I suspect the first error is really about serverca. So, it would use user/password, but firstly it needs to establish SSL connection for which it requires serverca field. It shouldn't be more needed in current release (1.12) - so no explicit serverca line is required and system-wide verification will be used.

Can you try it with 1.12 version? And/or paste an error which appears when serverca is supplied to see if it is really ignoring user/password settings or some other SSL part is the source.

Also would be helpful if you can point us, where documentation should be improved (or write some of it :-))

I'm not able to easily try the 1.12 version, because it's not available in CentOS 7.

The error message when setting the serverca value is:

Traceback (most recent call last):
  File "/usr/sbin/kojira", line 805, in <module>
    session.login()
  File "/usr/lib/python2.7/site-packages/koji/__init__.py", line 2026, in login
    sinfo = self.callMethod('login', self.opts['user'], self.opts['password'], opts)
  File "/usr/lib/python2.7/site-packages/koji/__init__.py", line 2245, in callMethod
    return self._callMethod(name, args, opts)
  File "/usr/lib/python2.7/site-packages/koji/__init__.py", line 2362, in _callMethod
    return self._sendCall(handler, headers, request)
  File "/usr/lib/python2.7/site-packages/koji/__init__.py", line 2276, in _sendCall
    return self._sendOneCall(handler, headers, request)
  File "/usr/lib/python2.7/site-packages/koji/__init__.py", line 2321, in _sendOneCall
    r = self.rsession.post(handler, **callopts)
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 507, in post
    return self.request('POST', url, data=data, json=json, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 464, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 576, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests/adapters.py", line 431, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)

The strange thing is... it seems to work when I use serverca = /etc/pki/tls/certs/ca-bundle.crt, but not when I use the chainX.pem or fullchainX.pem file from Let's Encrypt that httpd is using.

I'm still not sure why this doesn't work with the CA chain provided by Let's Encrypt. But, a quick resolution to this would be to have a default value for serverca set to /etc/pki/tls/certs/ca-bundle.crt, at least for the Fedora/RHEL/CentOS packaging.

Which version of Koji did you upgrade from?

Wait, sorry I misread something

Current build in epel7 testing:

https://koji.fedoraproject.org/koji/buildinfo?buildID=881629

Perhaps try that?

Is this still applicable?

Sorry for delay. I haven't had time to check yet. As it turns out... it's not easy to rapidly deploy a koji instance. :pouting_cat:

If your server url uses https, then Koji will verify the cert by default. This is built in to python-requests, which we now use for our hub calls.

If serverca is specified, then that is the ca (or ca bundle) used to verify the cert. Otherwise it uses the python-requests default, which uses your system ca bundle and/or certifi.

If you want to use https, but disable cert verification, you can set no_ssl_verify = true in your config.

This behavior changed in 1.11.

Cool, the no_ssl_verify = true option sounds like exactly what I needed. It might be awhile before I can test it, but if the developers are confident that works, then I'm satisfied.

Closing - if you hit some more problems, please respond/reopen.

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/395

Please continue any further discussion there.