Missing GlobalSign Root R46 in bundled CA store causes SSL verification failure

Aperta Adatta ai principianti
  • Qualcosa non va?
#10,870 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
aws, python
Ambito
cli, security

Direzione di ricerca

L’issue indica che manca GlobalSign Root R46 nel bundle CA incluso in awscli/botocore/cacert.pem. Inizia verificando da dove proviene questo file e se il certificato è presente nel bundle CA upstream. Il lavoro sarà completato quando il bundle incluso conterrà la root CA attendibile e la catena di certificati dell’endpoint segnalato verrà convalidata senza un bundle CA personalizzato.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug needs-triage
Describe the bug

When connecting to S3-compatible endpoints (or custom AWS API endpoints) whose SSL/TLS certificates chain up to the GlobalSign Root R46 CA, AWS CLI v2 fails with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain.

Regression Issue
  • Select this option if this issue appears to be a regression.
Expected Behavior

AWS CLI should successfully validate the TLS certificate chain when connecting to endpoints using modern GlobalSign R46 root certificates without requiring manual injection of custom CA files via AWS_CA_BUNDLE or --ca-bundle.

Current Behavior

Because AWS CLI v2 uses an isolated Python runtime with its own bundled CA store (cacert.pem via botocore), it does not consult the OS trust stores (Windows CryptoAPI or Linux system certificates) unless explicitly overridden via AWS_CA_BUNDLE. Since GlobalSign Root R46 is missing from the bundled cacert.pem, any connection to endpoints using certificates issued under this root fails out of the box.

Reproduction Steps
Environment
  • AWS CLI Version: aws-cli/2.37.x – aws-cli/2.39.x
  • OS: Linux (Ubuntu 24.04 / Debian 12) & Windows Server
  • Bundled CA Paths affected:
    • Linux: /opt/aws/dist/awscli/botocore/cacert.pem
    • Windows: C:\Program Files\Amazon\AWSCLIV2\awscli\botocore\cacert.pem
Steps to Reproduce

Run any command against an endpoint utilizing a GlobalSign Root R46 certificate chain:
Bash

aws s3 --endpoint-url https://<custom-s3-endpoint> ls s3://<bucket-name> --debug
Debug Log Output
DEBUG - Certificate path: /opt/aws/dist/awscli/botocore/cacert.pem
DEBUG - Starting new HTTPS connection (1): <endpoint>:443
DEBUG - Exception received when sending HTTP request.
...
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1082)
urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1082)
botocore.exceptions.SSLError: SSL validation failed for https://<endpoint>/... [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1082)
Possible Solution

Please consider updating the bundled cacert.pem in botocore / AWS CLI distributions to include GlobalSign Root R46 (or synchronizing with the upstream CA store that includes this root).

Additional Information/Context
Root Cause & Certificate Details

The server presents a valid certificate chain:

  1. Server Cert: CN = *.domain.com
  2. Intermediate CA: CN = GlobalSign GCC R46 DV TLS CA 2025, O = GlobalSign nv-sa, C = BE
  3. Root CA: CN = GlobalSign Root R46, O = GlobalSign nv-sa, C = BE

While older GlobalSign roots (R1, R3) are present in the bundled cacert.pem, GlobalSign Root R46 is absent.

