Hi,
When I'm trying to send the API request to the Qualys US Platform 2, All my requests are resulting in the following error
requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)
Do I need to install any extra (Qualys) Certificate to get this issue resolved
Thanks,
Suraj
Depending on how your making the call. You have two options; you can explicit say insecure. So in CURL you could use --insecure and most commands would allow this.
Otherwise you would need to download the certificate from Qualys and put this in your local certificate store.
I would try it first with the insecure flag. If it works then try to load it into your system and see if it then works without the secure flag.
David
Hi Busby,
I'm using Python requests to send the POST requests. I tried using " verify=False", in which case I'm getting this error
C:\Python27\lib\site-packages\urllib3\connectionpool.py:852: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)
How can I download Qualys Certificate? I'm not able to find any of that option in GUI
Thanks
Suraj
what browser are you using and I will try and give you the step-by-step
I use Google Chrome as my browser. I can access the Qualys API/Guard through the browser but this error is only seen when trying to access through API.
Thanks
Suraj
ok I use both but I can tell you the steps in Firefox, Chrome I did not see how.
In Firefox in the upper left next to the padlock there is a little information ICON.
If you click that it should give you two icons one for Secure Connection with an arrow to the right. Click the arrow then click More Information. Now a new page comes up.
Now click on view Certificate then details. Under details you can Export the certificate. On Windows you can add this to your certificate store to trust. But depending on what tool your using to access the API you may need to put the certificate in another location as well and you would need to consult the documentation.
Let me know if you need help on that.
David
Please see: Using SSL client certificate authentication with QualysGuard API v1 and v2 and note we do not support cert auth with the API.
Yep no certificate authentication but I read the issue as they get warning for insecure communication. For things like CURL you can put the cert in a specific place and then you don't get the warnings but it has nothing to do with authentication just verification that the certificate is trusted. This can be specific to the clients as they don't usually come with a trusted certificate store.
David
Hi Jeff,
If I can't send the certificate for authentication, how can I resolve this issue "requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)"
And when I change the request to add the Qualys Certificate
request = self.session.post(url, cert="path/qualys.crt",data=data, auth=self.auth, headers=headers, proxies=self.proxies)
result in " requests.exceptions.SSLError: [SSL] PEM lib (_ssl.c:2600)" Error.
I'm sending basic authorization for logging and then SessionID for the subsequent requests. Sending the same data using POSTMAN is working but not with Python requests. What do you suggest for this issue?
Thanks
Suraj
"Sending the same data using POSTMAN is working but not with Python requests." this suggests the problem is with your code and not on the Qualys side.
First as Mr. Leggett has stated before the API does not support certificate based authentication; all you are doing is removing errors related to insecure communications warnings.
So typically to resolve the error in say a CURL command you pass the parameter --insecure. This does not fix the error merely acknowledge that that is what you expect.
I do not know if post man is doing anything with the certificate or not but it is not part of your authorization or authentication.
API troubleshooting
This write up was for the site https://qualysguard.qg2.apps.qualys.com
The API failed due to a missing certificate. It was working fine before but now it failed. It may be that recent updates may have messed with the certificate store or I misinterpreted results since I am developing for pod1 and pod2 simultaneously. Regardless, The following details what I had to do on my two systems to get pod2 API to work.
It failed in two places using two different testing methods. The curl command failed which uses the system certificates and the python “Requests” package failed which uses the certificates installed with the certifi package. The easy way to test was with the curl command. And although this should be fixed it led me down a false path to get the python API working. The rest of this write up details fixing both curl and the python API.
