After updating python-pyOpenSSL spacecmd and API calls are not able to connect to the server

This document (000019664) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 12 SP4
SUSE Linux Enterprise Server for SAP Applications 12 SP4
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12 SP5
SUSE Manager 3.2

Situation

After updating to the latest python-pyOpenSSL (17.1.0-4.23.1) SUSE Manager spacecmd is not able to connect to the SUSE Manager Server anymore. The same happens when using the SUSE Manager API.

The error will be:

ERROR: Failed to connect to https://localhost/rpc/api

Resolution

When using https the hostname used should be matching the hostname that is used in the certificate of the SUSE Manager Server.

Note: The use of https is recommended. When using http the password is sent in clear text.

Depending on the configuration there can be 2 possible solutions:

The hostname used is not the same as used in the certificate. Often used are the IP-address of the server, localhost, or a CNAME created to access the SUSE Manager Server. In this case, use the FQDN hostname of the SUSE Manager Server (even when the command is being executed on the SUSE Manager Server.
If this command is not executed on the SUSE Manager server. Please add the certificate to this server:

cp /srv/www/htdocs/pub/RHN-ORG-TRUSTED-SSL-CERT /etc/pki/trust/anchors

update-ca-certificates

Cause

There has been a bug in python-OpenSSL that allows the use of a name that is not in the certificate. This is a security bug and has been solved in the latest version.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.