cyberark / conjur-api-python

Python client for the CyberArk Conjur API
Apache License 2.0
8 stars 3 forks source link

Add System Truststore Fallback #37

Closed gl-johnson closed 2 years ago

gl-johnson commented 2 years ago

Desired Outcome

When the .conjurrc config cert_file property points to an invalid CA (or self-signed) cert, the API should still attempt to use the system truststore to verify the SSL connection.

Implemented Changes

Append system trusted CA certs to the SSL context even when a cert path is given.

Connected Issue/Story

CyberArk internal issue link: ONYX-24957 This PR should also address cyberark-conjur-cli#209

Definition of Done

At least 1 todo must be completed in the sections below for the PR to be merged.

Changelog

Test coverage

Documentation

Behavior

Security

szh commented 2 years ago

Is there any way we can include tests for this? It seems like it is a subtle behavior change.