Skip to content

tests: fix ssl generation#3365

Merged
vvoland merged 1 commit into
docker:mainfrom
thaJeztah:fix_dind_ssl
Oct 14, 2025
Merged

tests: fix ssl generation#3365
vvoland merged 1 commit into
docker:mainfrom
thaJeztah:fix_dind_ssl

Conversation

@thaJeztah

Copy link
Copy Markdown
Member

the "integration-dind-ssl" tests were failing due to an issue with the test-certs created;

==================================== ERRORS ====================================
_________ ERROR at setup of BuildTest.test_build_container_with_target _________
/usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:464: in _make_request
    self._validate_conn(conn)
/usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:1093: in _validate_conn
    conn.connect()
/usr/local/lib/python3.12/site-packages/urllib3/connection.py:790: in connect
    sock_and_verified = _ssl_wrap_socket_and_match_hostname(
/usr/local/lib/python3.12/site-packages/urllib3/connection.py:969: in _ssl_wrap_socket_and_match_hostname
    ssl_sock = ssl_wrap_socket(
/usr/local/lib/python3.12/site-packages/urllib3/util/ssl_.py:480: in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
/usr/local/lib/python3.12/site-packages/urllib3/util/ssl_.py:524: in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
/usr/local/lib/python3.12/ssl.py:455: in wrap_socket
    return self.sslsocket_class._create(
/usr/local/lib/python3.12/ssl.py:1041: in _create
    self.do_handshake()
/usr/local/lib/python3.12/ssl.py:1319: in do_handshake
    self._sslobj.do_handshake()
E   ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: invalid CA certificate (_ssl.c:1010)

During handling of the above exception, another exception occurred:
/usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:787: in urlopen
    response = self._make_request(
/usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:488: in _make_request
    raise new_e
E   urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: invalid CA certificate (_ssl.c:1010)

the "integration-dind-ssl" tests were failing due to an issue with the
test-certs created;

    ==================================== ERRORS ====================================
    _________ ERROR at setup of BuildTest.test_build_container_with_target _________
    /usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:464: in _make_request
        self._validate_conn(conn)
    /usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:1093: in _validate_conn
        conn.connect()
    /usr/local/lib/python3.12/site-packages/urllib3/connection.py:790: in connect
        sock_and_verified = _ssl_wrap_socket_and_match_hostname(
    /usr/local/lib/python3.12/site-packages/urllib3/connection.py:969: in _ssl_wrap_socket_and_match_hostname
        ssl_sock = ssl_wrap_socket(
    /usr/local/lib/python3.12/site-packages/urllib3/util/ssl_.py:480: in ssl_wrap_socket
        ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
    /usr/local/lib/python3.12/site-packages/urllib3/util/ssl_.py:524: in _ssl_wrap_socket_impl
        return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
    /usr/local/lib/python3.12/ssl.py:455: in wrap_socket
        return self.sslsocket_class._create(
    /usr/local/lib/python3.12/ssl.py:1041: in _create
        self.do_handshake()
    /usr/local/lib/python3.12/ssl.py:1319: in do_handshake
        self._sslobj.do_handshake()
    E   ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: invalid CA certificate (_ssl.c:1010)

    During handling of the above exception, another exception occurred:
    /usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:787: in urlopen
        response = self._make_request(
    /usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:488: in _make_request
        raise new_e
    E   urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: invalid CA certificate (_ssl.c:1010)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah thaJeztah marked this pull request as ready for review October 14, 2025 21:08
@thaJeztah thaJeztah requested a review from Copilot October 14, 2025 21:12

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR fixes SSL certificate generation issues in the integration test suite. The changes address certificate verification failures by properly configuring CA, server, and client certificates with correct X.509 v3 extensions and key usage attributes.

