{"action":"created","issue":{"url":"https://api.github.com/repos/cuckoobox/cuckoo/issues/656","labels_url":"https://api.github.com/repos/cuckoobox/cuckoo/issues/656/labels{/name}","comments_url":"https://api.github.com/repos/cuckoobox/cuckoo/issues/656/comments","events_url":"https://api.github.com/repos/cuckoobox/cuckoo/issues/656/events","html_url":"https://github.com/cuckoobox/cuckoo/pull/656","id":111911647,"number":656,"title":"Add workaround for PEP-0476 SSL certificate verification issues","user":{"login":"jgajek","id":7495374,"avatar_url":"https://avatars.githubusercontent.com/u/7495374?v=3","gravatar_id":"","url":"https://api.github.com/users/jgajek","html_url":"https://github.com/jgajek","followers_url":"https://api.github.com/users/jgajek/followers","following_url":"https://api.github.com/users/jgajek/following{/other_user}","gists_url":"https://api.github.com/users/jgajek/gists{/gist_id}","starred_url":"https://api.github.com/users/jgajek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgajek/subscriptions","organizations_url":"https://api.github.com/users/jgajek/orgs","repos_url":"https://api.github.com/users/jgajek/repos","events_url":"https://api.github.com/users/jgajek/events{/privacy}","received_events_url":"https://api.github.com/users/jgajek/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-10-16T21:08:33Z","updated_at":"2015-10-17T16:39:33Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/cuckoobox/cuckoo/pulls/656","html_url":"https://github.com/cuckoobox/cuckoo/pull/656","diff_url":"https://github.com/cuckoobox/cuckoo/pull/656.diff","patch_url":"https://github.com/cuckoobox/cuckoo/pull/656.patch"},"body":"Recent Python versions (2.7.9+) implement PEP-0476, which enables strict SSL certificate verification by default in the standard ssl module. The ssl module is being used internally by the VMware Python SDK, which has not yet been updated to allow unverified SSL connections via it's Connect() and SmartConnect() interfaces. There is no easy way to avoid the resulting connection failures in environments that use a self-signed certificate on the ESXi host.\r\n\r\nThis pull request adds a 'unverified_ssl' parameter to the vsphere.conf file which globally turns off SSL verification in the ssl module as a workaround."},"comment":{"url":"https://api.github.com/repos/cuckoobox/cuckoo/issues/comments/148932181","html_url":"https://github.com/cuckoobox/cuckoo/pull/656#issuecomment-148932181","issue_url":"https://api.github.com/repos/cuckoobox/cuckoo/issues/656","id":148932181,"user":{"login":"jgajek","id":7495374,"avatar_url":"https://avatars.githubusercontent.com/u/7495374?v=3","gravatar_id":"","url":"https://api.github.com/users/jgajek","html_url":"https://github.com/jgajek","followers_url":"https://api.github.com/users/jgajek/followers","following_url":"https://api.github.com/users/jgajek/following{/other_user}","gists_url":"https://api.github.com/users/jgajek/gists{/gist_id}","starred_url":"https://api.github.com/users/jgajek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgajek/subscriptions","organizations_url":"https://api.github.com/users/jgajek/orgs","repos_url":"https://api.github.com/users/jgajek/repos","events_url":"https://api.github.com/users/jgajek/events{/privacy}","received_events_url":"https://api.github.com/users/jgajek/received_events","type":"User","site_admin":false},"created_at":"2015-10-17T16:39:33Z","updated_at":"2015-10-17T16:39:33Z","body":"Hi Jurriaan,\r\n\r\nAny modules that rely on the standard Python ssl module would be affected.  This workaround is intended as a last resort for those who don't have the option to install a proper SSL certificate on their malware lab ESXi host.  Note that I have tried some less drastic options, like adding the default VMware self-signed certificate to the system trusted certificate store, but to no avail.  Turning off verification globally in the process was the only reasonable workaround I could find.  Once the VMware Python SDK folks get around to implementing a proper solution for this (according to the Github discussions on their repo they are working on it), I will update this machinery module so that the 'unverified_ssl' option only affects SSL connections to the ESXi host."}}