Skip to main content

Resolving SSL-issues when using Python with Connect

Cecil Singh
  • Updated

Problem

When publishing Python content to your Connect host, you may notice that you run into issues with SSL certificate verification similar to the output below:

requests.exceptions.SSLError: HTTPSConnectionPool(host='<hostname>', port=443): Max retries exceeded with url: /api/v1/user (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)')))

This often occurs when an application on the Connect server makes a request to another content item on the same server (such as with pins). Python does not use the system-wide SSL certificates by default. Even though your system may trust the SSL certificate, Python might not! We will need to manually tell Python where the trusted SSL certificate bundle exists on your server.

Solution

We can use the in-built functionality of Connect to initialize a program supervisor script when each application is run. More information on this below:

https://docs.posit.co/connect/admin/process-management/index.html#program-supervisors

This involves creating a shell script and pointing Connect to run this each time an application is invoked. You can create this file in any directory that you like, however, for this example we will use the scripts directory for Connect's default scripts:

touch /opt/rstudio-connect/scripts/connect-env.sh

From there, using your text editor of choice, add the following line to this bash file:

#!/bin/bash

echo arguments: "$@" >&2
echo >&2

export REQUESTS_CA_BUNDLE=/path/to/ca-certificate.crt

exec "$@"

Where /path/to/ca-certificate.crt is the filepath of your SSL certificate file. It's worth noting that this file will need your complete SSL certificate chain, including any intermediary, root, and local certificates, all concatenated into the single file. Once complete, add execute permissions to this file:

sudo chmod +x /opt/rstudio-connect/scripts/connect-env.sh

Next, we can modify your /etc/rstudio-connect/rstudio-connect.gcfg file accordingly:

[Applications]
Supervisor = /opt/rstudio-connect/scripts/connect-env.sh

Lastly, restart the Connect service for this to take effect:

sudo systemctl restart rstudio-connect

 

 

Related articles