请求 Microsoft graph api 时出现 SSL 错误答案

【问题标题】：SSL error while doing a request for Microsoft graph api请求 Microsoft graph api 时出现 SSL 错误
【发布时间】：2021-09-07 01:50:26
【问题描述】：

我试图将 Microsoft Graph API 集成到气流应用程序 docker-compose 中。我的域有一个自签名 SSL 证书。

以下是DAG（pythonOperator）的示例：[我使用的是msalpypi包]

app_meta = MicrosoftGraphAPI.get()
app = msal.ConfidentialClientApplication(
   app_meta['client_id'],
   authority=app_meta['authority'],
   client_credential=app_meta['client_credential'],
   token_cache=None,
)

错误：

    WARNING - Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])"))': /d8c857c0-b2da-48fd-9b28-db5792c0d481/v2.0/.well-known/openid-configuration
[2021-06-23 10:19:02,870] {taskinstance.py:1396} ERROR - HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /d8c857c0-b2da-48fd-9b28-db5792c0d481/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))
Traceback (most recent call last):
  File "/home/airflow/.local/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py", line 488, in wrap_socket
    cnx.do_handshake()
  File "/home/airflow/.local/lib/python3.8/site-packages/OpenSSL/SSL.py", line 1934, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "/home/airflow/.local/lib/python3.8/site-packages/OpenSSL/SSL.py", line 1671, in _raise_ssl_error
    _raise_current_error()
  File "/home/airflow/.local/lib/python3.8/site-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
    raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')]
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/home/airflow/.local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 670, in urlopen
    httplib_response = self._make_request(
  File "/home/airflow/.local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 381, in _make_request
    self._validate_conn(conn)
  File "/home/airflow/.local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 978, in _validate_conn
    conn.connect()
  File "/home/airflow/.local/lib/python3.8/site-packages/urllib3/connection.py", line 362, in connect
    self.sock = ssl_wrap_socket(
  File "/home/airflow/.local/lib/python3.8/site-packages/urllib3/util/ssl_.py", line 386, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/home/airflow/.local/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py", line 494, in wrap_socket
    raise ssl.SSLError("bad handshake: %r" % e)

更新：我不想忽略证书验证。如何解决它

【问题讨论】：

您能否提供有关您的集成、示例 DAG 以及您如何使用 Microsoft Graph API 的更多信息？
@bruno-uy，更新帖子
无法验证服务器证书。证书链中是否有可用的中间/根 CA 证书？
不知道是什么意思，我只是在dag中使用了msalpypi来调用graph api

标签： python python-requests microsoft-graph-api airflow

【解决方案1】：

早期的中间 CA 证书是可选的，但现在您必须在证书链中拥有所有可用的根证书和中间证书。我在连接到 nuget 站点下载包时也遇到了这个问题，所以我安装了“BaltimoreCyberTrustRoot”、“Microsoft Azure TLS Issuing CA 01”和“DigiCertGlobalRootG2”。它对我有用。

【讨论】：