pychef中的ssl证书验证

Question

I am trying to use python to connect to chef api. I am using pychef to connect to chef from python.

Following are the code:

import chef
with chef.ChefAPI('https://chef-e.xxxx.com:443/organizations/xxxx', '/root/.chef/rajgourav.pem', 'rajgourav'):
    n = chef.Node('chef-e.xxxx.com')

I am getting following certificate error:

[root@chef-e py]# /appl/python27/bin/python  mychef.py 
Traceback (most recent call last):
File "mychef.py", line 6, in <module>
n = chef.Node('chef-e.xxxx.com')
File "/appl/python27/lib/python2.7/site-packages/chef/base.py", line 58, in __init__
data = self.api[self.url]
File "/appl/python27/lib/python2.7/site-packages/chef/api.py", line 229, in __getitem__
return self.api_request('GET', path)
File "/appl/python27/lib/python2.7/site-packages/chef/api.py", line 225, in api_request
response = self.request(method, path, headers, data)
File "/appl/python27/lib/python2.7/site-packages/chef/api.py", line 208, in request
response = self._request(method, self.url+path, data, dict((k.capitalize(), v) for k, v in request_headers.iteritems()))
File "/appl/python27/lib/python2.7/site-packages/chef/api.py", line 195, in _request
return urllib2.urlopen(request).read()
File "/appl/python27/lib/python2.7/urllib2.py", line 154, in urlopen
return opener.open(url, data, timeout)
File "/appl/python27/lib/python2.7/urllib2.py", line 431, in open
response = self._open(req, data)
File "/appl/python27/lib/python2.7/urllib2.py", line 449, in _open
'_open', req)
File "/appl/python27/lib/python2.7/urllib2.py", line 409, in _call_chain
result = func(*args)
File "/appl/python27/lib/python2.7/urllib2.py", line 1240, in https_open
context=self._context)
File "/appl/python27/lib/python2.7/urllib2.py", line 1197, in do_open
raise URLError(err)
urllib2.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)>

Could you please help me resolve ssl certificate error. I know I have to accept the certificate and add it to trusted certificate list but dont know how to do it in python.

PS I am able to work with knife without any issue.

I tried using ssl_verify param but I am getting error :

TypeError: __init__() got an unexpected keyword argument 'ssl_verify'

from api.py:

def __init__(self, url, key, client, version='0.10.8', headers={}):

Some info about my env :

[root@chef-e py]# /appl/python27/bin/python 
Python 2.7.10 (default, Aug  8 2015, 06:25:19) 
[GCC 4.4.7 20120313 (Red Hat 4.4.7-16)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
 >>> import chef
 >>> chef.__version__
 (0, 2, 3, 'dev')
 >>>

Thanks, Rajgourav Jain

Answer 1

The __init__ method of ChefAPI has the following signature:

def __init__(self, url, key, client, version='0.10.8', headers={}, ssl_verify=True):

So obviously, you have to set the parameter ssl_verify to False :

import chef
with chef.ChefAPI(
  'https://chef-e.xxxx.com:443/organizations/xxxx',
  '/root/.chef/rajgourav.pem',
  'rajgourav',
  ssl_verify=False):

But indeed, this is still missing in the documentation .

EDIT: indeed, this seems to be a change that is not yet released (the v0.2.3 tag does not yet contain this option). So either use the source from the master branch or nag the author to push out a new release.