  • Adds proper v3_ca extension configuration for the Certificate Authority
  • Implements correct key usage and extended key usage for server certificates
  • Configures proper client authentication extensions for client certificates

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@vvoland vvoland merged commit 824d3ab into docker:main Oct 14, 2025
11 checks passed
@thaJeztah thaJeztah deleted the fix_dind_ssl branch October 14, 2025 21:39
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request Jul 12, 2026
…e-python [skip ci]

Updates the requirements on [docker](https://github.com/docker/docker-py) to permit the latest version.
Release notes

*Sourced from [docker's releases](https://github.com/docker/docker-py/releases).*

> 7.2.0
> -----
>
> Upgrade Notes
> -------------
>
> * `docker.from_env()` now honors the active Docker CLI context when `DOCKER_HOST` is not set.
>   + This means the client may connect to the daemon selected by `DOCKER_CONTEXT` or the current context in `~/.docker/config.json`, matching Docker CLI behavior more closely.
>   + If your application relied on the previous default connection behavior, set `DOCKER_HOST` explicitly, set `DOCKER_CONTEXT=default`, or pass `use_context=False` to `DockerClient.from_env()`.
> * Added `docker.from_context()` / `DockerClient.from_context()` for explicitly creating a client from a Docker CLI context.
>
> Features
> --------
>
> * Added support for Docker contexts when creating the default client
> * Added subpath support for volumes
>
> Bugfixes
> --------
>
> * Fixed `exec_run` documentation for the `stream` parameter
> * Fixed image loading to avoid depending on the deprecated `JSONMessage.error` field
> * Preserved the rotated unlock key in swarm integration tests
> * Fixed SSL certificate generation in tests
> * Fixed IPv6 integration tests by explicitly enabling IPv6 where required
>
> Miscellaneous
> -------------
>
> * Updated tests for newer Docker Engine behavior
> * CI and build updates
>
> What's Changed
> --------------
>
> * tests/exec: expect 127 exit code for missing executable by [`@​laurazard`](https://github.com/laurazard) in [docker/docker-py#3290](https://redirect.github.com/docker/docker-py/pull/3290)
> * fixing doc for stream param in exec\_run by [`@​yasonk`](https://github.com/yasonk) in [docker/docker-py#3292](https://redirect.github.com/docker/docker-py/pull/3292)
> * Bump default API version to 1.45 (Moby 26.0/26.1) by [`@​thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3261](https://redirect.github.com/docker/docker-py/pull/3261)
> * Set a dummy-version if none set, and remove unused APT\_MIRROR build-arg by [`@​thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3267](https://redirect.github.com/docker/docker-py/pull/3267)
> * test\_service\_logs: stop testing experimental versions by [`@​thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#2442](https://redirect.github.com/docker/docker-py/pull/2442)
> * Makefile: fix circular reference for integration-dind by [`@​thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3297](https://redirect.github.com/docker/docker-py/pull/3297)
> * image load: don't depend on deprecated JSONMessage.error field by [`@​thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3307](https://redirect.github.com/docker/docker-py/pull/3307)
> * integration: test\_create\_volume\_invalid\_driver allow either 400 or 404 by [`@​thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3296](https://redirect.github.com/docker/docker-py/pull/3296)
> * integration: adjust tests for omitted "OnBuild" by [`@​thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3336](https://redirect.github.com/docker/docker-py/pull/3336)
> * Implement Subpath Support for Volumes in Docker-Py ([#3243](https://redirect.github.com/docker/docker-py/issues/3243)) by [`@​Khushiyant`](https://github.com/Khushiyant) in [docker/docker-py#3270](https://redirect.github.com/docker/docker-py/pull/3270)
> * tests: fix ssl generation by [`@​thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3365](https://redirect.github.com/docker/docker-py/pull/3365)
> * test/integration: don't check for deprecated Networks field by [`@​thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3362](https://redirect.github.com/docker/docker-py/pull/3362)
> * test: Skip from\_env\_unix tests if DOCKER\_HOST is network socket by [`@​ricardobranco777`](https://github.com/ricardobranco777) in [docker/docker-py#3366](https://redirect.github.com/docker/docker-py/pull/3366)
> * test\_connect\_with\_ipv6\_address: enable IPv6 by [`@​robmry`](https://github.com/robmry) in [docker/docker-py#3372](https://redirect.github.com/docker/docker-py/pull/3372)
> * test\_create\_with\_ipv6\_address: enable IPv6 by [`@​robmry`](https://github.com/robmry) in [docker/docker-py#3373](https://redirect.github.com/docker/docker-py/pull/3373)
> * tests: Migrate off gpg2 and regenerate key ed25519 by [`@​vvoland`](https://github.com/vvoland) in [docker/docker-py#3399](https://redirect.github.com/docker/docker-py/pull/3399)
> * gha: Pin to digests by [`@​vvoland`](https://github.com/vvoland) in [docker/docker-py#3408](https://redirect.github.com/docker/docker-py/pull/3408)
> * Fix integration tests on non-amd64 hosts and add ARM64 CI by [`@​vvoland`](https://github.com/vvoland) in [docker/docker-py#3407](https://redirect.github.com/docker/docker-py/pull/3407)
> * integration/swarm: Preserve rotated unlock key by [`@​vvoland`](https://github.com/vvoland) in [docker/docker-py#3410](https://redirect.github.com/docker/docker-py/pull/3410)
> * [DKP-2535] Honour context if present for default client, add contexts support by [`@​ebriney`](https://github.com/ebriney) in [docker/docker-py#3401](https://redirect.github.com/docker/docker-py/pull/3401)
> * docs: 7.2.0 changelog by [`@​vvoland`](https://github.com/vvoland) in [docker/docker-py#3415](https://redirect.github.com/docker/docker-py/pull/3415)
>
> New Contributors
> ----------------
>
> * [`@​laurazard`](https://github.com/laurazard) made their first contribution in [docker/docker-py#3290](https://redirect.github.com/docker/docker-py/pull/3290)
> * [`@​yasonk`](https://github.com/yasonk) made their first contribution in [docker/docker-py#3292](https://redirect.github.com/docker/docker-py/pull/3292)
> * [`@​ricardobranco777`](https://github.com/ricardobranco777) made their first contribution in [docker/docker-py#3366](https://redirect.github.com/docker/docker-py/pull/3366)

