Requests: Add let's encrypt ca certificates to trusted certs

[maxnoe]

IMO requests should trust let's encrypt issued certs: www.letsencrypt.org

[sigmavirus24]

Do you have evidence that we don't?

If so, can you share the URL and version of requests, Python, and openssl?

Sent from my Android device with K-9 Mail. Please excuse my brevity.

[Lukasa]

Requests does trust LE: LE uses a cross signed root that we have chained up to for years.

[maxnoe]

MMh, then why do I get an SSL error when I request https://auxdb.app.tu-dortmund.de? It is using a letsencrypt certificate and all browsers I tried trust this certificate.

requests.get('https://auxdb.app.tu-dortmund.de')

I added the 4 intermediate certificates of letsencrypt to my systems ca-certificates:
https://letsencrypt.org/certificates/

This works:

requests.get('https://auxdb.app.tu-dortmund.de', verify='/etc/ssl/certs/ca-certificates.crt')

[Lukasa]

What version of requests do you have installed, what packages on your system do you have installed, what OS are you on, and what OpenSSL version do you have?

[maxnoe]

Are you saying that you can request the given url without ssl error?

[t-8ch]

@MaxNoe The server does not server the intermediate certificate(s) like it should (browser cache them from other sites, so it may work)
Compare:

$ openssl s_client -connect auxdb.app.tu-dortmund.de:443 -CAfile /etc/ssl/certs/ca-certificates.crt
...
Certificate chain
 0 s:/CN=git.e5.physik.tu-dortmund.de
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
...
Verify return code: 21 (unable to verify the first certificate)

$ openssl s_client -connect t-8ch.de:443 -CAfile /etc/ssl/certs/ca-certificates.crt
...
Certificate chain
 0 s:/CN=t-8ch.de
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
...
Verify return code: 0 (ok)

Certbot saves the chain to chain.pem and fullchain.pem (including the leaf cert).

[maxnoe]

Mhh, ok. So it's a problem on the other hand. Sorry to bother.

[maxnoe]

Ok, got it. I use a python script to upload the certificates obtained by letsencrypt into the rancher api. I got the keyword for the chain cert wrong. Everything works now.

[kennethreitz42]

Glad to hear that Requests is of a level of quality that it accidentally led you to fix your improperly configured server.

We should start selling a security audit edition license for corporations :)