Ignore self-signed certificate

[Mirro888]

Dear all, I am trying to use openconnect-sso against ocserv compiled with SAML support. My ocserv runs with self-signed certificate and openconnect-sso fails with ERR_CERT_AUTHORITY_INVALID when trying to connect to https://xxxx.ddns.net/+CSCOE+/saml/sp/login. Is there any way to ignore certificate errors everywhere in openconnect-sso?

Thank you,

Mirro

[ceres4]

Please provide support to ignore certificate verification as I am experiencing the same issue.

[Mirro888]

Hi ceres4, you can try this quick hack in the authenticator.py file: replace response = requests.get(self.host.vpn_url) with response = requests.get(self.host.vpn_url,verify=False) and 2 times replace this: response = self.session.post(self.host.vpn_url, request) with response = self.session.post(self.host.vpn_url, request,verify=False)

[ceres4]

Hi Mirro88,

Thank you for your response it works although I have other problem!

[Mirro888]

Maybe if you describe your problem, someone will know the solution.

[plachta11b]

I had to add the cert to nssdb to make the browser work with a self-signed cert. Python requests library needs to have ca-bundle configured too: ENV REQUESTS_CA_BUNDLE /usr/lib/ssl/cert.pem. Both tools do not take system certs into account by default.