Celery - [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

user_13794315 0
Viewed 490

I have the following celery configuration for my Django project hosted on heroku/git -

os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'App.settings')


app = Celery('App')

app.conf.timezone = 'Europe/London'

app.config_from_object('django.conf:settings')
app.conf.update(BROKER_URL=str(os.getenv('REDIS_URL')),
                CELERY_RESULT_BACKEND=str(os.getenv('REDIS_URL')),
                broker_use_ssl = {
                        'ssl_cert_reqs': ssl.CERT_REQUIRED
                    },
                    redis_backend_use_ssl = {
                        'ssl_cert_reqs': ssl.CERT_REQUIRED
                    }
                    )

However when I run celery I get the following log error message.

ERROR/MainProcess] consumer: Cannot connect to rediss://****************//: Error 1 connecting to *************. [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

I can fix this by setting ssl_cert_reqs': ssl.CERT_NONE however then I receive the following warning -

Setting ssl_cert_reqs=CERT_NONE when connecting to redis means that celery will not valdate the identity of the redis broker when connecting. This leaves you vulnerable to man in the middle attacks.

Does anyone know how I can solve this to use SSL with Celery to protect my project going forward?

django-celery celery heroku ssl-certificate ssl
1 Answers

Have you tried updating your SSL certificate? For Unix, running something like this code in your IDE should do it (found on GitHub).

import os
import os.path
import ssl
import stat
import subprocess
import sys

STAT_0o775 = ( stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR
             | stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
             | stat.S_IROTH |                stat.S_IXOTH )


def main():
    openssl_dir, openssl_cafile = os.path.split(
        ssl.get_default_verify_paths().openssl_cafile)

    print(" -- pip install --upgrade certifi")
    subprocess.check_call([sys.executable,
        "-E", "-s", "-m", "pip", "install", "--upgrade", "certifi"])

    import certifi

    # change working directory to the default SSL directory
    os.chdir(openssl_dir)
    relpath_to_certifi_cafile = os.path.relpath(certifi.where())
    print(" -- removing any existing file or link")
    try:
        os.remove(openssl_cafile)
    except FileNotFoundError:
        pass
    print(" -- creating symlink to certifi certificate bundle")
    os.symlink(relpath_to_certifi_cafile, openssl_cafile)
    print(" -- setting permissions")
    os.chmod(openssl_cafile, STAT_0o775)
    print(" -- update complete")

if __name__ == '__main__':
    main()
user_137168580
Related