permitio / opal

Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...)
https://opal.ac
Apache License 2.0
3.5k stars 154 forks source link

cannot use self sign certificate #588

Open wangli1030 opened 1 month ago

wangli1030 commented 1 month ago

Describe the bug When OPAL_CLIENT_SELF_SIGNED_CERTIFICATES_ALLOWED=true and OPAL_CLIENT_SSL_CONTEXT_TRUSTED_CA_FILE are configured in client, pub/sub server cannot be connected with error ValueError: connect() received a ssl argument for a ws:// URI, use a wss:// URI to enable TLS I believe when those two fields are configured, SSL is forced everywhere. And also HTTPS should be enabled for server which mentioned several times in the docs, but I did not find a way to start the server with SSL.

To Reproduce configure OPAL_CLIENT_SELF_SIGNED_CERTIFICATES_ALLOWED=true and OPAL_CLIENT_SSL_CONTEXT_TRUSTED_CA_FILE when starting the client, the error will be shown in client log

Expected behavior It should not impact the ws

Screenshots If applicable, add screenshots to help explain your problem.

OPAL version