You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "antonio-andrade (via GitHub)" <gi...@apache.org> on 2025/05/10 18:36:54 UTC
[I] DuckDB error Invalid SSL Certificate Requirements Flag: CERT_NONE [superset]
antonio-andrade opened a new issue, #33401:
URL: https://github.com/apache/superset/issues/33401
### Bug description
**How to reproduce the bug**
1. Install Superset 4.1.2 on Kubernetes 1.32.3 using the current Helm Chart 0.14.2 with Helm 3.17.3 and the custom value :
```shell
bootstrapScript: |
#!/bin/bash
pip install psycopg2-binary==2.9.6 \
"duckdb-engine>=0.12.1, <0.13" &&\
if [ ! -f ~/bootstrap ]; then echo "Running Superset with uid {{ .Values.runAsUser }}" > ~/bootstrap; fi
```
2. Connect to Superset
3. Add new database
4. In the dropdown select DuckDB database and fill in SQL Alchemy URI: duckdb:///:memory:
5. Click `Test connection " => OK
6. Click `Finish`to register the database
7. Go to SQL Lab
8. Try to install httpfs extension :
```sql
INSTALL httpfs;
```
**Expected results**
The https extension should be installed and one can proceed with the connection to a S3 repository :
```sql
LOAD https;
SET s3_region='fr-par';
SET s3_endpoint='http://s3.fr-par.scw.cloud';
SET s3_access_key_id='xxxxxxx';
SET s3_secret_access_key='xxxx-xxxx-xxxx-xxxx-xxxxxx';
SET s3_url_style = 'vhost';
SET s3_use_ssl=true;
SELECT *
FROM 'https://<bucket>.s3.fr-par.scw.cloud/naiades_analyse_physicochimie.parquet'
LIMIT 10;
```
**Actual results**
The error `DuckDB error Invalid SSL Certificate Requirements Flag: CERT_NONE` appears
### Screenshots/recordings
### Superset version
4.1.2
### Python version
3.10
### Node version
I don't know
### Browser
Chrome
### Additional context
- Superset python log :
```shell
100.64.0.241 - - [10/May/2025:18:09:30 +0000] "GET /health HTTP/1.1" 200 2 "-" "kube-probe/1.32"
172.16.16.5 - - [10/May/2025:18:09:32 +0000] "POST /tabstateview/ HTTP/1.1" 400 1319 "http://51.159.25.29:8088/sqllab/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
2025-05-10 18:09:33,547:INFO:superset.commands.sql_lab.execute:Triggering query_id: 15
2025-05-10 18:09:33,565:INFO:superset.sql_lab:Query 15: Executing 1 statement(s)
2025-05-10 18:09:33,565:INFO:superset.sql_lab:Query 15: Set query to 'running'
2025-05-10 18:09:33,600:INFO:superset.sql_lab:Query 15: Running statement 1 out of 1
2025-05-10 18:09:33,659:INFO:superset.sql_lab:Query 15: Storing results in results backend, key: 5a7dc232-274e-427b-9cec-b1e2d7146a58
2025-05-10 18:09:33,684:WARNING:superset.views.error_handling:SupersetErrorsException
Traceback (most recent call last):
File "/usr/local/lib/python3.10/site-packages/flask/app.py", line 1484, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/local/lib/python3.10/site-packages/flask/app.py", line 1469, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
File "/usr/local/lib/python3.10/site-packages/flask_appbuilder/security/decorators.py", line 95, in wraps
return f(self, *args, **kwargs)
File "/app/superset/views/base_api.py", line 119, in wraps
duration, response = time_function(f, self, *args, **kwargs)
File "/app/superset/utils/core.py", line 1364, in time_function
response = func(*args, **kwargs)
File "/app/superset/views/base_api.py", line 91, in wraps
return f(self, *args, **kwargs)
File "/app/superset/utils/log.py", line 303, in wrapper
value = f(*args, **kwargs)
File "/app/superset/sqllab/api.py", line 409, in execute_sql_query
command_result: CommandResult = command.run()
File "/app/superset/utils/decorators.py", line 266, in wrapped
return on_error(ex)
File "/app/superset/utils/decorators.py", line 236, in on_error
raise ex
File "/app/superset/utils/decorators.py", line 259, in wrapped
result = func(*args, **kwargs)
File "/app/superset/commands/sql_lab/execute.py", line 105, in run
status = self._run_sql_json_exec_from_scratch()
File "/app/superset/commands/sql_lab/execute.py", line 158, in _run_sql_json_exec_from_scratch
return self._sql_json_executor.execute(
File "/app/superset/sqllab/sql_json_executer.py", line 110, in execute
raise SupersetErrorsException(
superset.exceptions.SupersetErrorsException: [SupersetError(message='Invalid SSL Certificate Requirements Flag: CERT_NONE', error_type=<SupersetErrorType.GENERIC_DB_ENGINE_ERROR: 'GENERIC_DB_ENGINE_ERROR'>, level=<ErrorLevel.ERROR: 'error'>, extra={'engine_name': 'DuckDB', 'issue_codes': [{'code': 1002, 'message': 'Issue 1002 - The database returned an unexpected error.'}]})]
172.16.16.5 - - [10/May/2025:18:09:33 +0000] "POST /api/v1/sqllab/execute/ HTTP/1.1" 500 279 "http://51.159.25.29:8088/sqllab/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
172.16.16.5 - - [10/May/2025:18:09:33 +0000] "GET /api/v1/query/updated_since?q=(last_updated_ms:1746900563101) HTTP/1.1" 200 540 "http://51.159.25.29:8088/sqllab/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
172.16.16.5 - - [10/May/2025:18:09:34 +0000] "POST /superset/log/?explode=events HTTP/1.1" 200 20 "http://51.159.25.29:8088/sqllab/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
100.64.0.241 - - [10/May/2025:18:09:35 +0000] "GET /health HTTP/1.1" 200 2 "-" "kube-probe/1.32"
172.16.16.5 - - [10/May/2025:18:09:37 +0000] "POST /tabstateview/ HTTP/1.1" 400 1319 "http://51.159.25.29:8088/sqllab/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
172.16.16.5 - - [10/May/2025:18:09:38 +0000] "PUT /tabstateview/6 HTTP/1.1" 200 1 "http://51.159.25.29:8088/sqllab/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"
```
- The connection tested with `superset test-db` works fine
```shell
# Identify superset master pod
kubectl get pods
# Launch shell into the identifed pod
kubectl exec -it superset-7d64cf964f-xqrzt -- bash
# Test DuckDB connection
superset test-db duckdb:///:memory:
# Fill the JSON engine params and validate with CTRL+D
{"connect_args":{"preload_extensions":["httpfs"],"config":{"s3_region":"fr-par","s3_access_key_id":"xxxxxxx","s3_secret_access_key":"xxxxxx-xxxx-xxxx-xxxx-xxxxxxxx","s3_endpoint":"https://s3.fr-par.scw.cloud","s3_url_style":"vhost","s3_use_ssl":"True"}}}
```
- The connection with python script works fine
```python
import sqlalchemy
REGION = "fr-par"
ACCESS_KEY_ID = "xxxxxxxx"
SECRET_ACCESS_KEY = "xxxxx-xxxx-xxxx-xxxx-xxxxxxx"
BUCKET = "xxxxx"
FILE = "naiades_analyse_physicochimie.parquet"
url = f"https://{BUCKET}.s3.{REGION}.scw.cloud/{FILE}"
endpoint = f"https://s3.{REGION}.scw.cloud"
if __name__ == "__main__":
engine = sqlalchemy.create_engine(
"duckdb:///:memory:",
connect_args={
"config": {
"s3_region": REGION,
"s3_access_key_id": ACCESS_KEY_ID,
"s3_secret_access_key": SECRET_ACCESS_KEY,
"s3_endpoint": endpoint,
"s3_url_style": "vhost",
"s3_use_ssl": True,
},
},
)
with engine.begin() as conn:
conn.execute("INSTALL spatial; LOAD spatial;")
conn.execute("INSTALL https; LOAD https;")
result = conn.execute(f"SELECT * FROM '{url}' LIMIT 10;")
print(result.fetchall())
```
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] DuckDB error Invalid SSL Certificate Requirements Flag: CERT_NONE [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #33401:
URL: https://github.com/apache/superset/issues/33401#issuecomment-2869082726
<!-- Greeting -->
Hello @antonio-andrade! I'm [Dosu](https://dosu.dev), here to help you with bugs, answer your questions, and assist you on your journey as a contributor. While you wait for a human maintainer, feel free to share more about your issue, and I'll do my best to assist you!
<!-- Answer -->
The error "Invalid SSL Certificate Requirements Flag: CERT_NONE" suggests that there might be an issue with how SSL certificates are being handled in your DuckDB setup within Superset. This error typically occurs when the SSL configuration is not set correctly or when an unsupported SSL flag is used.
Here are a few steps you can take to troubleshoot and potentially resolve this issue:
1. **SSL Configuration**: Ensure that the SSL settings in your DuckDB connection are correctly configured. The error indicates that `CERT_NONE` is not a valid flag, so you might need to adjust the SSL certificate requirements. Check if there are any specific SSL settings required by DuckDB or Superset that you might have missed.
2. **DuckDB Version**: Verify that the version of DuckDB you are using is compatible with the SSL settings you are trying to apply. Sometimes, newer versions of libraries or engines have different requirements or deprecate certain flags.
3. **Superset Configuration**: Double-check the Superset configuration to ensure that it supports the SSL settings you are trying to use. There might be additional configuration needed in Superset to handle SSL connections properly.
4. **Python Environment**: Since the connection works fine with a standalone Python script, compare the environment and dependencies used in the script with those in the Superset environment. There might be differences in library versions or configurations that could affect SSL handling.
5. **Helm Chart and Kubernetes**: Ensure that the Helm Chart and Kubernetes configurations are correctly set up to support SSL connections. There might be environment variables or configurations that need to be adjusted to allow SSL connections.
If these steps do not resolve the issue, you may need to look into the specific SSL requirements and configurations for DuckDB and how they are integrated with Superset.
<!-- Dosu Comment Footer -->
*To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
---
<sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/f54b40d2-9eee-4382-aba3-2ce715694a84?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/f54b40d2-9eee-4382-aba3-2ce715694a84?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/f54b40d2-9eee-4382-aba3-2ce715694a84?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/f54b40d2-9eee-4382-aba3-2ce715694a84?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/f54b40d2-9eee-4382-aba3-2ce715694a84?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/f54b40d2-9eee-4382-aba3-2ce715694a84?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/f54b40d2-9eee-4382-aba3-2ce715694a84?feedback_type=other)</sup>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] DuckDB error Invalid SSL Certificate Requirements Flag: CERT_NONE [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #33401:
URL: https://github.com/apache/superset/issues/33401#issuecomment-4035390085
Based on the comments, this may be a DuckDB configuration issue — the `s3_endpoint` should be a hostname without the protocol. If this is still a Superset-side bug after verifying your configuration, please provide more details. Closing due to inactivity — feel free to open a new issue if the problem persists with a correct configuration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] DuckDB error Invalid SSL Certificate Requirements Flag: CERT_NONE [superset]
Posted by "editicalu (via GitHub)" <gi...@apache.org>.
editicalu commented on issue #33401:
URL: https://github.com/apache/superset/issues/33401#issuecomment-3117819733
If I recall correctly from when I did the initial setup of our system using DuckDB with S3, the `s3_endpoint` should be a hostname and not include the protocol `http://`. I also noticed issues could arise in the SQL Lab interface if a user only has select privileges, but (as the duckdb syntax doesn't require) select or allows it after your `from`, that this can make it that superset doesn't allow your query.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] DuckDB error Invalid SSL Certificate Requirements Flag: CERT_NONE [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #33401: DuckDB error Invalid SSL Certificate Requirements Flag: CERT_NONE
URL: https://github.com/apache/superset/issues/33401
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org