Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Receiving error when trying to use Cert in Python script

Hello,

We are trying to connect to the Information Service on the Orion server using the following Python script line:

swis = orionsdk.SwisClient(SWServerName, SWUsername, SWPassword, verify="/etc/ssl/certs/SolarWinds.pem")

However, we are getting the following error and i'm not sure how we should proceed.

/usr/local/lib/python3.8/dist-packages/urllib3/connection.py:357: SubjectAltNameWarning: Certificate for flxxxxxx.xxx.com has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See github.com/.../497 for details.)

urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='flxxxxxx.xxx.com', port=17778): Max retries exceeded with url: /SolarWinds/InformationService/v3/Json/Query (Caused by SSLError(SSLCertVerificationError("hostname 'flxxxxx.xxx.com' doesn't match 'SolarWinds-Orion'")))

Could anyone tell me what we are missing? I can't seem to find anything.

Thanks for any help,

Tom

Find more posts tagged with

Accepted answers

cpund

This has been a persistent problem for the last... at least 5 years with using the SolarWinds API.

The problem is with the self-signed certificates SolarWinds generates to secure community with the API between itself and external calls.

Caused by SSLError(SSLCertVerificationError("hostname 'flxxxxx.xxx.com' doesn't match 'SolarWinds-Orion'"))

Let's say my Orion instance was at orion.example.org, and I try to use the API. The SSL Cert used has a common name (CN) of "SolarWinds-Orion", not "orion.example.org". Because there's a mismatch between the name that you access Orion, and the self-signed cert's CN, it causes this problem. To my knowledge, there's two methods to solve this. Either A. Don't use SSL (verify=false), or B. Go into your hosts file on whichever machine you're using, and set the hostname SolarWinds-Orion to point to your orion server's IP.

If you've not ever modified your hosts file before, open /etc/hosts with your favorite text/cli editor and add a new line:

192.168.1.1     SolarWinds-Orion

Replacing 192.168.1.1 with whatever IP it's located at.

All comments

cpund

This has been a persistent problem for the last... at least 5 years with using the SolarWinds API.

The problem is with the self-signed certificates SolarWinds generates to secure community with the API between itself and external calls.

Caused by SSLError(SSLCertVerificationError("hostname 'flxxxxx.xxx.com' doesn't match 'SolarWinds-Orion'"))

If you've not ever modified your hosts file before, open /etc/hosts with your favorite text/cli editor and add a new line:

192.168.1.1     SolarWinds-Orion

Replacing 192.168.1.1 with whatever IP it's located at.

tdavison2

Awesome, thank you for the very quick response. Very helpful. My apologies, one follow up question. I tried adding SolarWinds-Orion to the hosts file without success, but I think the admin still used the actual server name in the SWIS Client command. Should the SolarWinds-Orion be used as the Server name instead to get this to work?

Thanks again,

Tom

cpund

Correct. At this point, you should refer to the solarwinds instance when constructing the sdk client via "SolarWinds-Orion".

adam.beedell

I've had a bunch of really weird behaviour doing this sort of thing recently, dont recommend.

You can add a correct SSL cert in config wizard or via IIS

cpund

Apologies if this isn't correct, but during my initial research into this issue ~4 years ago, I thought I had some inkling that replacing the SSL cert could break calls between the pollers. Unless I'm misremembering and it was just something that you'd have to replace after each upgrade.

adam.beedell

No issues with polling as long as the certificate is correct and trusted everywhere at what not (bad certs would be a concern)

During an upgrade as long as the website bindings checkbox is still ticked you can keep the same SSL, that said you'd need to remove the website from time to time or update the cert and both of those would need it updating again.

I may need to check specifically the cert presented on API calls to make sure I'm not just referring to the user-based connection, but wouldn't have a chance to mess with it anytime soon

When i've done the hosts file hack to get a working certificate connection for various things some web connections will process the pages wrong, I'd be quite worried about immediately breaking stuff on making that change (though I do have some working HOSTS entries anyway for weird DNS reasons)