SSL certificate verification failed..

[klroesner]

Hi folks, we would like to use SASpy but when we try to connect the compute server on SAS Viya via https we get this error message: "SSL certificate verification failed...". Where can we specify where the certificate is stored? Unfortunately I find nothing about this in the documentation.

Thanks,
Klaus

[tomweber-sas]

Hey, sorry I hadn't responded earlier, I was on vacation all last week. So, I can't find any doc on this in the Viya 4 doc either. But I dug up the following from an email thread I had some time ago. It's has doc from viya 3, but I expect it's the same for viya 4, as this is really just about HTTP and TLS and certificates; that's all common infrastructure, not anything specific to saspy or any client; just how http is configured and where it looks for things like certificates. Here's what I had in this email:

So, we tried this with a client that was getting the message about not being able to verify the certificate (default case).
We used the instructions from the doc about copying the trustedcerts.pem file from the viya deployment to the client,
and set the environment variable so it would be found and that worked as expected. It?s possible that if you put the .pem
file in the path where it's already being looked for by the http client on that machine, you don't even have to set the
SSL_CERT_FILE variable, but it you just put it some random place, then that gets it found even from there.

Yes. The approach above is a supported approach. It's documented in the PDF file that we included in our answer yesterday. 
https://go.documentation.sas.com/api/docsets/calencryptmotion/3.5/content/calencryptmotion.pdf
See the Configure SAS 9.4 Clients to Work with SAS Viya section.
1.	Get the from the Viya system. 
2.	Put that trustedcerts.pem file on your client. 
3.	export SSL_CERT_FILE to point to it # if you need to (sometimes it just works without doing this step) 
4.	Run/use/program-against saspy


scp viyahost:/opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts/trustedcerts.pem /tmp/trustedcerts-from-viya-deployment.pem
export SSL_CERT_FILE=/tmp/trustedcerts-from-viya-deployment.pem

Here's the only other email I found on this, where (on my linux client) I put the certificate in the expected location on the system and it worked without needing to set an environment variables; the system found it in the expected location.

So, I connected saspy to that system and downloaded the certificates you mentioned in the other email:

>>> sas.download('.', '/opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts/vault-ca.crt')
>>> sas.download('.', '/opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts/trustedcerts.pem')

Then I tried swapping each of those out with the existing file on my system. The .pem file worked but the .crt one didn’t.

copy them to my certs dir and point at either

[root@tom64-5 ~]# cd /etc/pki/tls/certs 
[root@tom64-5 tls]# ll
total 24
lrwxrwxrwx  1 root root    22 May  8 12:09 cert.pem -> certs/trustedcerts.pem
[…]

And, reading up on this a little more over the past day or so, this is making more sense now. It is an
install config thing and nothing my actual code has anything to do with. Now I can connect in each of
3 ways and can validate my code each way: no ssl (port 80), ssl unverified (port 443 existing .pem), and ssl verified (port 443 viya .pem)

Thanks for the help! I think I’ve got it now.

Thanks!
Tom

I hope this helps. I don't deploy Viya and in my R&D environment, I don't have any issues with this (could be I copied this there many years ago and it's been working ever since). I'll keep looking to see if I can find any useful doc for Viya4, but I haven't seen the equivalent for Viya 4 as there is in the linked pdf above from viya 3.5.

Tom

[tomweber-sas]

Well, I finally found something like this in the viya 4 doc: https://go.documentation.sas.com/doc/en/pgmsascdc/v_028/calencryptmotion/n1xdqv1sezyrahn17erzcunxwix9.htm#p0yg7jd9m8d50pn1sdtkv64q6wxw
Which was linked to from https://go.documentation.sas.com/doc/en/itopscdc/v_029/itopssr/n18dxcft030ccfn1ws2mujww1fav.htm#p0bskqphz9np1ln14ejql9ush824

This doesn't seem to be as straight forward as the 3.5 doc, but I do seem some similar bits in there. Just a ton more stuff in that doc with less than straight forward instructions for what you are asking. I think you still get the .pem file from viya and put it where the system expects it and everything works.

[klroesner]

Hi Tom,
I hope you had a great vacation and thanks for your answer! I have solved the problem with a colleague from tech support. To my shame, the problem was with me. I specified the compute server and not the SAS Viya platform server. After I have used the correct server it also works with the certificates. Sometimes the solution is so close! ;-)

Thanks, Klaus

[tomweber-sas]

Hey, well that's great! I like the ones that fix themselves :)