Python连接Tableau服务器遇SSL证书验证失败问题求助

我已通过Python代码成功下载证书，执行了以下命令：

sudo cp tableau-it.homedepot.com_0.cer /usr/local/share/ca-certificates/tableau.crt

ls /usr/local/share/ca-certificates

sudo update-ca-certificates

随后编写了如下Python代码连接Tableau服务器：

import sys
import os
import glob
import certifi
import tableauserverclient as TSC
import csv
import json
import pathlib

carFilePath = "/etc/ssl/certs/tableau.pem"
crtCAFilePath = "/etc/ssl/certs/ca-certificates.crt"
server = TSC.Server(SOURCE_SERVER_NAME, use_server_version=True)
tableau_auth = TSC.PersonalAccessTokenAuth(token_name=tableauAccessToken, personal_access_token=tableauAccessTokenValue, site_id=SOURCE_SITE_NAME)
server.add_http_options({'verify': True, 'cert': carFilePath})
server.use_server_version()
print(server.version)

print('Checking connection to Tableau server...')
with server.auth.sign_in(tableau_auth):
    print('Logged in to source server successfully')

运行代码后出现如下错误：

request method get, url: https://tableau-it.homedepot.com//api/2.4/serverInfo
[18:27:57] Begin blocking request to https://tableau-it.homedepot.com//api/2.4/serverInfo
Error making request to server: HTTPSConnectionPool(host='tableau-it.homedepot.com', port=443): Max retries exceeded with url: //api/2.4/serverInfo (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)')))
[18:27:57] Request complete
[18:27:58] Async request returned: received HTTPSConnectionPool(host='tableau-it.homedepot.com', port=443): Max retries exceeded with url: //api/2.4/serverInfo (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)')))
Response status: HTTPSConnectionPool(host='tableau-it.homedepot.com', port=443): Max retries exceeded with url: //api/2.4/serverInfo (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)')))
Could not get version info from server: <class 'OSError'>Response is not a http response?
versions: None, 2.4
request method get, url: https://tableau-it.homedepot.com//api/2.4/serverInfo
[18:27:58] Begin blocking request to https://tableau-it.homedepot.com//api/2.4/serverInfo
Error making request to server: HTTPSConnectionPool(host='tableau-it.homedepot.com', port=443): Max retries exceeded with url: //api/2.4/serverInfo (Caused by SSLError(SSLError(336265225, '[SSL] PEM lib (_ssl.c:3845)')))
[18:27:58] Request complete
[18:27:59] Async request returned: received HTTPSConnectionPool(host='tableau-it.homedepot.com', port=443): Max retries exceeded with url: //api/2.4/serverInfo (Caused by SSLError(SSLError(336265225, '[SSL] PEM lib (_ssl.c:3845)')))
Response status: HTTPSConnectionPool(host='tableau-it.homedepot.com', port=443): Max retries exceeded with url: //api/2.4/serverInfo (Caused by SSLError(SSLError(336265225, '[SSL] PEM lib (_ssl.c:3845)')))
Could not get version info from server: <class 'OSError'>Response is not a http response?
versions: None, 2.4
2.4
Checking connection to Tableau server...
Traceback (most recent call last):
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/urllib3/connectionpool.py", line 722, in urlopen
    chunked=chunked,
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/urllib3/connectionpool.py", line 404, in _make_request
    self._validate_conn(conn)
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/urllib3/connectionpool.py", line 1058, in _validate_conn
    conn.connect()
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/urllib3/connection.py", line 429, in connect
    tls_in_tls=tls_in_tls,
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/urllib3/util/ssl_.py", line 418, in ssl_wrap_socket
    context.load_cert_chain(certfile, keyfile)
ssl.SSLError: [SSL] PEM lib (_ssl.c:3845)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/requests/adapters.py", line 497, in send
    chunked=chunked,
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/urllib3/connectionpool.py", line 800, in urlopen
    method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/urllib3/util/retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='tableau-it.homedepot.com', port=443): Max retries exceeded with url: //api/2.4/auth/signin (Caused by SSLError(SSLError(336265225, '[SSL] PEM lib (_ssl.c:3845)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "checkConnTableau.py", line 41, in <module>
    with server.auth.sign_in(tableau_auth):
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/tableauserverclient/server/endpoint/endpoint.py", line 292, in wrapper
    return func(self, *args, **kwargs)
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/tableauserverclient/server/endpoint/auth_endpoint.py", line 32, in sign_in
    url, data=signin_req, **self.parent_srv.http_options, allow_redirects=False
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/requests/sessions.py", line 637, in post
    return self.request("POST", url, data=data, json=json, **kwargs)
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/requests/sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/requests/sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
  File "/var/lib/jenkins/virtual_environments/tableauServerClient/lib/python3.7/site-packages/requests/adapters.py", line 517, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='tableau-it.homedepot.com', port=443): Max retries exceeded with url: //api/2.4/auth/signin (Caused by SSLError(SSLError(336265225, '[SSL] PEM lib (_ssl.c:3845)')))

我尝试指定证书安装时生成的pem文件路径，但仍未解决问题。请问该如何解决此问题？

1. 修复证书格式问题 #

错误[SSL] PEM lib说明Python无法解析指定的证书文件：

• 先检查/etc/ssl/certs/tableau.pem的格式，确认内容以-----BEGIN CERTIFICATE-----开头、-----END CERTIFICATE-----结尾。如果是DER格式证书，执行转换命令：

  openssl x509 -inform der -in tableau-it.homedepot.com_0.cer -out tableau.pem
  

• 将转换后的.pem文件复制到/usr/local/share/ca-certificates/，重新执行sudo update-ca-certificates。

2. 修正HTTP参数配置 #

代码中cert参数是用于客户端双向认证的，而你当前需要的是让Python信任服务器CA证书，应调整verify参数：

# 方法1：指定系统完整CA证书集合
server.add_http_options({'verify': '/etc/ssl/certs/ca-certificates.crt'})
# 方法2：直接指定单个证书文件
server.add_http_options({'verify': '/etc/ssl/certs/tableau.pem'})

移除cert参数，除非Tableau服务器明确要求客户端证书认证。

3. 强制Python使用系统CA证书 #

部分虚拟环境会默认使用certifi包的CA证书而非系统证书，可通过以下方式强制切换：

• 环境变量方式：

  export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
  

• 代码内指定：

  import os
  os.environ['REQUESTS_CA_BUNDLE'] = '/etc/ssl/certs/ca-certificates.crt'
  

4. 补充完整证书链 #

错误unable to get local issuer certificate说明缺少中间/根证书，获取服务器完整证书链：

openssl s_client -connect tableau-it.homedepot.com:443 -showcerts > full_chain.pem

将full_chain.pem重命名为tableau_chain.crt，复制到/usr/local/share/ca-certificates/后执行sudo update-ca-certificates。

5. 基础连接测试 #

先用requests库测试SSL连接，缩小问题范围：

import requests
response = requests.get('https://tableau-it.homedepot.com/api/2.4/serverInfo', verify='/etc/ssl/certs/tableau.pem')
print(response.status_code)

如果测试成功，再回到Tableau Server Client代码调整。

内容的提问来源于stack exchange，提问作者Eric Rosales