rtm_connect to slackbot gives SSL certificate validation error - ssl

Question

I have a slackbot in my workspace. I am using this python script to connect to the slackbot and process the chat messages it gets. The below line gives SSL error:
slack_client.rtm_connect(with_team_state=False)
Error:
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/slackclient/client.py", line 52, in rtm_connect
self.server.rtm_connect(use_rtm_start=with_team_state, **kwargs)
File "/usr/lib/python2.7/site-packages/slackclient/server.py", line 147, in rtm_connect
self.connect_slack_websocket(self.ws_url)
File "/usr/lib/python2.7/site-packages/slackclient/server.py", line 186, in connect_slack_websocket
raise SlackConnectionError(message=str(e))
SlackConnectionError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)
Connection failed. Exception traceback printed above.
I tried updating REQUESTS_CA_BUNDLE in the python code, but didn't work.
How can I install and make it verify the certificate? Also, how can I skip certificate verification?
Any detailed link on usage of SSL certificates is appreciated.

Answer 1

The reason this fails comes from the websocket package and the CA bundle it uses (which is not up-to-date). I couldn't figure out which CA bundle is actually used (I've tried to update the package supplied as well as system-installed OpenSSL bundle), but it can be overwritten on command line.
So first I've downloaded the DigiCert certs:
wget https://www.tbs-certificats.com/issuerdata/DigiCertGlobalRootCA.crt
(NOTE: I couldn't find an official download link on the DigiCert page, dunno why they're not offering it)
Then set the environment variable:
export WEBSOCKET_CLIENT_CA_BUNDLE=DigiCertGlobalRootCA.crt
And that worked for me:
$ python bot.py
Starter Bot connected and running!