Minio Python API Client: CERTIFICATE_VERIFY_FAILED with self signed certificate

I am using the Minio Python API client to access a Minio server running in a docker container. I have configured SSL by mounting the (self signed) public and private key into the container.

SSL appears to be working fine with curl, when I pass the CA certificate:

$ https_proxy= curl --cacert deploy/minio/certs/cacert.pem --resolve minio:2000:127.0.0.1 https://minio:2000
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied.</Message><Resource>/</Resource><RequestId>1567BC9DB72456EE</RequestId><HostId>3L137</HostId></Error>$

But the Python client doesn’t work:

MaxRetryError: HTTPSConnectionPool(host='localhost', port=2000): Max retries exceeded with url: /files.ips.bucket/ (Caused by SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),))

Here’s how I set up the connection:

MINIO_ENDPOINT = os.environ.get('MINIO_STORAGE_ENDPOINT', "localhost:2000")
MINIO_ACCESS_KEY = os.environ.get('MINIO_ACCESS_KEY')
MINIO_SECRET_KEY = os.environ.get('MINIO_SECRET_KEY')
MINIO_REGION = None
MINIO_USE_HTTPS = True

connection = Minio(settings.MINIO_ENDPOINT,
                                 settings.MINIO_ACCESS_KEY,
                                 settings.MINIO_SECRET_KEY,
                                 settings.MINIO_USE_HTTPS,
                                 settings.MINIO_REGION)

I have searched the docs and Google to no avail - how do I tell the Python client to check against my root certificate?

[solarist]

Without proxy would be something like this:

from minio import Minio
import urllib3

httpClient = urllib3.PoolManager(
                cert_reqs='CERT_REQUIRED',
                ca_certs='/usr/local/share/ca-certificates/CA-Bundle.crt')
minioClient = Minio('your_hostname.sampledomain.com:9000',
                    access_key='ACCESS_KEY',
                    secret_key='SECRET_KEY',
                    secure=True,
                    http_client=httpClient)

[solarist]

@zhangtai try something like this, maybe it helps.

from minio import Minio
from minio.error import ResponseError
import urllib3

httpClient = urllib3.ProxyManager(
                'https://proxy_host.sampledomain.com:8119/',
                timeout=urllib3.Timeout.DEFAULT_TIMEOUT,
                cert_reqs='CERT_REQUIRED',
                ca_certs='/usr/local/share/ca-certificates/CA-Bundle.crt'
            )
minioClient = Minio('your_hostname.sampledomain.com:9000',
                    access_key='ACCESS_KEY',
                    secret_key='SECRET_KEY',
                    secure=True,
                    http_client=httpClient)

The file that ca_certs points to should have the full chain of certificates. Just as a general way to produce one see here or any other tutorial on how to get the certificate chain right. Other option beside setting ca_cert in your http_client is to set the env variable SSL_CERT_FILE to the path of the file.