Hashicorp python 客户端暖通空调问题：-“握手错误：错误（[（'SSL 例程'，'tls_process_server_certificate'，'证书验证失败'

Question

我正在为我的 Hashicorp 服务器使用以下 config.hcl，

disable_mlock = true

storage "file" {
  path = "/etc/secrets"
}

listener "tcp" {
 address     = "10.xx.xx.xx:8200"
 tls_cert_file = "/etc/certs/selfsigned.crt"
 tls_key_file  = "/etc/certs/selfsigned.key"
}

当我执行保险库操作时它工作正常，但是当我尝试使用 hvac python 库访问它时，我收到 SSL 错误。 我用来从python连接到hashicorp服务器的代码是，

import hvac
client = hvac.Client(url='https://10.xx.xx.xx:8200', cert=('/etc/certs/selfsigned.crt', '/etc/certs/selfsigned.key'))
client.token = 'd460cb82-08aa-4b97-8655-19b6593b262d'
client.is_authenticated() 

我得到的完整错误跟踪如下：-

回溯（最近通话最后一个）：文件“”，1号线，在文件“/usr/local/lib/python2.7/dist-packages/hvac/v1/初始化的.py”，线路552，在is_authenticated self.lookup_token () File "/usr/local/lib/python2.7/dist-packages/hvac/v1/ init .py", line 460, in lookup_token return self._get('/v1/auth/token/lookup-self' ，wrap_ttl = wrap_ttl）上传.json（）文件“/usr/local/lib/python2.7/dist-packages/hvac/v1/ INIT py”为，线1236，在返回_GET自我。 request('get', url, **kwargs) 文件 "/usr/local/lib/python2.7/dist-packages/hvac/v1/__init .py", line 1264, in __request allow_redirects=False, **_kwargs ) 文件“/usr/local/lib/python2.7/dist-packages/requests/sessions.py”，第 512 行，请求 resp = self.send(prep, **send_kwargs) 文件“/usr/local/lib /python2.7/dist-packages/requests/sessions.py", line 622, in send r = adapter.send(request, **kwargs) File "/usr/local/lib/python2.7/dist-packages/ requests/adapters.py", line 511, in send raise SSLError(e, request=request) requests.exceptions.SSLError: HTTPSConnectionPool(host='10.xx.xx.xx', port=8200): Max retries exceeded with url: /v1/auth/token/lookup-self (由 SSLError(SSLError("bad handshake: Error([('SSLroutines', 'tls_process_server_certificate', 'certificate verify failed')],)",),) )

Answer 1

根据 hvac 文档Using TLS with client-side certificate authentication ，您需要指定verify=server_cert_path参数。

测试如下，我可以得到预期的结果。 顺便说一句，无论有没有token参数，它都可以成功运行。

import hvac

client = hvac.Client(url='https://127.0.0.1:8200',
                     token='xxxxxxxx',
                     cert=('server.crt',
                           'server.key'),
                     verify='ca.crt')

res = client.is_authenticated()
print("res:", res)