starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

webhooks: allow overwriting certificate bundle used to verify requests #2874

New Issue
Closed
opened 2025-12-29 18:22:58 +01:00 by adam · 3 comments
adam commented 2025-12-29 18:22:58 +01:00
Owner
Copy Link

Originally created by @uedvt359 on GitHub (Sep 13, 2019).

Environment

  • Python version: 3.6.8
  • NetBox version: v2.6.3

Proposed Functionality

Requests, which is used to call webhooks, vendors its own CA bundle. This is a problem in our environment, where we sign our certs with our own internal CA. You can override the used CA bundle by setting session.verify to a path (instead of True).

We propose adding a configuration option to set the path to the CA bundle used to verify TLS certificates. We have implemented the changes already in this branch (direct link to commit), and will open a PR once this enhancement gets accepted.

Use Case

We sign our internal certificates with our own (internal; non-default) CA. Adding such a configuration flag would allow us to turn on certificate verification for webhooks.

Database Changes

none.

External Dependencies

none.

Originally created by @uedvt359 on GitHub (Sep 13, 2019). ### Environment * Python version: 3.6.8 * NetBox version: v2.6.3 <!-- Describe in detail the new functionality you are proposing. Include any specific changes to work flows, data models, or the user interface. --> ### Proposed Functionality Requests, which is used to call webhooks, vendors its own CA bundle. This is a problem in our environment, where we sign our certs with our own internal CA. You can override the used CA bundle by setting session.verify to a path (instead of True). We propose adding a configuration option to set the path to the CA bundle used to verify TLS certificates. We have implemented the [changes already in this branch](https://github.com/dvtirol/netbox/tree/pr-cabundle) ([direct link to commit](https://github.com/dvtirol/netbox/commit/88c6a8be0150ac62e47bc9667f4dde41fe333353)), and will open a PR once this enhancement gets accepted. <!-- Convey an example use case for your proposed feature. Write from the perspective of a NetBox user who would benefit from the proposed functionality and describe how. ---> ### Use Case We sign our internal certificates with our own (internal; non-default) CA. Adding such a configuration flag would allow us to turn on certificate verification for webhooks. <!-- Note any changes to the database schema necessary to support the new feature. For example, does the proposal require adding a new model or field? (Not all new features require database changes.) ---> ### Database Changes none. <!-- List any new dependencies on external libraries or services that this new feature would introduce. For example, does the proposal require the installation of a new Python package? (Not all new features introduce new dependencies.) --> ### External Dependencies none.
adam added the status: acceptedtype: feature labels 2025-12-29 18:22:58 +01:00
adam closed this issue 2025-12-29 18:22:58 +01:00
adam commented 2025-12-29 18:22:59 +01:00
Author
Owner
Copy Link

@tyler-8 commented on GitHub (Sep 27, 2019):

requests is actually using the certifi package for CA information. The better solution, rather than modifying netbox IMO, is to follow the outline here: https://incognitjoe.github.io/adding-certs-to-requests.html and append your internal CAs to the certifi bundle.

@tyler-8 commented on GitHub (Sep 27, 2019): `requests` is actually using the `certifi` package for CA information. The better solution, rather than modifying `netbox` IMO, is to follow the outline here: https://incognitjoe.github.io/adding-certs-to-requests.html and append your internal CAs to the `certifi` bundle.
adam commented 2025-12-29 18:22:59 +01:00
Author
Owner
Copy Link

@uedvt359 commented on GitHub (Sep 30, 2019):

Thanks for your reply.

We'd rather not modify certifi, for two reasons:

  1. This will become reverted with every update to the library, increasing maintenance costs and (if someone forgets to monkey-patch it back in) breakage of the webhooks.
  2. We use the same virtual environment for multiple programs on multiple hosts. We need to be able to verify certs signed by public CAs in some applications, and only certs signed by us in others (including Netbox).
  3. To me, and this is purely subjectively, modifying certifi is the wrong layer to handle this. Requests supports supplying a custom CAbundle, only Netbox doesn't expose that functionality.

While not relevant for us directly, some distributions patch certifi to use the system CA bundle. With such a setup, using a custom CA just for validating webhooks becomes impossible without clobbering certs for the whole system.

For all these reasons I still believe that such a configuration option is useful to have in Netbox.

@uedvt359 commented on GitHub (Sep 30, 2019): Thanks for your reply. We'd rather not modify certifi, for two reasons: 1. This will become reverted with every update to the library, increasing maintenance costs and (if someone forgets to monkey-patch it back in) breakage of the webhooks. 2. We use the same virtual environment for multiple programs on multiple hosts. We need to be able to verify certs signed by public CAs in some applications, and only certs signed by us in others (including Netbox). 3. To me, and this is purely subjectively, modifying certifi is the wrong layer to handle this. Requests supports supplying a custom CAbundle, only Netbox doesn't expose that functionality. While not relevant for us directly, [some distributions](https://src.fedoraproject.org/rpms/python-certifi/blob/master/f/certifi-2018.10.15-use-system-cert.patch) patch certifi to use the system CA bundle. With such a setup, using a custom CA just for validating webhooks becomes impossible without clobbering certs for the whole system. For all these reasons I still believe that such a configuration option is useful to have in Netbox.
adam commented 2025-12-29 18:22:59 +01:00
Author
Owner
Copy Link

@lampwins commented on GitHub (Oct 13, 2019):

IMO @uedvt359 is correct here. The certifi method makes more sense if you control the flow end to end. Adding a CA file path field to the Webhook model on the other hand is more explicit and would be less error-prone for users.

@lampwins commented on GitHub (Oct 13, 2019): IMO @uedvt359 is correct here. The certifi method makes more sense if you control the flow end to end. Adding a CA file path field to the Webhook model on the other hand is more explicit and would be less error-prone for users.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#2874
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?