iris_ca_cert

[nsano-rururu]

https://github.com/jertel/elastalert2/blob/master/elastalert/schema.yaml#L547

current

  iris_ca_cert: {type: string}

fix

  iris_ca_cert: {type: [boolean, string]}

https://github.com/jertel/elastalert2/blob/master/elastalert/alerters/iris.py#L19

current

self.ca_cert = self.rule.get('iris_ca_cert', False)

fix

self.ca_cert = self.rule.get('iris_ca_cert')

https://github.com/jertel/elastalert2/blob/master/elastalert/alerters/iris.py#L113

current

        if self.ca_cert:
            verify = self.ca_cert
        else:
            verify = False

fix

        if self.ca_cert:
            verify = self.ca_cert
        else:
            verify = not self.ignore_ssl_errors

[jertel]

Hi @malinkinsa, will you please review these findings and make the corrections as needed?

[malinkinsa]

Hi, @jertel
Thank you, it looks good. I'll try to take a closer look this week and will proceed to finalize MR with the fix.

[malinkinsa]

One thing to note is that we'll need to override the default value for ignore_ssl_errors from False to True.
Otherwise, if we don't pass anything into 'iris_ca_cert', we'll encounter the following:

• verify = True;
• this block requests.packages.urllib3.disable_warnings() not active; Because the value of self.ignore_ssl_errors hasn't changed.

Consequently, this leads to an SSL error when using self-signed certificates.
To be honest, I'm not very inclined to change the default value for ignore_ssl_errors.

[jertel]

That is the expected behavior when using self-signed certs. The user can optionally configure the ignore_ssl_errors=True to disregard the self-signed errors. There is no need to override that default value for ignore_ssl_errors.

[malinkinsa]

Yeah, I forgot about that. I've also made some changes to the GELF alerter. I saw your changes when bumping the version to Python 3.12 and included them in my MR too.
#1331

[jertel]

Thank you for cleaning up the GELF alerter as well! @nsano-rururu had some documentation update requests on that PR. Once those are in I think we'll be ready to merge it.