Corporate netsec software on Windows may causes 'self signed certificate' verification errors

It appears that this happens as network packets are inspected and re-signed by software running in the background on the machine. In theory there should be a way to let users trust the certs issued by their corp IT teams, and/or selectively disable/mute validations from specific domains.

Two instances so far reported in slack:

• https://meltano.slack.com/archives/C01TCRBBJD7/p1656621387384619
• https://meltano.slack.com/archives/C01TCRBBJD7/p1656516344303779

---

Maybe (or maybe not) related:

I went digging around we did have some historic references to ‘self signed certificates’ in tap-gitlab and in the SDK. In those cases, a suggested improvement was to leverage a python session object when preparing or making the request.

• The applied change in the SDK was to prepare the request from the session object: https://gitlab.com/meltano/sdk/-/merge_requests/45/diffs
• merge_environment_settings was noted in the historic tap-gitlab issue here as being relevant and skipped in certain codepaths: https://github.com/psf/requests/blob/8c211a96cdbe9fe320d63d9e1ae15c5c07e179f8/requests/sessions.py#L701

---

See below for guidance from Greg Vaslo on slack. Also this issue is noted as related (affects SDK taps but not Meltano core):

• https://github.com/meltano/sdk/issues/633

[edgarrmondragon]

A workaround to this error in meltano add for anyone stumbling into it:

1. Locate the plugin in Meltano Hub: https://hub.meltano.com/. In the plugin page, take note of the default variant, or pick the one you prefer:

   

2. Manually download the plugin definition from the Meltano Hub API into the plugins/<plugin type> directory of your Meltano project. In the case of tap-oracle, this directory is plugins/extractors/:

   PLUGIN_TYPE=extractors
   PLUGIN=tap-oracle
   VARIANT=transferwise
   PLUGIN_PATH=plugins/$PLUGIN_TYPE/$PLUGIN--$VARIANT
   curl https://hub.meltano.com/meltano/api/v1/$PLUGIN_PATH > $PLUGIN_PATH.lock
   

3. Add the plugin entry to meltano.yml

   plugins:
     extractors:
     - name: tap-oracle
       variant: transferwise
   

You should now be able to use the plugin normally.

[visch]

Discovery file changed locations, maybe a workaround you put in place is broken now? Maybe you could take a look at lock files which is new https://docs.meltano.com/reference/command-line-interface#lock I believe, then meltano shouldn’t need to be able to reach the hub. I am guessing at what the cause is without errors and things but this sounds likely based on the past info!