References:
https://curl.haxx.se/docs/sslcerts.html
https://community.qualys.com/docs/DOC-3273
https://stackoverflow.com/questions/22027418/openssl-python-requests-error-certificate-verify-failed
https://serverfault.com/questions/394815/how-to-update-curl-ca-bundle-on-redhat
1.1.1 systems certificates to use with curl
Problem: curl command failed when going to pod2 with following error embedded in curl output:
SSL certificate problem: unable to get local issuer certificate
Test:
You may have to set up your proxies:
export http_proxy=proxy_name:proxy_port
export https_proxy=proxy_name:proxy_port
Test with the curl command:
curl -vv -u "USERNAME" -H "X-Requested-With: Curl" https://qualysguard.qg2.apps.qualys.com/api/2.0/fo/network/?action=list
Find out where the certificate storage is by running a command that fails. The curl output should display the certificate store. It will prompt you for a password.
curl -vv -u "USERNAME" -H "X-Requested-With: Curl" https://qualysguard.qg2.apps.qualys.com/api/2.0/fo/network/?action=list
1.1.1.1 Redhat 6.9 (Santiago):
https://curl.haxx.se/docs/sslcerts.html This is good background but won’t help much on RedHat.
https://serverfault.com/questions/394815/how-to-update-curl-ca-bundle-on-redhat This is more help, but incomplete
cat /etc/pki/ca-trust/source/README
The forgoing did not work for me on RedHat. I had to download the certificate, convert to pem format and then insert it into the following file
/etc/pki/tls/certs/ca-bundle.crt
CAfile: /etc/pki/tls/certs/ca-bundle.crt
If you use Internet Explorer, this is one way to get extract the CA cert for a particular server:
THe forgoing did not work for me so i tried copying the ca-bundle.crt to my local directory and adding the cert to that file.
curl -vvv --cacert ca-bundle.crt -u "gener2sm1" -H "X-Requested-With: Curl" "https://qualysguard.qg2.apps.qualys.com/api/2.0/fo/network/" -d "action=list"
Once that test passed I made a backup of the file and I manually updated the original file with the qualys-qg2.pem data.
1.1.1.2 Ubuntu 16.04.3 LTS"
. . . . .
* found 150 certificates in /etc/ssl/certs/ca-certificates.crt
* found 604 certificates in /etc/ssl/certs
. . . . . .
https://curl.haxx.se/docs/sslcerts.html
If you use Internet Explorer, this is one way to get extract the CA cert for a particular server:
curl -vvv --insecure http://sg.symcb.com/sg.crt -o qualys_qg2.crt
openssl x509 -inform DES -in yourdownloaded.crt -out outcert.pem -text
curl -vvv --cacert qualys_qg2.pem -u "USERNAME" -H "X-Requested-With: Curl" "https://qualysguard.qg2.apps.qualys.com/api/2.0/fo/network/" -d "action=list"
$ sudo su -
# cd /usr/share/ca-certificates/mozilla
# cp -i [PATH] qualys.pem qualys_[qg1|2].crt
# vi /etc/ca-certificates.conf
# add mozilla/ qualys_[qg1|2].crt
# update-ca-certificates -v
Updating certificates in /etc/ssl/certs...
Doing .
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
Test:
1.1.2 Updating python certificates
First verify the error using your python scriptYou will see something like this:
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:645)
requests.packages.urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:645)
This looks like a missing certificate in the certifi package that installs the certificates in .PEM format.
Find out where the certificates are:
python3 -c 'import requests; print(requests.certs.where())'
After this, use the methods above to obtain the cert, convert it to pem format and then load it into the certificate file.
The places where I found it. If you use a virtual environment you may see it in a different place. YMMV:
RedHat:
/usr/local/lib/python3.5/site-packages/requests-2.11.1-py3.5.egg/requests/cacert.pem
Ubuntu:
/usr/local/lib/python3.5/dist-packages/certifi-2017.7.27.1-py3.5.egg/certifi/cacert.pem
The redhat file was a little different. It had Informational headers. I used the following command to get them
You can use the following as a header before the certificate. Make sure you use “#” to comment out the information.
openssl x509 -serial -subject -issuer -fingerprint -in qualys_qg2.pem -noout
Please see: Using SSL client certificate authentication with QualysGuard API v1 and v2 and note we do not support cert auth with the API.