... (truncated)


Commits

* [`5ad5327`](docker/docker-py@5ad5327) Merge pull request [#3415](https://redirect.github.com/docker/docker-py/issues/3415) from vvoland/update-changelog
* [`d242230`](docker/docker-py@d242230) docs: 7.2.0 changelog
* [`ba01cc7`](docker/docker-py@ba01cc7) Merge pull request [#3401](https://redirect.github.com/docker/docker-py/issues/3401) from ebriney/client-from-context
* [`ae5dfe9`](docker/docker-py@ae5dfe9) Merge pull request [#3410](https://redirect.github.com/docker/docker-py/issues/3410) from vvoland/fix-flaky
* [`aa99999`](docker/docker-py@aa99999) integration/swarm: Preserve rotated unlock key
* [`059d371`](docker/docker-py@059d371) Merge pull request [#3407](https://redirect.github.com/docker/docker-py/issues/3407) from vvoland/fix-arm64
* [`9b4b9b8`](docker/docker-py@9b4b9b8) gha: Add arm64 integration CI
* [`9e9f8ff`](docker/docker-py@9e9f8ff) Skip tests incompatible with host architecture
* [`e0542d9`](docker/docker-py@e0542d9) Merge pull request [#3408](https://redirect.github.com/docker/docker-py/issues/3408) from vvoland/gha-pin
* [`578a11d`](docker/docker-py@578a11d) gha: Pin to digests
* Additional commits viewable in [compare view](docker/docker-py@7.1.0...7.2.0)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants