certificate verify failed: self signed certificate

[nabeelmoeen]

Describe the bug when calling the import script with the trello exported json file, the script outputs the identified labels, stacks and cards in the json, but the import fails with the following error:

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1129)

(full trace below)

it's a fresh install using the latest nextcloudpi install script, which sets it up as a https site. I haven't configured DDNS yet.

Full trace output

``` Found: 6 labels 8 stacks 21 cards (archived and non-archived) Traceback (most recent call last): File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 670, in urlopen httplib_response = self._make_request( File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 381, in _make_request self._validate_conn(conn) File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 978, in _validate_conn conn.connect() File "/usr/lib/python3.9/site-packages/urllib3/connection.py", line 362, in connect self.sock = ssl_wrap_socket( File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 397, in ssl_wrap_socket return context.wrap_socket(sock) File "/usr/lib64/python3.9/ssl.py", line 500, in wrap_socket return self.sslsocket_class._create( File "/usr/lib64/python3.9/ssl.py", line 1040, in _create self.do_handshake() File "/usr/lib64/python3.9/ssl.py", line 1309, in do_handshake self._sslobj.do_handshake() ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1129) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 439, in send resp = conn.urlopen( File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 726, in urlopen retries = retries.increment( File "/usr/lib/python3.9/site-packages/urllib3/util/retry.py", line 439, in increment raise MaxRetryError(_pool, url, error or ResponseError(cause)) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='192.168.1.2', port=443): Max retries exceeded with url: /ocs/v1.php/cloud/capabilities?format=json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1129)'))) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/home/jdnsmp/.local/bin/trello-to-deck", line 47, in compatibility = api.getCompatibility() File "/home/jdnsmp/.local/lib/python3.9/site-packages/trello_to_deck/deck.py", line 75, in getCompatibility result = self.get("/ocs/v1.php/cloud/capabilities?format=json").json() File "/home/jdnsmp/.local/lib/python3.9/site-packages/trello_to_deck/deck.py", line 14, in get response = requests.get( File "/usr/lib/python3.9/site-packages/requests/api.py", line 76, in get return request('get', url, params=params, **kwargs) File "/usr/lib/python3.9/site-packages/requests/api.py", line 61, in request return session.request(method=method, url=url, **kwargs) File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 542, in request resp = self.send(prep, **send_kwargs) File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 655, in send r = adapter.send(request, **kwargs) File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 514, in send raise SSLError(e, request=request) requests.exceptions.SSLError: HTTPSConnectionPool(host='192.168.1.2', port=443): Max retries exceeded with url: /ocs/v1.php/cloud/capabilities?format=json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1129)'))) ```

Server details

**Operating system**: raspian 10 **Web server:** apache **Nextcloud version:** (see Nextcloud admin page) 21 **Where did you install Nextcloud from:** installed using the nextcloudpi script (not docker) **Nextcloud configuration:** ``` { "system": { "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": { "0": "localhost", "22": "nextcloudpi", "11": "203.121.218.6", "1": "192.168.1.2", "3": "localhost" }, "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "21.0.4.1", "overwrite.cli.url": "https:\/\/nextcloudpi\/", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "mysql.utf8mb4": true, "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "instanceid": "***REMOVED SENSITIVE VALUE***", "memcache.local": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": 0, "timeout": 0, "password": "***REMOVED SENSITIVE VALUE***" }, "tempdirectory": "\/var\/www\/nextcloud\/data\/tmp", "mail_smtpmode": "sendmail", "mail_smtpauthtype": "LOGIN", "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_domain": "***REMOVED SENSITIVE VALUE***", "preview_max_x": "2048", "preview_max_y": "2048", "jpeg_quality": "60", "overwriteprotocol": "https", "loglevel": "2", "log_type": "file" } } ```

[nabeelmoeen]

I circumvented the problem by adding the 'verify=False' argument to the post, postfile and get 'request' calls in deckapi.py. I'm not knowledgeable enough about this to determine whether this is a valid workaround vs. a security issue, but for a one-off task, I'm just happy that I got it working :grinning:

[maxammann]

In fact it is acceptable for initial setup. The imposed security risk is that an arbitrary MITM could intercept the connection.

For a single connection the risk is very very low though. I would add this as a reusable feature if a second person has this problem.

Generally TLS verification should succeed. Running Nextcloud with a broken TLS setup is only for testing purposes acceptable.