Add option to allow insecure SSL certificate during 'update_vendors()'

[mpenning]

If you're behind a corporate proxy or other internet security device, downloading the latest client mac vendor DB may find unknown certificates in the lookup path...

from mac_vendor_lookup import MacLookup

obj = MacLookup()
obj.update_vendors()
oui_vendor = obj.lookup("aa:bb:cc:dd:ee:ff")

Running this yields...

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1007)

Please add an option to bypass ssl certificate checks during update_vendors()

[BUZZARDGTA]

UP @bauerj

[BUZZARDGTA]

Using the code example above, it works on my main PC but not on a fresh new Windows 10 VM.

[Webster83]

@BUZZARDGTA , @bauerj
The issue in corporate environments is often with things like Netskope, where your org may not return the a CA signed cert to netskope that they're using (i.e infosec don't want to turn it over). Further complicating efforts is that the pem/cer/crt configs can be encrypted such that even if you do have access to example: C:\ProgramData\NetSkope\STagent..... then files therein are all encrypted, so you can't even pull the local cert and create a try/except to use a locally-sourced cert file or chain. Back to the drawing board says I.

What I've found, and I'm hoping to do a PR on this shortly, is to add the truststore module as a dependency (I've tested this in a wrapper script used in my Terminal client for doing vendor lookups based on the clipboard data). If we create a truststore context akin to the following:

import ssl
import aiohttp
import truststore

ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)

async with aiohttp.ClientSession(ssl=ctx) as http_client:
    async with http_client.get("https://example.com") as http_response:

We should be able to ingest the user's OS native key stores, where that chain, even with self-signed certs, are going to sit. This is friendly to an end-user who would not feel comfortable building their own chain and pulling it into a local cert file, and modifying the underlying code to point to the custom cert path. This also avoids breaking code in the future when a user may pip update and reintroduce the issue, forgetting what they did and code not working again