topic Re: MineMeld outbound calls impacted by SSL interception in General Topics

MineMeld outbound calls impacted by SSL interception

andrew.stanton — Thu, 15 Dec 2016 22:35:36 GMT

I could see the node was having problems pulling the external resource due it being decrypted and our CA being used.

I added our CA to the Ubuntu store with the processes used here, but still no juice.

Thoughts?

ksteves1 — Fri, 16 Dec 2016 20:00:02 GMT

python requests library uses its own CA store and certifi store. but we have to investigate more how to best handle this. stay tuned. thanks!

andrew.stanton — Fri, 16 Dec 2016 20:49:18 GMT

probably this file:?

/opt/minemeld/engine/0.9.30/lib/python2.7/site-packages/requests$ ls -lh cacert.pem
-rw-r--r-- 1 minemeld minemeld 302K Dec 15 21:26 cacert.pem

lmori — Mon, 19 Dec 2016 07:49:21 GMT

that's what is being used by MineMeld. That file is upgraded with MineMeld upgrades.

The idea then would be:

- take that file and place it in a "safe" directory (a directory persistent across upgrade), like /opt/minemeld/local/certs

- append your cert to that file

- create the file /etc/default/minemeld with contenets "export REQUESTS_CA_BUNDLE=/opt/minemeld/local/certs/cacert.pem"

- sudo service minemeld restart

We are working on a utility to do this.