search

myOmikron / mailcow-ldap-sync

26 stars 2 forks source link

"allow_self_signed": True", only works for LDAP but not for the Mailcow API #21

Closed ne0YT closed 1 year ago

ne0YT commented 1 year ago

"allow_self_signed": True", only works for LDAP but not for the Mailcow API

ne0YT commented 1 year ago 
  Base = declarative_base()
Traceback (most recent call last):
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 714, in urlopen
    httplib_response = self._make_request(
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 403, in _make_request
    self._validate_conn(conn)
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 1053, in _validate_conn
    conn.connect()
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/urllib3/connection.py", line 419, in connect
    self.sock = ssl_wrap_socket(
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/lib/python3.10/ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.10/ssl.py", line 1071, in _create
    self.do_handshake()
  File "/usr/lib/python3.10/ssl.py", line 1342, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:997)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/requests/adapters.py", line 440, in send
    resp = conn.urlopen(
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 798, in urlopen
    retries = retries.increment(
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/urllib3/util/retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='mail.mydomain.tld', port=443): Max retries exceeded with url: /api/v1/get/mailbox/administrator@mydomain.tld (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:997)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/mailcow-ldap-sync/mailcow_ldap_sync/./main.py", line 381, in <module>
    main(
  File "/opt/mailcow-ldap-sync/mailcow_ldap_sync/./main.py", line 92, in main
    existing_mailcow = requests.get(
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/requests/api.py", line 75, in get
    return request('get', url, params=params, **kwargs)
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/requests/api.py", line 61, in request
    return session.request(method=method, url=url, **kwargs)
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/requests/sessions.py", line 529, in request
    resp = self.send(prep, **send_kwargs)
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/requests/sessions.py", line 645, in send
    r = adapter.send(request, **kwargs)
  File "/opt/mailcow-ldap-sync/venv/lib/python3.10/site-packages/requests/adapters.py", line 517, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='mail.mydomain.tld', port=443): Max retries exceeded with url: /api/v1/get/mailbox/administrator@mydomain.tld (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:997)')))
myOmikron commented 1 year ago

This works as expected, as allow_self_signed is in the ldap block.

To ignore mailcow certs, use the --do-not-verify parameter