How to Properly set SSL Certificate in openshift deployment?

[dargoz]

Hi everyone,

I've difficulties for configuring SMTP and related authentication since most of it use self-signed certificate, I always got an error:

nginx stdout | 192.168.76.2 - - [10/Dec/2024:12:06:11 +0000] "GET /accounts/email-sent/ HTTP/1.1" 200 5271 "https://weblate.apps.ocpdevgra.dti.co.id/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0"
celery-notify stderr | [2024-12-10 12:06:11,305: INFO/MainProcess] Task weblate.accounts.tasks.send_mails[12db4371-2e99-4062-a257-95e33a1cce13] received
celery-notify stderr | [2024-12-10 12:06:11,418: ERROR/594] Could not initialize e-mail backend
celery-notify stderr | Traceback (most recent call last):
celery-notify stderr | File "/app/venv/lib/python3.12/site-packages/weblate/accounts/tasks.py", line 189, in send_mails
celery-notify stderr | connection.open()
celery-notify stderr | File "/app/venv/lib/python3.12/site-packages/django/core/mail/backends/smtp.py", line 93, in open
celery-notify stderr | self.connection.starttls(context=self.ssl_context)
celery-notify stderr | File "/usr/local/lib/python3.12/smtplib.py", line 779, in starttls
celery-notify stderr | self.sock = context.wrap_socket(self.sock,
celery-notify stderr | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
celery-notify stderr | File "/usr/local/lib/python3.12/ssl.py", line 455, in wrap_socket
celery-notify stderr | return self.sslsocket_class._create(
celery-notify stderr | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
celery-notify stderr | File "/usr/local/lib/python3.12/ssl.py", line 1041, in _create
celery-notify stderr | self.do_handshake()
celery-notify stderr | File "/usr/local/lib/python3.12/ssl.py", line 1319, in do_handshake
celery-notify stderr | self._sslobj.do_handshake()
celery-notify stderr | ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)

what I've tried

1. I've tried mounting cacerts but still didn't work.
2. I've Open Terminal on weblate-web pod and ensure that cert already accessible with ls /usr/local/share/ca-certificates/
3. set DeploymentConfig with field WEBLATE_EMAIL_SSL_CERTFILE / EMAIL_SSL_CERTFILE

but I always return the same error. Maybe I did it wrong?
is there any other way I can debug?

[nijel]

The documentation only covers custom CA for HTTP requests: https://docs.weblate.org/en/latest/admin/install.html#using-custom-certificate-authority. Did you run update-ca-certificates after placing additional CA certificate?

I think EMAIL_SSL_CERTFILE is for client certificate, so it won't influence how server certificate is being verified. Furthermore, this is not exposed to environment configuration by Weblate.

[dargoz]

does that mean I still need to add this code:

import os

os.environ["REQUESTS_CA_BUNDLE"] = "/etc/ssl/certs/ca-certificates.crt"

and build my own image first?

[dargoz]

also regarding update-ca-certificates it seems the deployed container doesn't contain that command (even sudo command not enabled)

[nijel]

It is installed, but not in the search path because the container doesn't use UID 0. I've added a hint for Docker users in b873e26.

There is a long-outstanding issue to automate this: WeblateOrg/docker#1525