Certificate verification issues when running ./nb-dt-import.py

[BartVdAvort]

The environment: Ubuntu 24.04 LTS, Netbox 4.1.5, Python 3.12
Root ca and Sub-ca certs are installed in /usr/share/ca-certificates
Certificate issued by the subca is attached to the website, it has the proper SANs and CN

Netbox is running properly

Still when I run ./nb-dt-import.py the following errors are received

(venv) ipamadmin@netbox:~/Device-Type-Library-Import$ ./nb-dt-import.py
Package devicetype-library is already installed, updating /home/ipamadmin/Device-Type-Library-Import/repo
Traceback (most recent call last):
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 466, in _make_request
self._validate_conn(conn)
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 1095, in _validate_conn
conn.connect()
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/urllib3/connection.py", line 730, in connect
sock_and_verified = _ssl_wrap_socket_and_match_hostname(
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/urllib3/connection.py", line 909, in ssl_wrap_socket_and_match_hostname
ssl_sock = ssl_wrap_socket(
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/urllib3/util/ssl.py", line 469, in ssl_wrap_socket
ssl_sock = ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/urllib3/util/ssl.py", line 513, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
File "/usr/lib/python3.10/ssl.py", line 513, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.10/ssl.py", line 1100, in _create
self.do_handshake()
File "/usr/lib/python3.10/ssl.py", line 1371, in do_handshake
self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 789, in urlopen
response = self._make_request(
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 490, in _make_request
raise new_e
urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/requests/adapters.py", line 667, in send
resp = conn.urlopen(
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/urllib3/connectionpool.py", line 843, in urlopen
retries = retries.increment(
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/urllib3/util/retry.py", line 519, in increment
raise MaxRetryError(_pool, url, reason) from reason # type: ignore[arg-type]
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='netbox.cartamundi.local', port=443): Max retries exceeded with url: /api/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/ipamadmin/Device-Type-Library-Import/./nb-dt-import.py", line 54, in
main()
File "/home/ipamadmin/Device-Type-Library-Import/./nb-dt-import.py", line 17, in main
netbox = NetBox(settings)
File "/home/ipamadmin/Device-Type-Library-Import/netbox_api.py", line 28, in init
self.verify_compatibility()
File "/home/ipamadmin/Device-Type-Library-Import/netbox_api.py", line 50, in verify_compatibility
version_split = [int(x) for x in self.netbox.version.split('.')]
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/pynetbox/core/api.py", line 109, in version
).get_version()
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/pynetbox/core/query.py", line 180, in get_version
req = self.http_session.get(
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/requests/sessions.py", line 602, in get
return self.request("GET", url, **kwargs)
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/requests/sessions.py", line 589, in request
resp = self.send(prep, **send_kwargs)
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/requests/sessions.py", line 703, in send
r = adapter.send(request, **kwargs)
File "/home/ipamadmin/Device-Type-Library-Import/venv/lib/python3.10/site-packages/requests/adapters.py", line 698, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='netbox.cartamundi.local', port=443): Max retries exceeded with url: /api/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)')))
(venv) ipamadmin@netbox:~/Device-Type-Library-Import$

Any ideas on how to solve this would be appreciated

[BartVdAvort]

SOLVED: I was able to solve this by appending the root-ca bundle of my CA to certifi's cacert.pem

That being said: Why python and other programs are not simply using the certificate store of the SO is beyond me. The OS has a certstore and ways to access that store. If you need something sandboxed, make a copy of the store and create a way to keep your copy up to date. Simple, elegant and the user/sysadmin only has to keep 1 store up to date instead of gonig on an hours/dayslong goosehunt... Do we ever learn?