mirror of
https://github.com/outbackdingo/patroni.git
synced 2026-08-25 14:53:37 +00:00
IsraelandGitHub
ed02826103
Revert to using `ssl._ssl._test_decode_cert` A change has been included as part of Patroni 3.0.3 release: use public functions instead of `ssl._ssl._test_decode_cert` to get serial number of certificates. There was a slight bug in that implementation: it was only loading the certificates through `load_verify_locations`, but was missing to get the certificates through `get_ca_certs`. As a consequence Patroni was not able anymore to reload REST API cert on SIGHUP. An attempt to fix that issue was made through commit `20f578f09f3aa604e5288710d4fd4e611152ed5f`. However, even with the correct call of `get_ca_certs`, it was detected a corner case where `load_verify_locations` would skip loading a certificate: if it was issued with `CA:FALSE`. That essentially means the implementation is still buggy in that situation. See [CPython](https://github.com/python/cpython/blob/c283a0cff5603540f06d9017e484b3602cc62e7c/Modules/_ssl.c#L4618C14-L4619) for the underlying problem. In order to get back a functional implementation again we are reverting the code to use the private function `ssl._ssl._test_decode_cert`. We can later study a possible more elegant alternative for solving this, if any. --------- Signed-off-by: Israel Barth Rubio <[email protected]>