使用 Python Jira 模块连接到 Jira 服务器时出现 SSL 错误答案

【问题标题】：SSL error when connecting to a Jira server using Python Jira module使用 Python Jira 模块连接到 Jira 服务器时出现 SSL 错误
【发布时间】：2019-08-07 00:04:26
【问题描述】：

我在尝试使用客户端 SSL 证书连接到 Jira 实例时收到 SSL 错误：

>>> jira.JIRA(server="https://jira.server", options={'client_cert':'/path/to/my/cert.pem', 'verify':False})

WARNING:root:HTTPSConnectionPool(host='https://jira.server', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1056)'))) while doing GET https://jira.server/rest/api/2/serverInfo [{'params': None, 'headers': {'User-Agent': 'python-requests/2.22.0', 'Accept-Encoding': 'gzip, deflate', 'Accept': 'application/json,*.*;q=0.9', 'Connection': 'keep-alive', 'Cache-Control': 'no-cache', 'Content-Type': 'application/json', 'X-Atlassian-Token': 'no-check'}}]
WARNING:root:Got ConnectionError [HTTPSConnectionPool(host='jira.server', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1056)')))] errno:None on GET https://jira.server/rest/api/2/serverInfo
{'response': None, 'request': <PreparedRequest [GET]>}\{'response': None, 'request': <PreparedRequest [GET]>}
WARNING:root:Got recoverable error from GET https://jira.server/rest/api/2/serverInfo, will retry [1/3] in 12.759554186699715s. Err: HTTPSConnectionPool(host='jira.server', port=443): Max retries exceeded with url: /rest/api/2/serverInfo (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1056)')))
^CTraceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/toryan/.envs/python-jira/lib/python3.7/site-packages/jira/client.py", line 472, in __init__
    si = self.server_info()
  File "/Users/toryan/.envs/python-jira/lib/python3.7/site-packages/jira/client.py", line 2133, in server_info
    j = self._get_json('serverInfo')
  File "/Users/toryan/.envs/python-jira/lib/python3.7/site-packages/jira/client.py", line 2549, in _get_json
    r = self._session.get(url, params=params)
  File "/Users/toryan/.envs/python-jira/lib/python3.7/site-packages/jira/resilientsession.py", line 151, in get
    return self.__verb('GET', url, **kwargs)
  File "/Users/toryan/.envs/python-jira/lib/python3.7/site-packages/jira/resilientsession.py", line 136, in __verb
    if self.__recoverable(response_or_exception, url, verb.upper(), retry_number):
  File "/Users/toryan/.envs/python-jira/lib/python3.7/site-packages/jira/resilientsession.py", line 104, in __recoverable
    time.sleep(delay)
KeyboardInterrupt

使用requests 模块发出的相同请求正常工作：

>>> requests.get("https://jira.server/rest/api/2/serverInfo", verify=False, cert='/path/to/my/cert.pem')
/Users/toryan/.envs/python-jira/lib/python3.7/site-packages/urllib3/connectionpool.py:851: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
  InsecureRequestWarning)
<Response [200]>

.pem 文件包含证书和私钥。使用单独的证书和私钥文件并将它们作为元组传递给client_cert 时，我得到了同样的错误。我也尝试过将 .pem 和 .key 文件的内容作为字符串传递，但这没有奏效。

【问题讨论】：

根据documentation，client_cert 应该是“客户端 SSL 的请求库的 (cert,key) 元组”，而不是证书文件的文件路径。
@JohnGordon 我尝试将证书和密钥的内容作为字符串传递，但这也没有用。

标签： python ssl jira-rest-api

【解决方案1】：

只需从选项中删除验证即可。它会解决你的问题。

因为您已经添加了证书路径和verify=False，即您明确要求请求/适配器模块不要添加您添加的证书。

例如：

jira.JIRA(server="https://jira.server", options={'client_cert':'/path/to/my/cert.pem'})

或下面的代码将遵循 certifi 包提供的默认证书。

jira.JIRA(server="https://jira.server")

【讨论】：