Fetching collections from private Artifactory: CERTIFICATE_VERIFY_FAILED

Get Help
, ,
1

Dear AWX users,

we are trying to pull collection updates from a private Artifactory instance.

We found that we need to disable the TLS certificate validation, even though Artifactory is using a valid certificate.

Got an unexpected error when getting available versions of collection
community.hashi_vault: Unknown error when attempting to call Galaxy at
'https://artifactory.example.org/api': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify
failed: unable to get local issuer certificate (_ssl.c:1032)>. <urlopen error
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local
issuer certificate (_ssl.c:1032)>
ERROR! Unknown error when attempting to call Galaxy at 'artifactory.example.org/api': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)>. <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)>

Funnily enough, we can curl Artifactory from inside all containers in the awx-task and awx-web pods. Or use python urllib to connect, which also works fine.

It seems to only be the collections update that fails.

The execution environment used for the controlplane (which is used for the project updates) is self-built and includes ansible-core 2.18.10 as well as openssl and ca-certificates. It is based on the example here

Any ideas how to debug further? Any solutions, tips, tricks?

Kind Regards,
Johannes

2

Trusting a Custom Certificate Authority - Ansible AWX Operator Documentation

Please see if this helps , you have to create a bundle-ca with your custom CA which has signed your artifactory certificate and add it your KIND AWX deployment you have created

3

Do you use a certificate signed by the new Sectigo R46 CA? I had the same problem with webhook notifications to our ticketing system.
See Questions about notifications in AWX 24.6.1 - #7 by ildjarn for how I solved it.

4

Artifactory does not use a certificate signed by a custom CA. It is a regular certificate, signed by SwissSign AG.

And why would this error out during collection sync, when all other connections (curl, python urllib3, …) we tried did not complain regarding the certificate?