8000 SNI support · Issue #523 · getsentry/raven-python · GitHub
[go: up one dir, main page]
Skip to content
This repository was archived by the owner on Oct 23, 2023. It is now read-only.

SNI support #523

Open
raphaelm opened this issue Nov 10, 2014 · 12 comments
Open

SNI support #523

raphaelm opened this issue Nov 10, 2014 · 12 comments

Comments

@raphaelm
Copy link

In my setup the HTTP transport always failed because of an untrusted certificate. The certificate, however, was trusted, but the server sent the wrong certificate as raven's very own SSL wrapper apparently does not support TLS Server Name Indication. My guess is that this could be fixed by adding a server_hostname attribute with useful content to the ssl.wrap_socket call in raven.utils.http.urlopen.ValidHTTPSConnection.
@xordoquy
Copy link
Contributor

Does this work with the request transport ?

@gavinwahl
Copy link

It does work with the requests transport, but then you lose the asynchronous thread feature.

@dcramer
Copy link
Member
dcramer commented Dec 2, 2014

I would like to see:

  1. How much work it is to support SNI / http proxy by ourselves
  2. How much work it is to vendor requests
  3. How much work it is to vendor urllib3 (which afaik provides all of the functionality that we want out of requests)

On Monday, December 1, 2014 at 4:48 PM, Gavin Wahl wrote:

It does work with the requests transport, but then you lose the asynchronous thread feature.

—
Reply to this email directly or view it on GitHub (#523 (comment)).

@xordoquy
Copy link
Contributor

TBH, I'd go with vendoring requests. I don't have time to investigate on urllib3 or DYI SNI / proxy support in particular with how hard supporting some proxy is with the stdlibs

@fengsi
Copy link
Contributor
fengsi commented Aug 11, 2016

+1 for this

1 similar comment
@pypetey
Copy link
pypetey commented Oct 30, 2016

+1 for this

@serathius
Copy link

+1

@miracle2k
Copy link

I thought this was kind of nightmare, having to write code for 10+ apps after switching to LetsEncrypt on the server; but then I noticed there is a pretty easy way to change the transport via the url. Just use threaded+requests+https as a url scheme!

arthurzenika added a commit to arthurzenika/salt that referenced this issue Aug 17, 2017
@arthurzenika
[sentry_returner] don't force transport config
8f9cab6 
transport can be configured in the DSN 

as an example this configuration issue with SNI servers getsentry/raven-python#523 (comment) without this transport variable, it can be fixed by just changing the dsn in the pillar
@arthurzenika arthurzenika mentioned this issue Aug 17, 2017
Merged
@Silberschleier Silberschleier mentioned this issue Mar 29, 2018
Open
@gartens
Copy link
gartens commented Jul 13, 2018

This fixed the problem for me. Should I submit a PR?

@fzarifian
Copy link

@gartens Something went wrong on your tests (see flake8 core tests)

This was referenced Jan 28, 2019
Closed
Closed
Open
@est
Copy link
est commented Jan 28, 2019 •
edited
Loading

Also to add, if you can change your sentry server nginx settings, use something like

server {
    listen   443 ssl default;
    ....
}

to force nginx route the non-SNI default website to sentry.

@xitology xitology mentioned this issue May 11, 2020
Merged
@jgadelange
Copy link

Thanks @est, this saved me from changing stuff in ~100 projects.

Somehow somewhere last week the sentry logging started throwing urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)>
Seems to be related to this issue, can't find any changes in our system so far.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0