[AMBARI-23151] Ambari agent should trust Ambari server's SSL certificate

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Done
• Affects Version/s: 2.0.0
• Fix Version/s: 3.0.0
• Component/s: ambari-agent, ambari-server
• Labels: security ssl
• Assignee: Sandor Molnar
• Reporter: Robert Levas
• Created: 06/Mar/18 14:22
• Updated: 03/Oct/18 14:00
• Resolved: 03/Oct/18 14:00

Description

Ambari agent should trust Ambari server's SSL certificate.

When using Python 2.7 and above, the agent tends to fail connecting with the Ambari server with a CERTIFICATE_VERIFY_FAILED error.

To solve this, else tell Python to no verify certificates (which is insecure):

/etc/python/cert-verification.cfg

[https]
verify=disable

See https://access.redhat.com/articles/2039753

Or import the Ambari server's SSL cert into the truststore used by Python, which is more secure.