Add option for trusted CA when using HTTPS

[polski-g]

What is the idea ?

There is an ARA_API_INSECURE option which lets one ignore SSL errors, but then you get a python warning message at runtime. Would be nice for an option like ARA_API_CA which can point to a file that would be used by the requests library when making HTTPS requests.

[Nold360]

Here is my workaround for this:

You can set the Environment variable REQUESTS_CA_BUNDLE and/or CURL_CA_BUNDLE [in the context you are running Ara in] to the path to your CA-Chain. The chain could only contain the required certs or you just use the system one [if you imported your cert into the system].

e.g. for Centos 8 I'm using REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-bundle.trust.crt

Source: https://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification

[hille721]

Using the REQUEST_CA_BUNDLE environment variable is more than a workaround. It's kind of a standard for Python tools and widely used.

Would be probabably make sense to highlight it in the documentation.

[gaby]

@Nold360 @hille721 How do you add that REQUEST_CA_BUNDLE when using ansible.cfg?

I would think that ARA should set the CA for requests if the user changes ARA_API_CA

[dmsimard]

Unless mistaken, support for specifying certs, keys and CA has landed in the master branch via https://github.com/ansible-community/ara/pull/392 and https://github.com/ansible-community/ara/pull/403 but the CLI arg names will need to change a bit (see this issue) before 1.6.0 is released.

In other words, ARA_API_CA should already work if you if you install from the master branch. I would say you could use the container images that have the source installation but this is a client-side feature, not a server one.

I will leave this issue for now but let me know if it works for you.

[gaby]

I will test again tomorrow. Now that I got home my issue may be related to me specifying both:

• ARA_INSECURE_API
• ARA_CA

I will report back tomorrow once I test it again. I'm using the latest ara client + server.

[hille721]

@Nold360 @hille721 How do you add that REQUEST_CA_BUNDLE when using ansible.cfg?

I have following in my .profle/.bashrc:

# on RHEL/CentOS
if [ -f /etc/pki/tls/certs/ca-bundle.crt ]; then
    CRTFILE=/etc/pki/tls/certs/ca-bundle.crt
# on Ubuntu
elif [ -f /etc/ssl/certs/ca-certificates.crt ]; then
    CRTFILE=/etc/ssl/certs/ca-certificates.crt
fi

export REQUESTS_CA_BUNDLE=$CRTFILE
export SSL_CERT_FILE=$CRTFILE

While REQUESTS_CA_BUNDLE is used from Python requests package, SSL_CERT_FILE is used from some other tools, e.g. curl, httpx client, ...

[gaby]

@hille721 That works for one user. We have hundreds of hosts that run ansible using ansible-pull. Which is why I wanted to do this via ansible.cfg.

[hille721]

No, you can also set it in /etc/profile or /etc/environment and it will work for all users. And if you run ansible-pull via cron then you can also set it as environment variable in your crontab.

But yeah you can not set it in ansible.cfg as it is not an Ansible config.

[gaby]

It would also help if ARA did this in the client code when ARA_INSECURE_API is set:

import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

When verify is False, here: https://github.com/ansible-community/ara/blob/master/ara/clients/http.py#L36

[gaby]

Using ara_ca in my ansible.cfg fixed the issue for me. :-) I think this issue can be closed.

ansible.cfg

[ara]
api_client = http
ara_ca = /path/to/ca
ara_host = https://example.com

[dmsimard]

It would also help if ARA did this in the client code when ARA_INSECURE_API is set:

import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

When verify is False, here: https://github.com/ansible-community/ara/blob/master/ara/clients/http.py#L36

I guess we can do that. Want to send a PR @gaby ? :)

[dmsimard]

Using ara_ca in my ansible.cfg fixed the issue for me. :-) I think this issue can be closed.

api_ca, right ? There is no such setting as ara_ca.

Same thing for ara_host, it's api_host.

[gaby]

Using ara_ca in my ansible.cfg fixed the issue for me. :-) I think this issue can be closed.

api_ca, right ? There is no such setting as ara_ca.

Same thing for ara_host, it's api_host.

Oops! Yes!

[ara]
api_client = http
api_ca = /path/to/ca
api_host = https://example.com

[gaby]

It would also help if ARA did this in the client code when ARA_INSECURE_API is set:

import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

When verify is False, here: https://github.com/ansible-community/ara/blob/master/ara/clients/http.py#L36

I guess we can do that. Want to send a PR @gaby ? :)

Sure, I can submit a PR tomorrow during the day. I'm currently on my phone.

[gaby]

@dmsimard PR has been submitted