<p>I'm currently running Sentry in Kubernetes with auto certificate generation using let's encrypt and cert-manager. When Sentry attempts to send an error to the sentry server, the following error is thrown: </p>

<pre><code>urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)&gt; (url: https://example.host.com/)
</code></pre>

<p>I have verified that the correct python packages for 2.7.15 have been installed. Packages include <code>certifi</code>, <code>urllib2</code> along with the dependencies. </p>

<p>Turning off TLS Verification works, but this is a last resort. Security is very important even though this is an internally hosted service. </p>

Norman Shipman
<p>It has been my experience that even the most up-to-date <code>ca-certificates</code> packages sometimes don't contain all <a href="https://letsencrypt.org/certificates/" rel="nofollow noreferrer">3 Let's Encrypt certificates</a>. The solution(?) is to download them into the "user-controlled" certificate directory (often <code>/usr/local/share/ca-certificates</code>) and then re-run <a href="http://manpages.ubuntu.com/manpages/bionic/en/man8/update-ca-certificates.8.html" rel="nofollow noreferrer"><code>update-ca-certificates</code></a>:</p>

<pre class="lang-sh prettyprint-override"><code># the first one very likely is already in your chain,
# but including it here won't hurt anything
for i in isrgrootx1.pem.txt lets-encrypt-x3-cross-signed.pem.txt letsencryptauthorityx3.pem.txt
do
    curl -vko /usr/local/share/ca-certificates/`basename $i .pem.txt`.crt \
        https://letsencrypt.org/certs/$i
done
update-ca-certificates
</code></pre>

<p>The ideal outcome would be to do that process for every Node in your cluster, and then volume mount the <em>actual</em> ssl directory into the containers, so every container benefits from the latest certificates. However, I would guess just doing it in the affected containers could work, too.</p>
