Summary
Since paperless snap revision 232, every web login via SSO fails with
HTTP 500. Paperless can no longer verify the Let’s Encrypt certificate of
auth.<domain>, because REQUESTS_CA_BUNDLE is now always set to the
self-signed Syncloud CA.
Environment
- paperless snap 232 (Paperless-ngx 3.4.2), channel
latest/stable - Raspberry Pi (aarch64), device uses a Let’s Encrypt certificate
- Last working revision: 214
Steps to reproduce
- Open
https://paperless.<domain>/and log in via SSO (Authelia). - The server returns
500 Internal Server Error.
Log (journalctl -u snap.paperless.granian)
[ERROR] [django.request] Internal Server Error: /accounts/oidc/authelia/login/
requests.exceptions.SSLError: HTTPSConnectionPool(host='auth.<domain>', port=443):
Max retries exceeded with url: /.well-known/openid-configuration
(Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED]
certificate verify failed: unable to get local issuer certificate')))
Cause
bin/service.granian.sh changed between 214 and 232:
- if [[ -f /var/snap/platform/current/CI_TEST ]]; then
- export REQUESTS_CA_BUNDLE=/var/snap/platform/current/syncloud.ca.crt
- fi
+ export REQUESTS_CA_BUNDLE=/var/snap/platform/current/syncloud.ca.crt
syncloud.ca.crt contains only the self-signed “syncloud ca”. Because
REQUESTS_CA_BUNDLE replaces the default trust store, which it does not
extend, requests no longer trusts any public CA.
Verified with the snap’s own Python:
REQUESTS_CA_BUNDLE |
GET https://auth.<domain>/.well-known/openid-configuration |
|---|---|
syncloud.ca.crt |
SSLError |
| unset (certifi) | 200 |
curl and openssl s_client on the device validate the certificate chain
of auth.<domain> without errors.
Impact
Web login is impossible. Regular login is disabled
(PAPERLESS_DISABLE_REGULAR_LOGIN=true), so there is no workaround.
Token-based API access still works.