Newer scipy-notebook version 3.3.4 with GEN_CERT=yes creates SSL errors [http request]; does not work with Traefik reverse-proxy

bgalvao · May 7, 2022, 11:03am

I built an image to include some preinstalled packages. I noticed that this has something to do with the versions of jupyterlab:

docker run --rm -p 8888:8888 -e GEN_CERT=yes jupyter/scipy-notebook:lab-3.2.8

runs fine without any breaking SSL error. However

docker run --rm -p 8888:8888 -e GEN_CERT=yes jupyter/scipy-notebook:lab-3.3.4

generates the following SSL error

[W 2022-05-07 10:36:02.146 ServerApp] SSL Error on 44 ('127.0.0.1', 44474): [SSL: HTTP_REQUEST] http request (_ssl.c:1129)

I tested Docker Swarm services using both versions. The version 3.2.8 works fine. Version 3.3.4 breaks! I should probably open an issue on GitHub, but I would like to hear someone’s opinion first.

Note: I hope 3.2.8 isn’t too old to have Facets included.

bgalvao · May 7, 2022, 11:10am

github.com/jupyter/docker-stacks

[BUG] - Healthcheck fails when using self-signed SSL certificate

opened 08:07PM - 06 May 22 UTC

remisalmon

type:Bug

### What docker image(s) are you using? jupyter/base-notebook:latest ### O…S system and architecture running docker image Amazon Linux 2 ### What Docker command are you running? ``` docker run --rm \ --detach \ --publish 8888:8888 \ --name jupyter \ --volume ${HOME}/work:/home/jovyan/work \ --env GEN_CERT=yes \ --env RESTARTABLE=yes \ jupyter/base-notebook:latest ``` ### How to Reproduce the problem? 1. Run the docker command above 2. Run `docker ps`, container shows as `(unhealthy)` 3. Run `wget -O- --no-verbose --tries=1 --no-check-certificate http://localhost:8888/api` 4. Run `wget -O- --no-verbose --tries=1 --no-check-certificate https://localhost:8888/api` ### Command output Step 2: ``` CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES ... jupyter/base-notebook:latest "tini -g -- start-no…" 3 days ago Up 3 days (unhealthy) 0.0.0.0:8888->8888/tcp, :::8888->8888/tcp jupyter ``` Step 3: ``` No data received. ``` Step 4: ``` ERROR: cannot verify localhost's certificate, issued by ‘/C=XX/ST=XX/L=XX/O=generated/CN=generated’: Self-signed certificate encountered. ERROR: certificate common name ‘generated’ doesn't match requested host name ‘localhost’. To connect to localhost insecurely, use `--no-check-certificate'. ``` ### Expected behavior Healthchecks should work when using self-signed SSL certificates. ### Actual behavior When running the base notebook image with `GEN_CERT=yes`, healthchecks are failing in Docker because the check is targeting http://localhost (see https://github.com/jupyter/docker-stacks/blob/60b4e4b298ccccf1da88fb030a8f48778e3d40a7/base-notebook/Dockerfile#L168). ### Anything else? _No response_

there’s an issue already

Evdel · May 10, 2022, 6:44pm

Does the client trust the authority used by the server ?

bgalvao · May 19, 2022, 11:37am

I can easily bypass that.

Topic		Replies	Views
@JupyterLab Services and SSL self signed certs and rejectUnauthorized JupyterLab	0	1070	May 17, 2019
JupyterLab behind traefik reverse proxy JupyterLab help-wanted	1	2325	June 7, 2021
New Notebook docker images are not working Notebook	9	188	December 10, 2024
Interpretation of console output General	1	3142	September 28, 2019
Failed to check authorization (upstream problem) JupyterHub jupyterlab , jupyterhub	3	1446	April 15, 2021

Newer scipy-notebook version 3.3.4 with GEN_CERT=yes creates SSL errors [http request]; does not work with Traefik reverse-proxy

Related topics