SSL handshake fails on OS X 10.11.2 (certificate verify failed) about mediawiker HOT 15 CLOSED

Update here: Mediawiker uses Package Control's SSL implementation, so it would seem that problem lies there (most likely, PC can't get certs from the Keychain). @tosher, can you confirm my suspicions?

Also, I get this problem both on OS X 10.10.5 and 10.11.2.

from mediawiker.

Yes, the plugin depends on ssl from package control.
Do you have the same problems as in

• wbond/package_control#959
• wbond/package_control#957

or only with Mediawiker?

from mediawiker.

Mediawiker only, and only with our corporate wiki.
I tried https with Wikipedia, everything is fine. Package Control itself works fine too.

It seems that Package Control doesn't trust our custom certificate despite I have added it to the Mac's Keychain and to ca-bundle.

from mediawiker.

I'm forgot about one thing, the plugin depends on PC's _ssl library loader only, and for Linux platform.
I think it's bug in my code (or bug or unsupported in mwclient library) and I'll research it.

If you know some public sites (based on mediawiki engine) with the same problem, tell me please :) It will be useful for testing.

from mediawiker.

I don't know such wikis but I can test a beta on our wiki. :] Just tell me the branch hash.

from mediawiker.

For self signed certificate we can disable verification of cert:
mwclient/client.py

after the string

self.connection = requests.Session()

add line

self.connection.verify = False

If this changes will help, i'll can to add this option to the plugin.

from mediawiker.

Sure, I'll test it next morning (around 11:00 UTC+4).

from mediawiker.

Tested, everything works (had to restart Sublime).

As far as I can tell, the new line disables cert verification altogether. I would suggest to do this only for self-signed certs (e. g. those that are stored in Package Control.user-ca-bundle or in the Keychain, something like that).

Thanks, anyway!

from mediawiker.

I'll make it as param in server settings with default value as True (verification is On).

from mediawiker.

That will be nice. Thank you.

from mediawiker.

Please, try the new version: 3.0.2
is_ssl_cert_verify - option for site configuration

"My wiki":
{
    "host": "en.wikisite.com",
    "https": true,
    "is_ssl_cert_verify": false,
    ...
}

from mediawiker.

Oops, something went wrong.

Traceback (most recent call last):
  File "/Users/yakovshapovalov/Library/Application Support/Sublime Text 3/Packages/Mediawiker/mwutils.py", line 256, in get_site
    sitecon = mwclient.Site(host=self.host, path=self.path, do_ssl_cert_verify=self.is_ssl_cert_verify)
TypeError: __init__() got an unexpected keyword argument 'do_ssl_cert_verify'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Applications/Sublime Text.app/Contents/MacOS/sublime_plugin.py", line 550, in run_
    return self.run(edit, **args)
  File "/Users/yakovshapovalov/Library/Application Support/Sublime Text 3/Packages/Mediawiker/mediawiker.py", line 183, in run
    sitecon = mw.get_connect(password)
  File "/Users/yakovshapovalov/Library/Application Support/Sublime Text 3/Packages/Mediawiker/mwutils.py", line 130, in get_connect
    return mwcon.get_site(password)
  File "/Users/yakovshapovalov/Library/Application Support/Sublime Text 3/Packages/Mediawiker/mwutils.py", line 267, in get_site
    raise Exception('HTTP connection failed: %s' % e)
Exception: HTTP connection failed: __init__() got an unexpected keyword argument 'do_ssl_cert_verify'

from mediawiker.

Restart required

https://github.com/tosher/Mediawiker/blob/master/mwclient/client.py

def __init__(self, host, path='/w/', ext='.php', pool=None, retry_timeout=30,
                 max_retries=25, wait_callback=lambda *x: None, clients_useragent=None,
                 max_lag=3, compress=True, force_login=True, do_init=True, httpauth=None, do_ssl_cert_verify=True):

Parameter exists.

from mediawiker.

Oops, my bad. :)
All right, now it works fine.

Thanks for your fix! 👍

from mediawiker.

Ок! Thanx for help with testing :)

from mediawiker.