SSL: CERTIFICATE_VERIFY_FAILED using proxy server

[radiocolin]

(Describe your issue and goal here)

The Slack SDK version

3.15.2

Python runtime version

3.7.4

OS info

RHEL 7

Steps to reproduce:

I am using the slack_sdk behind a corporate proxy that has its own SSL certificate chain. If I attempt to make a request to the Slack API using the requests library, the request is successful.

If I try using the slack_sdk, I get a urllib error:
urllib.error. URLError: urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)>

I suspect there is a magic incantation I need to point it at our certificate chain, either an environment variable to set or some code to add to my Python script, but as of yet I am unsure what that is. I have tried all of the environment variables in this thread with no luck.

[filmaj]

Hey @radiocolin,

I assume you are using the web client construct from the slack_sdk? One of 'web api clients' listed at the top of this repo's reference docs page? i.e. slack_sdk.web.client or slack_sdk.web.async_client? If so, how are you constructing the client? These clients have two relevant properties: ssl and proxy (see the constructor details here - though, granted, the docs here could use some additional details on how these two properties are used).

For full reference, the key area of the code where ssl and proxy are used is here. Depending on what combination of these two properties are used, the logic is a bit different on how they are leveraged.

The ssl property is an instance of SSLContext, which has helper methods like load_cert_chain which is probably what you are looking for to leverage your own certificate chain.

Let me know if/how that works for you, happy to help further.

[radiocolin]

Thanks, I was able to create an SSL context using the cafile parameter and apply it to the client. That solved it.

…

-CW

On Thu, May 19, 2022, at 10:30 AM, Fil Maj wrote: Hey @radiocolin <https://github.com/radiocolin>, I assume you are using the web client construct from the `slack_sdk`? One of 'web api clients' listed at the top of this repo's reference docs page <https://slack.dev/python-slack-sdk/api-docs/slack_sdk/>? i.e. `slack_sdk.web.client` or `slack_sdk.web.async_client`? If so, how are you constructing the client? These clients have two relevant properties: `ssl` and `proxy` (see the constructor details here <https://slack.dev/python-slack-sdk/api-docs/slack_sdk/web/client.html> - though, granted, the docs here could use some additional details on how these two properties are used). For full reference, the key area of the code where `ssl` and `proxy` are used is here <https://github.com/slackapi/python-slack-sdk/blob/main/slack_sdk/web/base_client.py#L521-L539>. Depending on what combination of these two properties are used, the logic is a bit different on how they are leveraged. The `ssl` property is an instance of `SSLContext` <https://docs.python.org/3/library/ssl.html#ssl-contexts>, which has helper methods like `load_cert_chain` <https://docs.python.org/3/library/ssl.html#ssl.SSLContext.load_cert_chain> which is probably what you are looking for to leverage your own certificate chain. Let me know if/how that works for you, happy to help further. — Reply to this email directly, view it on GitHub <#1214 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAHSGIIXGSBA3HTEJG5KK5TVKZF7XANCNFSM5WMLUXCA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[filmaj]

Great news. I will keep this issue open as I want to add some additional documentation in the API docs around the relevant proxy and ssl constructor parameters.

[filmaj]

OK more documentation around the proxy and ssl parameters has been merged. In the next release we will also update the published docs. Closing this!