Custom SSL Certificate Verify about tus-py-client HOT 6 CLOSED

Thank you for bringing up this discussion in such a detailed way. This is probably best handled by @ifedapoolarewaju, the developer behind tus-py-client. However, it might take a few days until he's able to respond.

from tus-py-client.

Ok, many thanks :)

from tus-py-client.

Hi any thoughts / feedback regarding this issue?

from tus-py-client.

hi @dcs3spp do you know what URL is being requested from tuspy client at the time the error is thrown? I am asking to know what library throws the error of the two used by the client

from tus-py-client.

Hi @ifedapoolarewaju,

Firstly, if both environment variables are set it works great. A great library that has made development much easier.

The URL endpoint that I am passing to tus-py-client is the tus endpoint https://test.example.com:1081/files/. I only receive an upload URL from tus-py-client if the REQUESTS_CA_BUNDLE environment variable is set. This allows the requests library to successfully send a request for creating an upload url, e.g. https://test.example.com:1081/files/640fd39f3325f301273576e12b3e335c+e22beb02-18fe-4b8e-a57f-39de91ec9fcb

If the SSL_CERT_FILE environment is not also set then a chunk fails to upload with an SSL VERIFY Exception from the http.client library.

Moving forward is there the possibility to raise a new feature request allowing the path to the CA certificate to be specified in TusClient constructor which then gets passed onto the requests and http-client libraries?

I have tried to include a detailed account below. Hope this helps.

Kind regards

dcs3spp

The tusd server is running behind an nginx proxy with an SSL terminated connection. I can visit the /files/ and /metrics/ endpoints for tusd successfully in browsers with a SSL/TLS connection successfully.

I am making a request to tus-py-client as follows:

try:
    ........<earlier code to to set path to file to upload and initialise meta data>
    uploader = tusd_client.uploader(filepath, chunk_size=6291456, metadata=meta_data_dict)
    uploader.upload()
    log.info("test_upload_document_template :: sent upload request to tusd server")
except TusCommunicationError as ce:
    raise RuntimeError(f"tusclient error {ce}") from ce

If I do not set REQUESTS_CA_BUNDLE environment variable then tus-py-client throws an exception when using the requests library. The exception is an SSLError and is triggered at line 205 of uploader.py in the create_url function :

SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:841)'),))

If I set REQUESTS_CA_BUNDLE but do not set SSL_CERT_FILE then the following occurs.

1. A url is created for uploaded by the create_url function in uploader.py. This is https://test.example.com:1081/files/640fd39f3325f301273576e12b3e335c+e22beb02-18fe-4b8e-a57f-39de91ec9fcb
2. tus-py-client creates a TusRequest instance and starts the process of uploading file chunks. When the first chunk is uploaded an exception is thrown at line 287 of the _do_request function in uploader.py. This is triggered from line 276 in the upload_chunk function. The exception that is rasied is [SSL: CERTIFICATE_VERIFY_FAILED]. Upon further inspection of the source code, TusRequest uses the http.client library

If I then set REQUESTS_CA_BUNDLE and SSL_CERT_FILE everything works.

from tus-py-client.

Closing this issue due to inactivity. Feel free to leave a comment if you want to continue the discussion :)

from tus-py-client.