Fail to connect to HTTPs server even with `AYON_CA_FILE` set

[MustafaJafar]

Is there an existing issue for this?

• I have searched the existing issues and added correct labels.

Description

Current Behavior

AYON Python API fails to connect to locally hosted server with https configured even after setting AYON_CA_FILE env file.

The log points out to _get_server_info function but it doesn't respect ssl arguments.

ayon-python-api/ayon_api/server_api.py

Lines 1489 to 1492 in 4d3c880

	response = self.raw_get(
	"info",
	handle_invalid_token=False,
	)

Expected Behavior

It should work

Steps To Reproduce:

1. host AYON server on https and get the root ca file
2. pip install ayon python api
3. Run

import os
os.environ["AYON_SERVER_URL"] = "https://localhost:5000"
os.environ["AYON_API_KEY"] = "veryinsecurapikey"
os.environ["AYON_CA_FILE"]= "E:/Ynput/extras/caddy-root.crt"

import ayon_api
con = ayon_api.get_server_api_connection()

ayon_api.close_connection

Additional context:

Version

Version of the server, ayon-core and the addon that's affected

What platform were you running when you found the bug?

Windows
Linux - Rocky9
Linux - Ubuntu
MacOS

You can also provide any additional information relevant to the issue.

Relevant log output:

AYON api error: Connection error happened.
Traceback (most recent call last):
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\urllib3\connectionpool.py", line 464, in _make_request
    self._validate_conn(conn)
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\urllib3\connectionpool.py", line 1106, in _validate_conn
    conn.connect()
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\urllib3\connection.py", line 796, in connect
    sock_and_verified = _ssl_wrap_socket_and_match_hostname(
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\urllib3\connection.py", line 975, in _ssl_wrap_socket_and_match_hostname
    ssl_sock = ssl_wrap_socket(
               ^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\urllib3\util\ssl_.py", line 433, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\urllib3\util\ssl_.py", line 477, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\ssl.py", line 517, in wrap_socket
    return self.sslsocket_class._create(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\ssl.py", line 1104, in _create
    self.do_handshake()
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\ssl.py", line 1382, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\urllib3\connectionpool.py", line 788, in urlopen
    response = self._make_request(
               ^^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\urllib3\connectionpool.py", line 488, in _make_request
    raise new_e
urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\requests\adapters.py", line 696, in send
    resp = conn.urlopen(
           ^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\urllib3\connectionpool.py", line 842, in urlopen
    retries = retries.increment(
              ^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\urllib3\util\retry.py", line 543, in increment
    raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='localhost', port=5000): Max retries exceeded with url: /api/info (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\ayon_api\server_api.py", line 1562, in _do_rest_request
    response = function(url, **kwargs)
               ^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\requests\api.py", line 87, in get
    return request("get", url, params=params, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\requests\api.py", line 71, in request
    return session.request(method=method, url=url, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\requests\sessions.py", line 651, in request
    resp = self.send(prep, **send_kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\requests\sessions.py", line 784, in send
    r = adapter.send(request, **kwargs)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\requests\adapters.py", line 727, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='localhost', port=5000): Max retries exceeded with url: /api/info (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)')))
---------------------------------------------------------------------------
ServerError                               Traceback (most recent call last)
Cell In[1], line 7
      3 os.environ["AYON_API_KEY"] = "veryinsecurapikey"
      4 os.environ["AYON_CA_FILE"]= "E:/Ynput/extras/caddy-root.crt"
      5 
      6 import ayon_api
----> 7 con = ayon_api.get_server_api_connection()
      8 
      9 ayon_api.close_connection

File C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\ayon_api\_api.py:401, in get_server_api_connection()
    391 def get_server_api_connection():
    392     """Access to global scope object of GlobalServerAPI.
    393 
    394     This access expect to have set environment variables 'AYON_SERVER_URL'
   (...)    399 
    400     """
--> 401     return GlobalContext.get_server_api_connection()

File C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\ayon_api\_api.py:202, in GlobalContext.get_server_api_connection(cls)
    199 @classmethod
    200 def get_server_api_connection(cls):
    201     if cls._connection is None:
--> 202         cls.create_connection()
    203     return cls._connection

File C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\ayon_api\_api.py:196, in GlobalContext.create_connection(cls, *args, **kwargs)
    194 if cls._connection is not None:
    195     cls.close_connection()
--> 196 cls._connection = GlobalServerAPI(*args, **kwargs)
    197 return cls._connection

File C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\ayon_api\_api.py:127, in GlobalServerAPI.__init__(self, site_id, client_version, default_settings_variant, ssl_verify, cert)
    114 super(GlobalServerAPI, self).__init__(
    115     url,
    116     token,
   (...)    124     create_session=False,
    125 )
    126 self.validate_server_availability()
--> 127 self.create_session()

File C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\ayon_api\server_api.py:843, in ServerAPI.create_session(self, ignore_existing, force)
    841 self._as_user_stack.clear()
    842 # Validate token before session creation
--> 843 self.validate_token()
    845 session = requests.Session()
    846 session.cert = self._cert

File C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\ayon_api\server_api.py:788, in ServerAPI.validate_token(self)
    781     return False
    783 # TODO add other possible validations
    784 # - existence of 'user' key in info
    785 # - validate that 'site_id' is in 'sites' in info
    786 
    787 # Check server url
--> 788 self._get_server_info()
    790 user_info = get_user_info_by_token(
    791     self.base_url,
    792     self._token_info.token,
   (...)    795     timeout=self.timeout,
    796 )
    797 self._token_info.is_valid = user_info.is_valid

File C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\ayon_api\server_api.py:1493, in ServerAPI._get_server_info(self)
   1488 """Get server info without a session."""
   1489 response = self.raw_get(
   1490     "info",
   1491     handle_invalid_token=False,
   1492 )
-> 1493 response.raise_for_status()
   1494 return response.data

File C:\.pyenv\pyenv-win\versions\3.11.9\Lib\site-packages\ayon_api\utils.py:212, in RestApiResponse.raise_for_status(self, message)
    210         if self.status_code == 401:
    211             raise UnauthorizedError(self._data["detail"])
--> 212         raise ServerError(self._data["detail"])
    213     raise ValueError("Response is not available.")
    215 try:

ServerError: AYON api error: Unable to connect the server. Connection error.