SSL/TLS Inspection breaks python pip

Hi,

I can not say if it is similar to the issue I had with certificates.

Added the domains in the exclusion list at WEB and it did not have any effect at first. Only after I shutdown the appliance for 5min and back on all worked as intended.

Best regards

Eli.

The issue with python pip is that python does not use the operating system's store of trusted CAs but has its own set.

For pip, there is a command-line option --cert <CA file> that allows you to specify a different CA. You should be able to use this option to point pip to the CA file for the appliance.

Of course, the other option is to exclude the pip servers (domain pypi.org) from decryption by adding the domain to the Local Exclusions URL group.

As mentioned in my original post, adding pypi.org to the local exclusion URL group does not work. It results in the same certificate errors.

I suppose I can try the first option you mentioned of manually adding a certificate to pip, but I’m more curious as to why pypi.org doesn’t seem to work with the local exclusion URL group.

That would imply the URL is wrong.

Ian

I found that if I wanted to exclude pip traffic, instead of providing the CA at the command line, there are more URLs/domains that need to be excluded. It looks like pypi.org is just the initial database queries, but actual file downloads are hosted on other domains.

files.pythonhosted.org is one. I don't know if this is the same for all packages, or whether it varies from one package to another.

I found this out by looking in the SSL/TLS log for other connections from the same client IP immediately following the initial connection to pypi.org.

I found that if I wanted to exclude pip traffic, instead of providing the CA at the command line, there are more URLs/domains that need to be excluded. It looks like pypi.org is just the initial database queries, but actual file downloads are hosted on other domains.

files.pythonhosted.org is one. I don't know if this is the same for all packages, or whether it varies from one package to another.

I found this out by looking in the SSL/TLS log for other connections from the same client IP immediately following the initial connection to pypi.org.