Root Certificate Details:
  • Subject / Issuer: C = BE, O = GlobalSign nv-sa, CN = GlobalSign Root R46
  • Validity: Mar 20 00:00:00 2019 GMT – Mar 20 00:00:00 2046 GMT
  • Key: RSA 4096 bit, SHA-384
-----BEGIN CERTIFICATE-----
MIIFWjCCA0KgAwIBAgISEdK7udcjGJ5AXwqdLdDfJWfRMA0GCSqGSIb3DQEBDAUA
MEYxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRwwGgYD
VQQDExNHbG9iYWxTaWduIFJvb3QgUjQ2MB4XDTE5MDMyMDAwMDAwMFoXDTQ2MDMy
MDAwMDAwMFowRjELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYt
c2ExHDAaBgNVBAMTE0dsb2JhbFNpZ24gUm9vdCBSNDYwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCsrHQy6LNl5brtQyYdpokNRbopiLKkHWPd08EsCVeJ
OaFV6Wc0dwxu5FUdUiXSE2te4R2pt32JMl8Nnp8semNgQB+msLZ4j5lUlghYruQG
vGIFAha/r6gjA7aUD7xubMLL1aa7DOn2wQL7Id5m3RerdELv8HQvJfTqa1VbkNud
316HCkD7rRlr+/fKYIje2sGP1q7Vf9Q8g+7XFkyDRTNrJ9CG0Bwta/OrffGFqfUo
0q3v84RLHIf8E6M6cqJaESvWJ3En7YEtbWaBkoe0G1h6zD8K+kZPTXhc+CtI4wSE
y132tGqzZfxCnlEmIyDLPRT5ge1lFgBPGmSXZgjPjHvjK8Cd+RTyG/FWaha/LIWF
zXg4mutCagI0GIMXTpRW+LaCtfOW3T3zvn8gdz57GSNrLNRyc0NXfeD412lPFzYE
+cCQYDdF3uYM2HSNrpyibXRdQr4G9dlkbgIQrImwTDsHTUB+JMWKmIJ5jqSngiCN
I/onccnfxkF0oE32kRbcRoxfKWMxWXEM2G/CtjJ9++ZdU6Z+Ffy7dXxd7Pj2Fxzs
x2sZy/N78CsHpdlseVR2bJ0cpm4O6XkMqCNqo98bMDGfsVR7/mrLZqrcZdCinkqa
ByFrgY/bxFn63iLABJzjqls2k+g9vXqhnQt2sQvHnf3PmKgGwvgqo6GDoLclcqUC
4wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV
HQ4EFgQUA1yrc4GHqMywptWU4jaWSf8FmSwwDQYJKoZIhvcNAQEMBQADggIBAHx4
7PYCLLtbfpIrXTncvtgdokIzTfnvpCo7RGkerNlFo048p9gkUbJUHJNOxO97k4Vg
JuoJSOD1u8fpaNK7ajFxzHmuEajwmf3lH7wvqMxX63bEIaZHU1VNaL8FpO7XJqti
2kM3S+LGteWygxk6x9PbTZ4IevPuzz5i+6zoYMzRx6Fcg0XERczzF2sUyQQCPtIk
pnnpHs6i58FZFZ8d4kuaPp92CC1r2LpXFNqD6v6MVenQTqnMdzGxRBF6XLE+0xRF
FRhiJBPSy03OXIPBNvIQtQ6IbbjhVp+J3pZmOUdkLG5NrmJ7v2B0GbhWrJKsFjLt
rWhV/pi60zTe9Mlhww6G9kuEYO4Ne7UyWHmRVSyBQ7N0H3qqJZ4d16GLuc1CLgSk
ZoNNiTW2bKg2SnkheCLQQrzRQDGQob4Ez8pn7fXwgNNgyYMqIgXQBztSvwyeqiv5
u+YfjyW6hY0XHgL+XVAEV8/+LbzvXMAaq7afJMbfc2hIkCwU9D9SGuTSyxTDYWnP
4vkYxboznxSjBF25cfe1lNj2M8FawTSLfJvdkzrnE6JwYZ+vj+vYxXX4M2bUdGc6
N3ec592kD3ZDZopD8p/7DEJ4Y9HiD2971KE9dJeFt0g5QdYg/NA6s/rob8SKunE3
vouXsXgxT7PntgMTzlSdriVZzH81Xwj3QEUxeCp6
-----END CERTIFICATE-----
CLI version used

aws-cli/2.37.x – aws-cli/2.39.x

Environment details (OS name and version, etc.)

Linux (Ubuntu 24.04 / Debian 12) & Windows Server

Lingua principale
Python
Stelle
17.4k
Fork
4.8k
Merge medio
4g 3h
PR unite (30g)
64

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aws/aws-cli

Tutte le issue di aws/aws-cli

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.