SubjectAltNameWarning

[oliver-sanders]

We appear to be getting deprecation warnings for the common name field.

/usr/lib64/python2.6/site-packages/requests/packages/urllib3/util/ssl_.py:338:
SNIMissingWarning: An HTTPS request has been made, but the SNI
(Subject Name Indication) extension to TLS is not available on this
platform. This may cause the server to present an incorrect TLS
certificate, which can cause validation failures. You can upgrade to a
newer version of Python to solve this. For more information, see
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
SNIMissingWarning
/usr/lib64/python2.6/site-packages/requests/packages/urllib3/util/ssl_.py:132:
InsecurePlatformWarning: A true SSLContext object is not available.
This prevents urllib3 from configuring SSL appropriately and may cause
certain SSL connections to fail. You can upgrade to a newer version of
Python to solve this. For more information, see
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecurePlatformWarning
/usr/lib64/python2.6/site-packages/requests/packages/urllib3/connection.py:337:
SubjectAltNameWarning: Certificate for
<fqdn> has no `subjectAltName`, falling
back to check for a `commonName` for now. This feature is being
removed by major browsers and deprecated by RFC 2818. (See
https://github.com/shazow/urllib3/issues/497 for details.)
SubjectAltNameWarning

See also:

• Feature: Remove support for common names in certificates urllib3/urllib3#497
• https://stackoverflow.com/questions/28707134/why-request-with-ssl-certification-returns-html
• False SSL certificate subjectAltName warnings for older Python versions. urllib3/urllib3#523

[hjoliver]

specific to python2.6 and older?

[matthewrmshin]

Already filtering some warnings here:
https://github.com/cylc/cylc/blob/master/lib/cylc/network/httpclient.py#L389

I'll try adding some more filters.

[oliver-sanders]

The traceback shows two warnings, SNIMissingWarning and InsecurePlatformWarning.

Ignoring SNIMissingWarning sounds like it should be fail safe. Ignoring InsecurePlatformWarning sounds to me to be potentially fail deadly.

From https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings:

InsecurePlatformWarning

This happens on Python 2 platforms that have an outdated ssl module. These older ssl modules can cause some insecure requests to succeed where they should fail and secure requests to fail where they should succeed. Follow the pyOpenSSL guide to resolve this warning.

SNIMissingWarning

This happens on Python 2 versions older than 2.7.9. These older versions lack SNI support. This can cause servers to present a certificate that the client thinks is invalid. Follow the pyOpenSSL guide to resolve this warning.