Merge pull request #361 from lsst-sqre/tickets/DM-48214/disable-kafka…

…-x509-strict-verification

DM-48214: Unset `ssl.VERIFY_X509_STRICT` flag on Kafka SSl contexts

changelog.d/20241218_162844_danfuchs_disable_kafka_x509_strict_verification.md

@@ -0,0 +1,3 @@
+### Bug fixes
+
+- Unset the `ssl.VERIFY_X509_STRICT` flag in SSL contexts used for Kafka connections. Python 3.13 enables this flag by default, and the current certs that Strimzi generates for these Kafka endpoints are missing an Authority Key Identifier, which prevents connections when the flag is set.

safir/src/safir/kafka/_kafka_config.py

@@ -103,12 +103,21 @@ class SslSettings(BaseModel):
 
     def to_ssl_context(self) -> ssl.SSLContext:
         """Create an SSL context for connecting to Kafka."""
-        return helpers.create_ssl_context(
+        context = helpers.create_ssl_context(
             cafile=str(self.cluster_ca_path),
             certfile=str(self.client_cert_path),
             keyfile=str(self.client_key_path),
         )
 
+        # Starting with Python 3.13, the VERIFY_X509_STRICT flag is set in
+        # contexts created with ssl.create_default_context(), which this
+        # context is. The certs generated by Strimzi on the Kafka bootstrap
+        # endpoints do not have an Authority Key Identifier set, which makes
+        # connections fail. Until these get fixed and regenerated in Strimzi,
+        # unset VERIFY_X590_STRICT.
+        context.verify_flags &= ~ssl.VERIFY_X509_STRICT
+        return context
+
     def to_faststream_params(self) -> FastStreamBrokerParams:
         return {
             "bootstrap_servers": self.bootstrap_servers,
@@ -189,10 +198,19 @@ def to_ssl_context(self) -> ssl.SSLContext:
 
         if self.cluster_ca_path:
             cafile = str(self.cluster_ca_path)
-        return helpers.create_ssl_context(
+        context = helpers.create_ssl_context(
             cafile=cafile,
         )
 
+        # Starting with Python 3.13, the VERIFY_X509_STRICT flag is set in
+        # contexts created with ssl.create_default_context(), which this
+        # context is. The certs generated by Strimzi on the Kafka bootstrap
+        # endpoints do not have an Authority Key Identifier set, which makes
+        # connections fail. Until these get fixed and regenerated in Strimzi,
+        # unset VERIFY_X590_STRICT.
+        context.verify_flags &= ~ssl.VERIFY_X509_STRICT
+        return context
+
     def to_faststream_params(self) -> FastStreamBrokerParams:
         cls: type[SASLScram512 | SASLScram256 | SASLPlaintext]
         match self.sasl_mechanism: