EE certificate key too weak

[2br-2b]

Hello! I'm working on deploying a python docker container to Kubernetes, but I keep getting this error when the bot tries to connect to Discord:

aiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host discord.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak (_ssl.c:1006)')]

How can I give the docker container access to the wider internet? I don't believe it's a problem with the certs, since I have it running fine on ubuntu, unless there's a substantial difference between debian/ubuntu's networking. Since it's running in a docker container, however, I am guessing this isn't the issue?

Here are the files I'm using:

https://gist.github.com/2br-2b/19dc385de561adf0197c4e8468eb613a

My hope is to eventually host some websites on this cluster, so I need to make sure incoming and outgoing traffic can still be routed like that in the future. I'm still learning, however, so I haven't finished setting up nginx to handle that.

Thank you so much! Have a wonderful day!

[brandond]

This is not a network issue. This is Python complaining that the private key you're using is too small. Or perhaps it's complaining about the cert on the Discord server but I've never seen a key error for a remote server cert like that.

Either way this is a Python problem and not anything you're going to fix at a cluster level.

[2br-2b]

Hi, thanks for responding! I have tested the docker container and it works on the same system outside of k3s with the same environment variables. I don't believe it's a python issue; otherwise, I would experience the same error whether or not I was running it on a cluster. Do you have any recommendations for what I can do to further troubleshoot this issue?

[brandond]

Make sure that discord.com resolves to the right thing inside your pod? The only thing I can think of is that you're connecting to something else.

[2br-2b]

I played around with the settings and found that originally all traffic from apt was being forwarded to 192.168.1.1.

I ran kubectl edit configmap coredns -n kube-system and added extra dns entries like so:

forward . /etc/resolv.conf 1.1.1.1 1.0.0.1

Then restarted coredns:

kubectl rollout restart deployment coredns -n kube-system

Then killed/restarted the pod hosting it.

This now causes requests to go thru most of the time but they still get flagged every so often with the same message.