topic Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway) in Network Platform API

Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

CiscoDave — Mon, 13 Jan 2020 15:08:15 GMT

Hello,

I am using the Meraki Python module and having issues getting through our web gateway.

My old scripts use a request.get where I can pass the certificate location in, but I am unable to see how to do this within the meraki python module

Code / Error:

import meraki

x_cisco_meraki_api_key = 'MyKey'

m = meraki.DashboardAPI(x_cisco_meraki_api_key)
orgs = m.organizations.getOrganizations()

print(orgs)

Organizations, getOrganizations - HTTPSConnectionPool(host='api.meraki.com', port=443): Max retries exceeded with url: /api/v0/organizations (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1045)'))),

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

Shiyue Cheng — Mon, 13 Jan 2020 18:40:19 GMT

Can you provide an example of what you did previously with requests.get to pass in the certificate information to make calls correctly with your corporate proxy please?

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

CiscoDave — Mon, 13 Jan 2020 18:57:26 GMT

I am able to pass " verify='C:\location\of\my\cert.cer' to the requests.get, and it uses the certificate as expected, see below:

def list_networks(api_key, org_id):
    url = 'https://dashboard.meraki.com/api/v0/organizations/{}/networks'.format(org_id)
    try:
        response = requests.get(url=url, headers={'X-Cisco-Meraki-API-Key': api_key, 'Content-Type': 'application/json'}, verify='C:\\certfolder\\certfile.cer')
        return json.loads(response.text)
    except requests.exceptions.RequestException as e:
        print('Error calling list_networks: {}'.format(e))

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

Philip D'Ath — Mon, 13 Jan 2020 21:21:14 GMT

Is this a transparent proxy? Can you manually use whatever it is as a "normal" proxy?

Can you add *.meraki.com to a whitelist to bypass SSL inspection?

Some other thoughts; Python should trust what the underlying operating systems considers is trusted. Can you web browse (from this machine running the script) to the below location and get no browser errors?

https://api.meraki.com/

If you do get a browser error, you will need to add the root certificate of your proxy server into the trusted root certificate store on the machine making the request. I guess it is also possible the the root certicate of the device doing the SSL inspection has expired. Need to see what that browser test says.

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

Philip D'Ath — Mon, 13 Jan 2020 21:22:47 GMT

What OS are you using this on?

Also, are you using a "recent" requests module? Try something like:

pip install -U requests

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

Shiyue Cheng — Mon, 13 Jan 2020 21:46:49 GMT

Thanks @CiscoDave, this functionality has been pushed to a new 0.70.5 version so that you can specify the certificate path in the class instantiation, like this:

m = meraki.DashboardAPI(x_cisco_meraki_api_key, certificate_path='C:\\certfolder\\certfile.cer')

Also, this update contains newly-published endpoints for MV camera quality & retention settings, MX inbound firewall, and MS link aggregations.

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

CiscoDave — Tue, 14 Jan 2020 13:39:48 GMT

Thank you for that fast turnaround - everything is now working as expected.

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

westie1981 — Thu, 06 Aug 2020 13:42:52 GMT

Hi,

I'm getting a syntax error when trying to define certificate_path as below. Any ideas on how to work around this?

def main():

# Instantiate a Meraki dashboard API session

dashboard = meraki.DashboardAPI(

api_key='xxxx',

base_url='https://api-mp.meraki.com/api/v0/',

output_log=True,

log_file_prefix=os.path.basename(__file__)[:-3],

log_path='',

print_console=True

certificate_path='C:\\certfolder\\certfile.cer'

)

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

Shiyue Cheng — Thu, 06 Aug 2020 15:43:33 GMT

looks like you're missing a comma there following the penultimate parameter

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

westie1981 — Thu, 06 Aug 2020 19:19:08 GMT

Thanks for that, I knew it would have been something daft. Do you know if the full key chain is required? I'm still having problems, but it is a different challenge this time.

meraki: INFO > Meraki dashboard API session initialized with these parameters: {'version': '0.110.5', 'api_key': '************************************', 'base_url': 'https://api-mp.meraki.com/api/v0/', 'single_request_timeout': 60, 'certificate_path': 'C:\\certfolder\\certfile.cer', 'requests_proxy': '', 'wait_on_rate_limit': True, 'nginx_429_retry_wait_time': 60, 'action_batch_retry_wait_time': 60, 'retry_4xx_error': False, 'retry_4xx_error_wait_time': 60, 'maximum_retries': 2, 'simulate': False, 'be_geo_id': None, 'caller': None}

meraki: WARNING > Organizations, getOrganizations - HTTPSConnectionPool(host='api-mp.meraki.com', port=443): Max retries exceeded with url: /api/v0/organizations (Caused by SSLError(SSLError(136, '[X509: NO_CERTIFICATE_OR_CRL_FOUND] no certificate or crl found (_ssl.c:4263)'))), retrying in 1 second

I have checked the basics like is the certificate valid etc and ensured the path is correct and the case is correct.

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

abc28 — Tue, 17 Nov 2020 10:45:18 GMT

Hi, I am new to meraki module.

I developed the script using meraki module but i always get the below error

(Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)')))

Even after using certificate_path="C:\certfolder\certificate.cer" am getting the same error.

Is there any solution for this ?

Thanks in advance

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

Greenberet — Tue, 17 Nov 2020 13:10:22 GMT

try double slashes in the path -> "C:\\certfolder\\certificate.cer"

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

abc28 — Tue, 17 Nov 2020 14:07:09 GMT

Thanks for the reply.

Yea i tried that too. Still getting the same error.

Is there any other way to download the certificate.cer and load them into "certificate_path"

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

Adrian41 — Tue, 31 Jan 2023 10:51:10 GMT

I am sending the API calls via python script in pycharm ide on Windows 11.

I can reach the site with no errors but when I run the scripts I get

send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='api.meraki.com', port=443): Max retries exceeded with url: /api/v1/organizations (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)')))

I am setting verify to false to get around it but Id like to fix it properly.

I have tried downloading the cisco umbrella root CA from the dashboard site and import it into my trusted root cert authorities but it hasn't worked.

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

Philip D'Ath — Tue, 31 Jan 2023 19:38:15 GMT

It sounds like pycharm in your environment doesn't have the typical set of trusted root certificates loaded. I would Google in that area.

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

CiscoDave — Tue, 31 Jan 2023 19:48:31 GMT

in my specific situation it was that I had to trust our corporate web gateway root certificate. if you have a similar situation, you can store the cert locally, and use the following line in your python code to reference it:

dashboard = meraki.DashboardAPI(MERAKI_DASHBOARD_API_KEY, suppress_logging=True, certificate_path="C:\\certs\\your_cert.cer")

Re: Dashboard API via Python - unable to get local issuer certificate (passing through web gateway)

Adrian41 — Wed, 01 Feb 2023 10:13:52 GMT

cheers