mirror of
https://github.com/healthchecks/healthchecks.git
synced 2026-04-25 15:05:49 +03:00
[GH-ISSUE #1033] SMTP with custom CA certificate #717
Labels
No labels
bug
bug
bug
feature
good-first-issue
new integration
pull-request
question
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/healthchecks#717
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jlssmt on GitHub (Jul 25, 2024).
Original GitHub issue: https://github.com/healthchecks/healthchecks/issues/1033
Hello,
I want to self-host healthchecks.
I get the
error.
Can anyone please help me to set up healthchecks with a custom CA?
Is it possible or do I need django-ca?
My docker-compose looks like this:
Thanks in advance
@cuu508 commented on GitHub (Jul 26, 2024):
Hello @jlssmt, what are you doing when you get this error?
Where does this error appear?
Is there additional context around it (a traceback perhaps?)?
@jlssmt commented on GitHub (Jul 26, 2024):
I'm trying to sign up via mail.
Error happens when my instance is trying to send a mail.
stacktrace:
@cuu508 commented on GitHub (Jul 26, 2024):
Your docker-compose file sets
EMAIL_SSL_CERTFILEenv var, but I don't think it gets passed through to Django.The env vars are loaded into Django settings in the settings.py file here, it goes through a fixed set of env vars and
EMAIL_SSL_CERTFILEis not one of them.I can add
EMAIL_SSL_CERTFILEin settings.py if we know it does fix the issue. As an experiment, could you try the following:local_settings.pywith contents:@jlssmt commented on GitHub (Jul 26, 2024):
i tried
EMAIL_SSL_CERTFILE = "/certificates/test.pem"i think it's working. but i get a different error now. but i don't know if this is related to the healthchecks app...
@jlssmt commented on GitHub (Jul 26, 2024):
I don't understand it 😆 😢
It seems for me that Django cannot verify my passed public cert and I don't know why...
I'm passing a public cert in pem format.
I do not have a private cert because the public cert is signed from our company CA and not self signed.
So I cannot pass EMAIL_SSL_KEYFILE.
But Django seems to accept also certfile without keyfile:
github.com/django/django@1b277b45cc/django/core/mail/backends/smtp.py (L61)maybe django-ca is needed for my setup?
@cuu508 commented on GitHub (Jul 26, 2024):
I'm not sure, but I think
EMAIL_SSL_KEYFILEis for specifying client certificate, and so requires keyfile.Django accepts certfile because the certificate and the key can be combined in one file:
https://docs.python.org/3/library/ssl.html#combined-key-and-certificate
What you need to do instead is to specify certificates that the client is willing to trust and the ssl module has
load_verify_locationsmethod for that:https://docs.python.org/3/library/ssl.html#ssl.SSLContext.load_verify_locations
But it doesn't look like Django's EmailBackend has a way to use that.
@cuu508 commented on GitHub (Jul 26, 2024):
Not sure if it would work but perhaps you could prepare a custom
ca-certificates.crtfile which includes your company CA cert, and then tell docker-compose to mount it in/etc/ssl/certs/ca-certificates.crt. Django will then use system's default CA certificates, but they will include your certificate too.@jlssmt commented on GitHub (Jul 29, 2024):
Nailed it
Mount:
- ./certificates/custom-CA.pem:/usr/local/share/ca-certificates/custom-CA.pem.crt:roRun:
update-ca-certificates@cuu508 commented on GitHub (Aug 2, 2024):
Good stuff! Marking this as resolved.