fedora-infrastructure

#6621 Stg fails to download fedmsg ca cert
Closed: Fixed Opened by msimacek.

Closed: Fixed
Reopen Issue

Trying to tail_messages with fedmsg fails in stg with:

HTTPSConnectionPool(host='fedoraproject.org', port=443): Max retries exceeded with url: /fedmsg/ca.crt (Caused by SSLError(CertificateError("hostname 'fedoraproject.org' doesn't match either of '*.stg.fedoraproject.org', 'stg.fedoraproject.org'",),))

Adding:

    ca_cert_location='https://stg.fedoraproject.org/fedmsg/ca.crt',
    crl_location='https://stg.fedoraproject.org/fedmsg/crl.pem',

to fedmsg config fixes the problem for me, but I don't know if that's the correct solution.

This is with fedmsg-1.1.0-1 from updates-testing which I installed on koschei.stg to test it.

Actually, according to the release notes, using URLs for ca/crl is now deprecated [https://github.com/fedora-infra/fedmsg/releases/tag/1.1.0], so it should point to local files instead, but that is supported only from 1.1.0

Fixed by http://infrastructure.fedoraproject.org/cgit/ansible.git/commit/?id=5c4f49a

Metadata Update from @mizdebsk:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

FYI, according to fedmsg release notes, URLs in ca_cert_location and crl_cert_location are now deprecated [0].

[0] https://github.com/fedora-infra/fedmsg/releases/tag/1.1.0

I can see how we could put CA in the filesystem, but for CRL in makes less sense - it's probably better to periodically re-download in from HTTPS. Perhaps this is something we could discuss on mailing list or in a meeting.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.