Custom s3 compatible https endpoint not working, port forwarded to localhost works

[ion-elgreco]

Custom s3 compatible https endpoint not working, port forwarded to localhost works

[ion-elgreco]

I see what's going wrong here. By default it's looking at the wrong certificate bundle, while it should use this: /etc/ssl/certs/ca-certificates.crt, other clients like Hyper in Rust don't really have an issue with find this, so quite interesting

[martindurant]

Python SSL certificates are a thing. Apparently, you can set AWS_CA_BUNDLE or configure this in your .aws config somehow.

[ion-elgreco]

@martindurant what do you mean, are a thing? I don't use AWS so I won't have that config.

What I don't quite get, that this is only an issue with aiobotocore. everything else is able to find the certificate bundles without a problem

[martindurant]

The cert path defined within python is often not your system one. The rust crate will use the latter.

everything else is able to find the certificate bundles without a problem

What is "everything else" in this context? Libraries like requests usually allow you to explicitly supply extra bundles/paths at runtime.

[ion-elgreco]

The cert path defined within python is often not your system one. The rust crate will use the latter.

everything else is able to find the certificate bundles without a problem

What is "everything else" in this context? Libraries like requests usually allow you to explicitly supply extra bundles/paths at runtime.

I don't believe I've needed to manually provide the paths for 'requests' before

[martindurant]

I don't believe I've needed to manually provide the paths for 'requests' before

but have you used that with a custom endpoint like this before?

[ion-elgreco]

I don't believe I've needed to manually provide the paths for 'requests' before

but have you used that with a custom endpoint like this before?

I connected on multiple occasions to intranet pages that required the CA bundles to be manually installed in the system.

[martindurant]

ca_bundle and AWS_CA_BUNDLE are mentioned here: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html . This suggests that boto(core) won't use your standard configuration without explicitly configuring. Have you tried setting these values?

[ion-elgreco]

@martindurant I got it working with: client_kwargs={"verify": CERT_PATH}, sorry for late update : P