: <built-in method peer_certificate of _ssl._SSLSocket object at 0x7f98ac154858> returned NULL without setting an error #72357

New issue
New issue
Closed
Closed
SystemError: <built-in method peer_certificate of _ssl._SSLSocket object at 0x7f98ac154858> returned NULL without setting an error#72357
Assignees
tiran
Labels
topic-SSLtype-bugAn unexpected behavior, bug, or error

Description

@MattWright
MattWright
mannequin
opened on Sep 15, 2016
BPO 28170
Nosy @tiran
Superseder
  • bpo-27691: X509 cert with GEN_RID subject alt name causes SytemError
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/tiran'
closed_at = <Date 2016-09-15.15:54:28.429>
created_at = <Date 2016-09-15.15:47:27.155>
labels = ['expert-SSL', 'type-bug']
title = 'SystemError: <built-in method peer_certificate of _ssl._SSLSocket object at 0x7f98ac154858> returned NULL without setting an error'
updated_at = <Date 2016-09-15.16:02:41.952>
user = 'https://bugs.python.org/MattWright'

    bugs.python.org fields:

    activity = <Date 2016-09-15.16:02:41.952>
actor = 'Matt Wright'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2016-09-15.15:54:28.429>
closer = 'christian.heimes'
components = ['SSL']
creation = <Date 2016-09-15.15:47:27.155>
creator = 'Matt Wright'
dependencies = []
files = []
hgrepos = []
issue_num = 28170
keywords = []
message_count = 3.0
messages = ['276567', '276570', '276571']
nosy_count = 2.0
nosy_names = ['christian.heimes', 'Matt Wright']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = '27691'
type = 'behavior'
url = 'https://bugs.python.org/issue28170'
versions = ['Python 3.5']

    Activity

    1. MattWright commented on Sep 15, 2016

      @MattWright
      MattWrightmannequin
      on Sep 15, 2016
      MannequinAuthor

      I'm experiencing a strange error when connecting to a web server with a self signed certificate. I've added the Root and Intermediate certs to the system CA bundle, and can curl against the server without any errors or using the k flag. But Python (via requests) raises an error that I can't seem to figure out at all with the peer_certificate method. Below you'll find the specific error:

      import requests
requests.get('https://localhost:9200/_cluster/health', verify='/etc/ssl/certs/ca-certificates.crt')
Traceback (most recent call last):
  File "test.py", line 2, in <module>
    requests.get('https://localhost:9200/_cluster/health', verify='/etc/ssl/certs/ca-certificates.crt')
  File "/usr/lib/python3/dist-packages/requests/api.py", line 67, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/api.py", line 53, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 468, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 576, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 376, in send
    timeout=timeout
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 560, in urlopen
    body=body, headers=headers)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 346, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 787, in _validate_conn
    conn.connect()
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 259, in connect
    cert = self.sock.getpeercert()
  File "/usr/lib/python3.5/ssl.py", line 818, in getpeercert
    return self._sslobj.getpeercert(binary_form)
  File "/usr/lib/python3.5/ssl.py", line 595, in getpeercert
    return self._sslobj.peer_certificate(binary_form)
SystemError: <built-in method peer_certificate of _ssl._SSLSocket object at 0x7f98ac154858> returned NULL without setting an error
    2. MattWright
      assigned
      tiran
      on Sep 15, 2016
    3. MattWright
      added
      topic-SSL
      type-bugAn unexpected behavior, bug, or error
      on Sep 15, 2016

    4. tiran commented on Sep 15, 2016

      @tiran
      tiran
      on Sep 15, 2016
      Member

      Do you happen to talk to an ElasticSearch cluster with a GEN_RID in the subject alternative name field? It's a known bug in Python's ssl code. The fix bpo-27691 will be in the next releases of 2.7 and 3.5.

      In the mean time you can work around the bug by reconfiguring your ES cluster and application. You have to use different certs for node <-> client and node <-> node communication. OID 1.2.3.4.5.5 should only be in the cluster communication certs. https://github.com/floragunncom/search-guard-docs/blob/1a35ec309661f7b8fb1efc2586fc298dcb7cb139/installation.md#generating-a-server-certificate

    5. tiran
      closed this as completedon Sep 15, 2016

    6. MattWright commented on Sep 15, 2016

      @MattWright
      MattWrightmannequin
      on Sep 15, 2016
      MannequinAuthor

      Ahh! Thanks much!

    7. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    Labels

    topic-SSLtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions