Bug/check certificate #438
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Amazon S3's wildcard certificate doesn't work with FQDN-style buckets (any bucket with a '.' in its name). We were calling ssl._create_unverified_context() when --no-check-certificate was being used, but this doesn't actually stop the host name checks from happening, which on python 2.7.9, then fail the connection before doing any useful work. I don't think we need _create_unverified_context() at all, certainly not for talking to S3 directly, and with --ca-cert present, we shouldn't need it for any S3-like services either. This patch also fixes up a failed merge conflict, having us use _https_connection() on the non-proxied path like we intended.
http://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html "When using virtual hosted–style buckets with SSL, the SSL wild card certificate only matches buckets that do not contain periods. To work around this, use HTTP or write your own certificate verification logic." Therefore, when we detect we are sending a request to *.s3.amazonaws.com and are using SSL, we must disable hostname checking. This seems to only impact python 2.7.9 and newer, as that's where the new SSL context and checking exist.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #437