You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@superset.apache.org by "devikaaaa33 (via GitHub)" <gi...@apache.org> on 2025/08/14 17:04:38 UTC

[D] Unable to read custom certificate [superset]

GitHub user devikaaaa33 created a discussion: Unable to read custom certificate

### Bug description

I am using Helm chart version 0.15.0 to deploy Superset version 5.0.0 and am encountering the following error:

2025-08-11 08:42:56,797:ERROR:flask_appbuilder.security.views:Error authorizing OAuth access token: HTTPSConnectionPool(host='zitadel.******.devops.*******.com', port=443): Max retries exceeded with url: /oauth/v2/token (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1016)')))

I have placed my certificate in **/usr/local/lib/python3.11/site-packages/certifi**. Please let me know if there are any changes required in the certificate path for the OIDC setup.

 

### Screenshots/recordings

_No response_

### Superset version

5.0.0

### Python version

3.11

### Node version

18 or greater

### Browser

Chrome

### Additional context

_No response_

### Checklist

- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

GitHub link: https://github.com/apache/superset/discussions/34704

----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [D] Unable to read custom certificate [superset]

Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.

GitHub user dosubot[bot] added a comment to the discussion: Unable to read custom certificate

<!-- Answer -->
Placing your certificate in `/usr/local/lib/python3.11/site-packages/certifi` does not make it trusted by Python’s requests library unless you rebuild the certifi bundle, which is not recommended or reliable in containerized deployments. The supported way to add a custom CA for outbound HTTPS (including OIDC/OAuth) in Superset is to mount your CA bundle into the container and set the `REQUESTS_CA_BUNDLE` environment variable to its path. This tells Python requests to use your CA for SSL verification.

In a Helm/Kubernetes deployment, you should:
1. Mount your custom CA bundle (e.g., as a Kubernetes Secret or ConfigMap) into the Superset container, for example at `/etc/ssl/certs/my-ca-bundle.crt`.
2. Set the `REQUESTS_CA_BUNDLE` environment variable in your Helm values to point to that file.

Example Helm values override:
```yaml
extraEnv:
  - name: REQUESTS_CA_BUNDLE
    value: /etc/ssl/certs/my-ca-bundle.crt

extraVolumes:
  - name: custom-ca
    secret:
      secretName: my-custom-ca-secret

extraVolumeMounts:
  - name: custom-ca
    mountPath: /etc/ssl/certs/my-ca-bundle.crt
    subPath: my-ca-bundle.crt
    readOnly: true
```
This approach is necessary because Superset delegates SSL verification to Python requests, which only honors the `REQUESTS_CA_BUNDLE` variable for custom trust stores—there is no Superset-specific config for this use case.

If you still see SSL errors after this, check for DNS issues inside the pod (sometimes `/etc/resolv.conf` is misconfigured in Kubernetes and can cause misleading SSL errors) [source](https://github.com/apache/superset/issues/25004#issuecomment-2761120257).

Let me know if you need a more detailed example for your Helm chart or have questions about mounting the CA bundle.


<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*

---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/fa76bcb0-0972-48bf-9f9a-e6722667c787?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/fa76bcb0-0972-48bf-9f9a-e6722667c787?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/fa76bcb0-0972-48bf-9f9a-e6722667c787?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/fa76bcb0-0972-48bf-9f9a-e6722667c787?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/fa76bcb0-0972-48bf-9f9a-e6722667c787?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/fa76bcb0-0972-48bf-9f9a-e6722667c787?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/fa76bcb0-0972-48bf-9f9a-e6722667c787?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&
 nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/34666)

GitHub link: https://github.com/apache/superset/discussions/34704#discussioncomment-14106991

----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org