{"action":"created","issue":{"url":"https://api.github.com/repos/s3tools/s3cmd/issues/612","labels_url":"https://api.github.com/repos/s3tools/s3cmd/issues/612/labels{/name}","comments_url":"https://api.github.com/repos/s3tools/s3cmd/issues/612/comments","events_url":"https://api.github.com/repos/s3tools/s3cmd/issues/612/events","html_url":"https://github.com/s3tools/s3cmd/issues/612","id":104571275,"number":612,"title":"Fix python 2.7.9+ certificate check for S3-compatible services","user":{"login":"jamshid","id":8549,"avatar_url":"https://avatars.githubusercontent.com/u/8549?v=3","gravatar_id":"","url":"https://api.github.com/users/jamshid","html_url":"https://github.com/jamshid","followers_url":"https://api.github.com/users/jamshid/followers","following_url":"https://api.github.com/users/jamshid/following{/other_user}","gists_url":"https://api.github.com/users/jamshid/gists{/gist_id}","starred_url":"https://api.github.com/users/jamshid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jamshid/subscriptions","organizations_url":"https://api.github.com/users/jamshid/orgs","repos_url":"https://api.github.com/users/jamshid/repos","events_url":"https://api.github.com/users/jamshid/events{/privacy}","received_events_url":"https://api.github.com/users/jamshid/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-02T21:06:15Z","updated_at":"2015-09-03T04:51:48Z","closed_at":null,"body":"This is related to https://github.com/s3tools/s3cmd/issues/437, hoping you can provide some direction on what needs to be done to get s3cmd working with S3-compatible a https endpoint like https://me.cloud.example.com.\r\n\r\nI'm using master but it still doesn't work on my OSX with python 2.7.10.\r\n\r\n```\r\n$ git clone https://github.com/s3tools/s3cmd.git\r\n$ cd s3cmd\r\n$ python setup.py build\r\n\r\n# Create a file containing each cert, hand edited to remove non-cert output\r\n$ openssl s_client -connect me.cloud.example.com:443 -showcerts </dev/null 2>/dev/null > mycertfile.pem\r\n\r\n# List buckets works\r\n$ ./build/scripts-2.7/s3cmd --no-check-certificate --ca-cert ./mycertfile.pem ls \r\n2015-02-05 07:51  s3://x\r\n2015-02-04 04:15  s3://yum\r\n\r\n# List the \"x\" bucket, weird that it works, right?! I think it's related to being a single character.\r\n$ ./build/scripts-2.7/s3cmd -d --no-check-certificate --ca-cert ./mycertfile.pem ls s3://x\r\nDEBUG: Using ca_certs_file ./mycertfile.pem\r\nDEBUG: Disabling hostname checking\r\nDEBUG: non-proxied HTTPSConnection(me.cloud.example.com)\r\nDEBUG: Unicodising \"Bucket name 'x' is too short (min 3 characters)\" using UTF-8\r\nDEBUG: format_uri(): /x/?delimiter=/\r\n...\r\n                       DIR   s3://x/repodata/\r\n...\r\n\r\n# Listing any other bucket fails :-(\r\n$ ./build/scripts-2.7/s3cmd -d --no-check-certificate --ca-cert ./mycertfile.pem ls s3://yum\r\nWARNING: Retrying failed request: /?delimiter=/ (hostname 'yum.me.cloud.example.com' doesn't match either of '*.cloud.example.com', 'cloud.example.com')\r\n...\r\n```\r\n\r\nThis is my ~/.s3cfg:\r\n```\r\n[default]\r\naccess_key = XXX\r\nhost_base = me.cloud.example.com\r\nhost_bucket = %(bucket)s.me.cloud.example.com\r\nsecret_key = secret\r\nsignature_v2=True\r\nuse_https = True\r\n```"},"comment":{"url":"https://api.github.com/repos/s3tools/s3cmd/issues/comments/137331575","html_url":"https://github.com/s3tools/s3cmd/issues/612#issuecomment-137331575","issue_url":"https://api.github.com/repos/s3tools/s3cmd/issues/612","id":137331575,"user":{"login":"mdomsch","id":689066,"avatar_url":"https://avatars.githubusercontent.com/u/689066?v=3","gravatar_id":"","url":"https://api.github.com/users/mdomsch","html_url":"https://github.com/mdomsch","followers_url":"https://api.github.com/users/mdomsch/followers","following_url":"https://api.github.com/users/mdomsch/following{/other_user}","gists_url":"https://api.github.com/users/mdomsch/gists{/gist_id}","starred_url":"https://api.github.com/users/mdomsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mdomsch/subscriptions","organizations_url":"https://api.github.com/users/mdomsch/orgs","repos_url":"https://api.github.com/users/mdomsch/repos","events_url":"https://api.github.com/users/mdomsch/events{/privacy}","received_events_url":"https://api.github.com/users/mdomsch/received_events","type":"User","site_admin":false},"created_at":"2015-09-03T04:51:48Z","updated_at":"2015-09-03T04:51:48Z","body":"This is actually better and correct:\n\ndiff --git a/S3/ConnMan.py b/S3/ConnMan.py\nindex 65b1050..04a6363 100644\n--- a/S3/ConnMan.py\n+++ b/S3/ConnMan.py\n@@ -159,7 +159,7 @@ class ConnMan(object):\n             debug(\"ConnMan.get(): creating new connection: %s\" % conn_id)\n             conn = http_connection(conn_id, hostname, ssl, cfg)\n             conn.c.connect()\n-            if conn.ssl:\n+            if conn.ssl and conn.context.check_hostname:\n                 conn.match_hostname()\n         conn.counter += 1\n         return conn\n\n\nOn Wed, Sep 2, 2015 at 11:40 PM, Matt Domsch <matt@domsch.com> wrote:\n\n> Please try with this:\n>\n>\n> diff --git a/S3/ConnMan.py b/S3/ConnMan.py\n> index 65b1050..c311efe 100644\n> --- a/S3/ConnMan.py\n> +++ b/S3/ConnMan.py\n> @@ -159,7 +159,7 @@ class ConnMan(object):\n>              debug(\"ConnMan.get(): creating new connection: %s\" % conn_id)\n>              conn = http_connection(conn_id, hostname, ssl, cfg)\n>              conn.c.connect()\n> -            if conn.ssl:\n> +            if conn.ssl and cfg.check_ssl_certificate:\n>                  conn.match_hostname()\n>          conn.counter += 1\n>          return conn\n>\n>\n>\n>\n>\n>\n> On Wed, Sep 2, 2015 at 10:35 PM, jamshid <notifications@github.com> wrote:\n> >\n> > It's not a general solution, but a side-effect of always returning False\n> from check_bucket_name() is that it avoids the certificate check failure.\n> If you have any pointers maybe I can come up with a usable pull request.\n> >\n> > —\n> > Reply to this email directly or view it on GitHub.\n>\n"}}