ClientSecretCredential.get_token failed: Authentication failed: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:997)

[takkouet]

I'm using the azusre SDK to retrieve secrets from key vault.

from azure.identity import ClientSecretCredential
from azure.keyvault.secrets import SecretClient
from dotenv import load_dotenv
import os

load_dotenv()
TENANT_ID = os.getenv("AZURE_TENANT_ID")
CLIENT_ID = os.getenv("AZURE_CLIENT_ID")
CLIENT_SECRET = os.getenv("AZURE_CLIENT_SECRET")


class AzureKeyVault:
    def __init__(self, vault_name: str):
        self.vault_url = f"https://{vault_name}.vault.azure.net/"

    def __auth(self):
        try:
            credential = ClientSecretCredential(
                tenant_id = TENANT_ID,
                client_id = CLIENT_ID,
                client_secret = CLIENT_SECRET,
                # connection_verify=False # Only in dev, investigating for furthere stable solution
            )
            client = SecretClient(vault_url=self.vault_url, credential=credential)
            return client
        except Exception as e:
            error_message = f"Couldn't authenticate key vault {self.vault_url}, due to:\n {e}"
            raise Exception(error_message)

    def GetSecret(self, secret_name: str, secret_version: str = None) -> str:
        try:
            client = self.__auth()
            secret = client.get_secret(secret_name, secret_version).value
            return secret
        except Exception as e:
            error_message = f"Couldn't retrieve secret {secret_name} from {self.vault_url}, due to:\n {e}"
            raise Exception(error_message)

print(AzureKeyVault("key-vault-XXXXXXXX").GetSecret("admin-username"))
>> pqvinh2 (This was returned when uncomment connection_verify = False)
>> ClientSecretCredential.get_token failed: Authentication failed: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:997) (This was returned when comment connection_verify = False)

As you can see if i uncomment connection_verify = False when declaring credential, it works perfectly fine. I also use this script on my PC at work and no issue was to be found, but it keeps telling me that my cert is expired when I tried to run the script on my PC at home.

Please help me to identify and resolve this problem. Thank you!

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[xiangyan99]

Thanks for reaching out.

It looks to me there might be something wrong in your environment. e.g. did you set certificate on your home machine?

I cannot repro the issue on my machine.

[github-actions]

Hi @takkouet. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.

[takkouet]

Thanks for reaching out.

It looks to me there might be something wrong in your environment. e.g. did you set certificate on your home machine?

I cannot repro the issue on my machine.

Hi Xiangyan,
Sorry I'm quite vague about this security thing. Below are all the certs on my home PC. Can I ask which specific kind of certificate may cause the issue I'm raising?

[pvaneck]

On your home computer, try running pip install --upgrade certifi in your Python environment to see if that resolves the cert error.

[github-actions]

Hi @takkouet. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.

[github-actions]

Hi @takkouet, we're sending this friendly reminder because we haven't heard back from you in 7 days. We need more information about this issue to help address it. Please be sure to give us your input. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!