Configs.py throws certificate verify failed (_ssl.c:579) error

[#1]

Disclaimer:This article is based on my personal experience and knowledge.Don't take it as a standard guidelines, understand the concept and modify it for your environmental best practices and use case. Always contact Hortonworks support if its production cluster

Problem Description: I am currently using ambari-2.6.2 version. I am trying to update some configs via configs.py and my python version is python-2.7.9 and my configs.py is failing with below error :

[root@asnaik1 certs]# /var/lib/ambari-server/resources/scripts/configs.py --port=8443 --action=set --host=asnaik1.openstacklocal --cluster=asnaik --config-type=kafka-env --user=admin --password=admin --key=kafka_log_dir --value=/tmp --protocol=https
2018-12-05 10:24:57,615 INFO ### Performing "set":
2018-12-05 10:24:57,615 INFO ### new property - "kafka_log_dir":"/tmp"
Traceback (most recent call last):
File "/var/lib/ambari-server/resources/scripts/configs.py", line 364, in <module>
sys.exit(main())
File "/var/lib/ambari-server/resources/scripts/configs.py", line 343, in main
return set_properties(cluster, config_type, action_args, accessor)
File "/var/lib/ambari-server/resources/scripts/configs.py", line 237, in set_properties
update_config(cluster, config_type, updater, accessor)
File "/var/lib/ambari-server/resources/scripts/configs.py", line 131, in update_config
properties, attributes = config_updater(cluster, config_type, accessor)
File "/var/lib/ambari-server/resources/scripts/configs.py", line 136, in update
properties, attributes = get_current_config(cluster, config_type, accessor)
File "/var/lib/ambari-server/resources/scripts/configs.py", line 123, in get_current_config
config_tag = get_config_tag(cluster, config_type, accessor)
File "/var/lib/ambari-server/resources/scripts/configs.py", line 94, in get_config_tag
response = accessor(DESIRED_CONFIGS_URL.format(cluster))
File "/var/lib/ambari-server/resources/scripts/configs.py", line 89, in do_request
raise Exception('Problem with accessing api. Reason: {0}'.format(exc))
Exception: Problem with accessing api. Reason: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)>

Root cause: starting from python 2.7.9, python will validate the SSL certificate by default and if no valid SSL certificate is configured it might fail. All the python version below 2.7.9 this is disabled by default.

More Details can be found in this JIRA : https://issues.apache.org/jira/browse/AMBARI-23893

the above JIRA is fixed in ambari-2.7 version so all the versions below ambari-2.7 and having python 2.7.9 will be having this issue.

Workaround :

The fix of JIRA : AMBARI-23893 is this : https://github.com/apache/ambari/pull/1314/files

We can actually take backup of file : /var/lib/ambari-server/resources/scripts/configs.py and use this configs.py instead .

Steps

1) Navigate to /var/lib/ambari-server/resources/scripts/

cd /var/lib/ambari-server/resources/scripts/

2) take Backup of configs.py

mv configs.py configs.py_Backup

3) wget the raw github content with fix:

wget https://raw.githubusercontent.com/dlysnichenko/ambari/75e0c4a6e5f2c30483bf2f783c1af0c38f3b2623/ambar...

4) give necessary permissions

chmod -R 750 configs.py

5) Retry the Operation with --unsafe option 

[root@asnaik1 certs]# /var/lib/ambari-server/resources/scripts/configs.py --port=8443 --action=set --host=asnaik1.openstacklocal --cluster=asnaik --config-type=kafka-env --user=admin --password=admin --key=kafka_log_dir --value=/tmp --protocol=https --unsafe 

NOTE: Remember to add --unsafe option as that was the change associated with the apache-jira