Unable to connect to Azure Service fabric cluster from MAC

Question

I am trying to connect to a secured Azure Service Fabric cluster from my MAC but I am having some SSL issues

I can authenticate the /Explorer through the same certificate via web browser but when I am trying the same with my command-line I am getting SSl errors. Any suggestions please ?

Ushas-MacBook-Pro:azure-16 ushasm$ sfctl cluster select --endpoint https://mylinuxx.centralindia.cloudapp.azure.com:19080 --pem client.pem

Error :

Error occurred in request., SSLError: HTTPSConnectionPool(host='mylinuxx.centralindia.cloudapp.azure.com', port=19080): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)'),)) Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 601, in urlopen chunked=chunked) File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 346, in _make_request self._validate_conn(conn) File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 850, in _validate_conn conn.connect() File "/usr/local/lib/python3.6/site-packages/urllib3/connection.py", line 326, in connect ssl_context=context) File "/usr/local/lib/python3.6/site-packages/urllib3/util/ssl_.py", line 329, in ssl_wrap_socket return context.wrap_socket(sock, server_hostname=server_hostname) File "/usr/local/Cellar/python3/3.6.4_2/Frameworks/Python.framework/Versions/3.6/lib/python3.6/ssl.py", line 407, in wrap_socket _context=self, _session=session) File "/usr/local/Cellar/python3/3.6.4_2/Frameworks/Python.framework/Versions/3.6/lib/python3.6/ssl.py", line 814, in init self.do_handshake() File "/usr/local/Cellar/python3/3.6.4_2/Frameworks/Python.framework/Versions/3.6/lib/python3.6/ssl.py", line 1068, in do_handshake self._sslobj.do_handshake() File "/usr/local/Cellar/python3/3.6.4_2/Frameworks/Python.framework/Versions/3.6/lib/python3.6/ssl.py", line 689, in do_handshake self._sslobj.do_handshake() ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/requests/adapters.py", line 440, in send timeout=timeout File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 668, in urlopen **response_kw) File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 668, in urlopen **response_kw) File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 668, in urlopen **response_kw) File "/usr/local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 639, in urlopen _stacktrace=sys.exc_info()[2]) File "/usr/local/lib/python3.6/site-packages/urllib3/util/retry.py", line 388, in increment raise MaxRetryError(_pool, url, error or ResponseError(cause)) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='mylinuxx.centralindia.cloudapp.azure.com', port=19080): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)'),))

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/msrest/service_client.py", line 201, in send **kwargs) File "/usr/local/lib/python3.6/site-packages/requests/sessions.py", line 508, in request resp = self.send(prep, **send_kwargs) File "/usr/local/lib/python3.6/site-packages/requests/sessions.py", line 618, in send r = adapter.send(request, **kwargs) File "/usr/local/lib/python3.6/site-packages/requests/adapters.py", line 506, in send raise SSLError(e, request=request) requests.exceptions.SSLError: HTTPSConnectionPool(host='mylinuxx.centralindia.cloudapp.azure.com', port=19080): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)'),))

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/knack/cli.py", line 125, in invoke cmd_result = self.invocation.execute(args) File "/usr/local/lib/python3.6/site-packages/knack/invocation.py", line 85, in execute cmd_result = parsed_args.func(params) File "/usr/local/lib/python3.6/site-packages/knack/commands.py", line 67, in call return self.handler(*args, **kwargs) File "/usr/local/lib/python3.6/site-packages/knack/commands.py", line 123, in _command_handler result = op(client, **command_args) if client else op(**command_args) File "/usr/local/lib/python3.6/site-packages/sfctl/custom_cluster.py", line 95, in select rest_client.send(rest_client.get('/')).raise_for_status() File "/usr/local/lib/python3.6/site-packages/msrest/service_client.py", line 227, in send raise_with_traceback(ClientRequestError, msg, err) File "/usr/local/lib/python3.6/site-packages/msrest/exceptions.py", line 45, in raise_with_traceback raise error.with_traceback(exc_traceback) File "/usr/local/lib/python3.6/site-packages/msrest/service_client.py", line 201, in send **kwargs) File "/usr/local/lib/python3.6/site-packages/requests/sessions.py", line 508, in request resp = self.send(prep, **send_kwargs) File "/usr/local/lib/python3.6/site-packages/requests/sessions.py", line 618, in send r = adapter.send(request, **kwargs) File "/usr/local/lib/python3.6/site-packages/requests/adapters.py", line 506, in send raise SSLError(e, request=request) msrest.exceptions.ClientRequestError: Error occurred in request., SSLError: HTTPSConnectionPool(host='mylinuxx.centralindia.cloudapp.azure.com', port=19080): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)'),))

Answer 1

Are you using a self-signed certificate? If so, add --no-verify to the sfctl cluster select command.

If it is a self-signed certificate that is not CA signed, you can pass the --no-verify option to bypass CA verification If it is a self-signed certificate that is not CA signed, you can pass the --no-verify option to bypass CA verification

source