MineMeld outbound calls impacted by SSL interception

[andrew.stanton]

I could see the node was having problems pulling the external resource due it being decrypted and our CA being used.

I added our CA to the Ubuntu store with the processes used here, but still no juice.

http://askubuntu.com/questions/645818/how-to-install-certificates-for-command-line

Thoughts?

[ksteves1]

python requests library uses its own CA store and certifi store.  but we have to investigate more how to best handle this.  stay tuned.  thanks!

[andrew.stanton]

probably this file:?

/opt/minemeld/engine/0.9.30/lib/python2.7/site-packages/requests$ ls -lh cacert.pem
-rw-r--r-- 1 minemeld minemeld 302K Dec 15 21:26 cacert.pem

[lmori · Accepted solution]

HI @andrew.stanton,

that's what is being used by MineMeld. That file is upgraded with MineMeld upgrades.

The idea then would be:

- take that file and place it in a "safe" directory (a directory persistent across upgrade), like /opt/minemeld/local/certs

- append your cert to that file

- create the file /etc/default/minemeld with contenets "export REQUESTS_CA_BUNDLE=/opt/minemeld/local/certs/cacert.pem"

- sudo service minemeld restart

We are working on a utility to do this.