From 7b0e012f6220fd007069f7648d70e2aa35a3aaae Mon Sep 17 00:00:00 2001
From: Julien Riou <julien@riou.xyz>
Date: Thu, 20 Feb 2020 10:13:41 +0100
Subject: [PATCH] Disable SSL verification for Consul when it is required
 (#1399)

Consul client uses urllib3 with a verify=True by default. When
SSL verification is disabled with verify=False, we can see
CERTIFICATE_VERIFY_FAILED exceptions. With urllib3 1.19.1-1 on
Debian Stretch, the "cert_reqs" argument  must be explicitaly set
to ssl.CERT_NONE to effectively disable SSL verification.
---
 patroni/dcs/consul.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/patroni/dcs/consul.py b/patroni/dcs/consul.py
index cea7bb88..26f7b656 100644
--- a/patroni/dcs/consul.py
+++ b/patroni/dcs/consul.py
@@ -55,6 +55,8 @@ class HTTPClient(object):
             kwargs['ca_certs'] = ca_cert
         if verify or ca_cert:
             kwargs['cert_reqs'] = ssl.CERT_REQUIRED
+        else:
+            kwargs['cert_reqs'] = ssl.CERT_NONE
         self.http = urllib3.PoolManager(num_pools=10, **kwargs)
         self._ttl = None