rtm_connect to slackbot gives SSL certificate validation error

Question

I have a slackbot in my workspace. I am using this python script to connect to the slackbot and process the chat messages it gets. The below line gives SSL error:

slack_client.rtm_connect(with_team_state=False)

Error:

Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/slackclient/client.py", line 52, in rtm_connect
    self.server.rtm_connect(use_rtm_start=with_team_state, **kwargs)
  File "/usr/lib/python2.7/site-packages/slackclient/server.py", line 147, in rtm_connect
    self.connect_slack_websocket(self.ws_url)
  File "/usr/lib/python2.7/site-packages/slackclient/server.py", line 186, in connect_slack_websocket
    raise SlackConnectionError(message=str(e))
SlackConnectionError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)
Connection failed. Exception traceback printed above.

I tried updating REQUESTS_CA_BUNDLE in the python code, but didn't work.

How can I install and make it verify the certificate? Also, how can I skip certificate verification?

Any detailed link on usage of SSL certificates is appreciated.

Answer 1

The reason this fails comes from the websocket package and the CA bundle it uses (which is not up-to-date). I couldn't figure out which CA bundle is actually used (I've tried to update the package supplied as well as system-installed OpenSSL bundle), but it can be overwritten on command line.

So first I've downloaded the DigiCert certs:

wget https://www.tbs-certificats.com/issuerdata/DigiCertGlobalRootCA.crt

(NOTE: I couldn't find an official download link on the DigiCert page, dunno why they're not offering it)

Then set the environment variable:

export WEBSOCKET_CLIENT_CA_BUNDLE=DigiCertGlobalRootCA.crt

And that worked for me:

$ python bot.py
Starter Bot connected and running!