GCP Pub/Sub发布消息时报SSL_ERROR_SSL错误，如何关闭证书校验？

警告：关闭SSL证书校验会引入极大的中间人攻击风险，仅可用于临时测试、完全隔离的内网环境，生产环境请优先排查根证书不被信任的根因（如内网代理替换证书、系统根证书缺失等问题），不要关闭校验。

解决方法 #

Google Cloud Pub/Sub的Python客户端底层基于gRPC实现通信，你可以通过自定义gRPC传输配置来关闭证书校验，修改后的代码如下：

import grpc
from google.cloud import pubsub_v1
from google.auth import jwt
from google.cloud.pubsub_v1.transports import PublisherGrpcTransport

# service account details
service_account_info = {}

audience = "https://pubsub.googleapis.com/google.pubsub.v1.Subscriber"

# TODO(developer)
project_id = "id"
topic_id = "my-topic"

credentials = jwt.Credentials.from_service_account_info(
    service_account_info, audience=audience
)

# 调整Publisher对应的audience
publisher_audience = "https://pubsub.googleapis.com/google.pubsub.v1.Publisher"
credentials_pub = credentials.with_claims(audience={publisher_audience})

# 自定义gRPC SSL配置，关闭证书校验
ssl_creds = grpc.ssl_channel_credentials()
channel_opts = [
    ("grpc.ssl_target_name_override", "pubsub.googleapis.com"),
    ("grpc.default_authority", "pubsub.googleapis.com")
]
# 创建自定义传输
transport = PublisherGrpcTransport(
    credentials=credentials_pub,
    ssl_channel_credentials=ssl_creds,
    options=channel_opts,
    ssl_server_cert_verifier=grpc.no_cert_verifier()
)

# 使用自定义传输创建PublisherClient
publisher = pubsub_v1.PublisherClient(transport=transport)
topic_path = publisher.topic_path(project_id, topic_id)

data = f"Message test"
data = data.encode("utf-8")
future = publisher.publish(topic_path, data)
print(future.result())

print(f"Published messages to {topic_path}.")

更推荐的替代方案 #

如果你的环境是因为内网代理、自签名证书导致的验证失败，更安全的做法是将内网根证书文件路径配置到环境变量GRPC_DEFAULT_SSL_ROOTS_FILE_PATH，不需要完全关闭证书校验：

import os
os.environ["GRPC_DEFAULT_SSL_ROOTS_FILE_PATH"] = "/path/to/your/internal/root_ca.pem"

内容的提问来源于stack exchange，提问作者Edward Ramos