title: Neo4j Bolt with TLS and self-signed certificate: Certificate Verify Failed
body: <p>I'm trying to set up Neo4j with TLS enabled for the Bolt Communication on CentOS7.  The server is currently installed as a system service.  I have generated a self-signed certificate and key:</p>
  
  <pre><code>sudo openssl genrsa -des3 -out /var/ssl/ca.key 4096``
  sudo openssl req -new -x509 -days 365 -key /var/ssl/ca.key -out /var/ssl/ca.crt
  sudo openssl genrsa -des3 -out /var/ssl/neo4j/serv.key 1024``
  sudo openssl req -new -key /var/ssl/neo4j/serv.key -out /var/ssl/neo4j/server.csr
  sudo openssl x509 -req -days 365 -in /var/ssl/neo4j/server.csr -CA /var/ssl/ca.crt -CAkey /var/ssl/ca.key -set_serial 01 -out /var/ssl/neo4j/server.crt
  sudo openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in /var/ssl/neo4j/serv.key -out /var/ssl/neo4j/server.key
  </code></pre>
  
  <p>Then, I copied the server.crt file into /var/ssl/trusted/neo4j (per Neo4j documentation) and added the following lines to my neo4j.conf:</p>
  
  <pre><code>dbms.ssl.policy.default.trusted_dir=/var/ssl/trusted/neo4j
  dbms.ssl.policy.default.public_certificate=/var/ssl/neo4j/server.crt
  dbms.ssl.policy.default.private_key=/var/ssl/neo4j/server.key
  dbms.ssl.policy.default.base_directory=/var/ssl/neo4j/
  dbms.connector.bolt.enabled=true
  dbms.connector.bolt.tls_level=REQUIRED
  </code></pre>
  
  <p>Finally, I added the ca.crt file to my system trusted certificate chain:</p>
  
  <pre><code>sudo cp /var/ssl/ca.crt /etc/pki/ca-trust/source/anchors/
  sudo update-ca-trust
  </code></pre>
  
  <p>and re-started the server, which comes up correctly.  However, I see the following error when trying to connect to the server with the Python client:</p>
  
  <pre><code>neo4j.exceptions.SecurityError: Failed to establish secure connection to '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:600)'
  </code></pre>
  
  <p>Python code which yields the error:</p>
  
  <pre><code>from neo4j.v1 import GraphDatabase
  from neo4j.v1 import TRUST_SYSTEM_CA_SIGNED_CERTIFICATES
  uri = "bolt://localhost:7687"
  driver = GraphDatabase.driver(uri, auth=("neo4j", "neo4j"), trust=TRUST_SYSTEM_CA_SIGNED_CERTIFICATES)
  </code></pre>
  
  <p>The CA Certificate should be added to my system trust chain, and other applications appear to be able to use it, however it appears as though the Neo4j client is unable to utilize it to verify the certificate returned from the server.  Does Neo4j only use this CA for the HTTPS endpoint, and not the TLS endpoint?  If so, how can I get the CA certificate for the Bolt endpoint into my system's trust chain?</p>