Skip to content

Use SSL and verify certs only for HTTPS (port 443) #1603

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 12, 2022
Merged

Use SSL and verify certs only for HTTPS (port 443) #1603

merged 2 commits into from
Sep 12, 2022

Conversation

szemek
Copy link
Contributor

@szemek szemek commented Sep 12, 2022

Feature or Bugfix

  • Bugfix

Detail

Use SSL and verify certs only for HTTPS (port 443)
for port 443 use options use_ssl=True, verify_certs=True
for port 80 use options use_ssl=False, verify_certs=False

When working with local opensearch in container

docker-compose.yml

version: "3.9"

services:
  opensearch:
    container_name: opensearch
    image: opensearchproject/opensearch:1.1.0
    environment:
      - node.name=opensearch
      - cluster.name=opensearch-docker-cluster
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
      - "DISABLE_SECURITY_PLUGIN=true"
    ports:
      - "80:9200"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data:/usr/share/opensearch/data
    hostname: opensearch
    networks:
      default:
        aliases:
          - opensearch.localhost.localstack.cloud

volumes:
  data:

I experienced following error:

Traceback (most recent call last):
  File "/project/.venv/lib/python3.10/site-packages/opensearchpy/connection/http_requests.py", line 163, in perform_request
    response = self.session.send(prepared_request, **send_kwargs)
  File "/project/.venv/lib/python3.10/site-packages/requests/sessions.py", line 655, in send
    r = adapter.send(request, **kwargs)
  File "/project/.venv/lib/python3.10/site-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='localhost', port=80): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:997)')))

As you can notice, for localhost:80 SSL was used.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@jaidisido jaidisido requested a review from a team September 12, 2022 13:12
@malachi-constant malachi-constant merged commit 434b4d0 into aws:main Sep 12, 2022
@szemek szemek deleted the use-ssl-verify-certs-for-https branch September 13, 2022 09:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants