MISP-Taxii-Server crashes when trying to connect to a MISP instance with a self signed certificate

[misp]

MISP-Taxii-Server crashes when trying to connect to a MISP instance with a self signed certificate

[worldopener]

This fixes the error:

diff --git a/pymisp/api.py b/pymisp/api.py
index d68472a..d29b658 100644
--- a/pymisp/api.py
+++ b/pymisp/api.py
@@ -1096,7 +1096,7 @@ class PyMISP(object):
         """Returns the recommended API version from the server"""
         session = self.__prepare_session()
         url = urljoin(self.root_url, 'servers/getPyMISPVersion.json')
-        response = session.get(url)
+        response = session.get(url, verify=False)
         return self._check_response(response)

     def get_version(self):

I think the cleanest way to solve this, is to create a local CA

[FloatingGhost]

You shouldn't have to edit pymisp itself. It's already able to handle self-signed certficates.

See the README

As a last resort, you can disable SSL verification (config -> misp -> verifySSL), but this is not recommended.

[worldopener]

I now use an internal CA and this CA is trusted as wget for example throws no errror

The README seems to be outdated because when i set

misp:
    url: "https://test.local"
    api: xxxx
    verifySSL = False

i get

  File "/var/www/Taxii-Server/venv/lib/python3.5/site-packages/yaml/scanner.py", line 289, in stale_possible_simple_keys
    "could not find expected ':'", self.get_mark())
yaml.scanner.ScannerError: while scanning a simple key
  in "/var/www/Taxii-Server/config/config.yaml", line 32, column 5
could not find expected ':'
  in "/var/www/Taxii-Server/config/config.yaml", line 34, column 1

Setting it with:

misp:
    url: "https://test.local"
    api: xxxx
    verifySSL: False

works

exporting the CAs crt (i use an internal CA now) doesnt work

export REQUESTS_CA_BUNDLE=/usr/local/share/ca-certificates/CA.crt

Why doesn't it use the local certs wget uses?

[FloatingGhost]

verifySSL = False

well yeah of course this would fail? This is invalid YAML

Why doesn't it use the local certs wget uses?

A question for the maintainers of requests rather than me, I'm afraid