-
Notifications
You must be signed in to change notification settings - Fork 44
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Problems with SSL certificates with missing common name and alternative name #71
Comments
hey @gunhanoral , cam you please post content of your certificate here (CN and Subject Alternative Names)? Best, |
Hello @akarneliuk I don't think I can share any more information, sorry. |
Hey @gunhanoral , I tried to create certificate without CN, but I'm getting errors:
So I tried to create such:
However, here we still have CN, which value is Best, |
Hey @gunhanoral , Please, try the newest version Best, |
Hello @akarneliuk sorry I can't confirm if this solves the issue. I don't get any more errors due to common name or san but I can't connect to the device using pygnmi. At this point I'm not sure if this is related to this issue. Maybe I'm mixing up certificates? This is the script that I'm running:
Output:
An example of gnmic output using the same certificates:
Thank you for your time |
Hey @gunhanoral , Thanks for sharing this. Could you please advise if Best, |
Hey @gunhanoral , I did a few more tests, please check the latest #82 and published Best, |
Hello @akarneliuk , Sorry, it failed with another kind of error this time. I tried with override option, with same results.
|
Hey @gunhanoral , This message is quite interesting:
So basically it suggests something is missing in authentication. If you cannot discuss something in public, you can reach me in DM here or in LinkedIn. It is at the moment a bit difficult to troubleshoot your scenario, because I cannot reproduce your issue. Are using mTLS? Best, |
Hey @gunhanoral , after further tests, we've figured that this is not a Python problem but rather underlying C library, which handles gRPC connection. It doesn't have API to disable the validation entirely; hence, with the existing certificate I don't believe it will work, I'm afraid. The reason why gnmic working is that because it doesn't rely on the Google's C gRPC library. Best, |
If the common name is empty for the certificate, pygnmi fails due to this line.
I bypassed this using an if-else block, manually setting ssl_target_name_override. But this time pygnmi failed due to alternative name.
I tried this with a second certificate we use on some other devices and it failed with the same error.
I'm not sure what is missing here but I am using the same certificates with other gnmi tools in production so I don't think there's something wrong with them.
The text was updated successfully, but these errors were encountered: