#Self-signed certificate error when fetching from homelab service

1 messages · Page 1 of 1 (latest)

carmine dirge
#

I have my own CA created through Vault that provides ACME certificates to a bunch of services running in a homelab. This works well, and I've distributed the root CA certificate to the homelab machines where Nomad is running Home Assistant (among other things). Containers have the host's /etc/ssl/certs bind mounted into the container so they should be seeing the root cert. Using curl from the commandline and trying to access, e.g. https://prometheus.service.home works just fine from within the home assistant container. I can also write a few lines of Python to do an aiohttp fetch of the same URL from the container, and this is fine. However, when I try to do this from within an integration (https://github.com/mweinelt/ha-prometheus-sensor), home assistant complains of a self-signed certificate in the chain. Is there something in the aiohttp session gifted to the integration that breaks this? Something about where homeassistant reads its server certs from?

earnest nova
carmine dirge
#

Of course the answer is more integrations...

earnest nova
#

That'd be the extension point for HA 🙂

carmine dirge
#

I'm surprised though. The system's /etc/ssl/certs/ca-certificates.crt was rebuilt to include the new .home CA. This isn't enough?

earnest nova
#

If you did that and ran update-ca-certificates, I'd think it should be enough.

#

Wouldn't survive updates though

carmine dirge
#

The .crt file is in /usr/local/share/ca-certificates and I've run update-ca-certificates on the host. I do expect that this survives updates.

#

I'm wondering how this will work if this integration wants to rewrite ca-certificates on an RO filesystem...

carmine dirge
#

Yeah, this doesn't make any sense. https://github.com/Athozs/hass-additional-ca/issues/13 is at odds with what i'm seeing for python's behavior, and if the integration only serves to rebuild ca-certificates.crt at startup, then I've effectively already done that.

GitHub
private ca stopped working with update HAOS 14.0 · Issue #13 · At...

Describe the issue I added a private CA a while ago, everything was working fine. I updated from gui to latest HAOS and the CA isn't anymore trusted, integration using https like adguard or fri...

carmine dirge
#

Ok, I misread the that GH issue... Home Assistant still uses certifi, which is why there's a difference between what I see on the commandline and what HA sees. Fair enough.

#

Sigh. So, hass-additional-ca works. Solved, I guess, but it's annoying that I can't solve this in the same way as every other container I run.

#

@earnest nova thanks for the help

carmine dirge
#

Ah, no. This is terrible. After deploying the container I have to immediately restart home assistant.

brazen dune
#

I tested this "hass-additional-ca" hoping it would allow me to use "proxmox-ve" integration in https without warning flooding the logs regarding HTTPS.... but no.
To have it working i still have to use verify_ssl: false 🙁

carmine dirge
#

welp, last try is the simplest thing and it also seems to work: the hass-additional-ca repo makes mention of the REQUESTS_CA_BUNDLE environment variable. if i set that to /etc/ssl/certs/ca-certificate.crt, i can just bind mount in /etc/ssl/certs from the host.

carmine dirge