httpcore.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Subject Key Identifier (_ssl.c:1018)

[yyzhou0811]

Self-Hosted Version

25.6.1

CPU Architecture

x86_64

Docker Version

28.1.1

Docker Compose Version

2.37.1

Machine Specification

• My system meets the minimum system requirements of Sentry

Steps to Reproduce

I encountered an SSL certificate verification error when running the gosu sentry sentry cleanup --days 30 command in the sentry-self-hosted-sentry-cleanup-1 container. The error message is as follows

httpcore.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Subject Key Identifier (_ssl.c:1018)
02:21:55 [ERROR] sentry_sdk.errors: Internal error in sentry_sdk

Expected Result

The command should execute successfully without any SSL certificate errors.
Old FileBlob references should be cleaned up as expected.
All pending events should be sent normally.

Actual Result

Cleaning up unused FileBlob references
File Blobs [####################################] 100%
Sentry is attempting to send 1 pending events
Waiting up to 2 seconds
Press Ctrl-C to quit
Traceback (most recent call last):
File "/.venv/lib/python3.13/site-packages/httpcore/_exceptions.py", line 10, in map_exceptions
yield
File "/.venv/lib/python3.13/site-packages/httpcore/_backends/sync.py", line 168, in start_tls
raise exc
File "/.venv/lib/python3.13/site-packages/httpcore/_backends/sync.py", line 163, in start_tls
sock = ssl_context.wrap_socket(
self._sock, server_hostname=server_hostname
)
File "/.venv/lib/python3.13/site-packages/pip/_vendor/truststore/_api.py", line 96, in wrap_socket
ssl_sock = self._ctx.wrap_socket(
sock,
...<4 lines>...
session=session,
)
File "/usr/local/lib/python3.13/ssl.py", line 455, in wrap_socket
return self.sslsocket_class._create(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
sock=sock,
^^^^^^^^^^
...<5 lines>...
session=session
^^^^^^^^^^^^^^^
)
^
File "/usr/local/lib/python3.13/ssl.py", line 1076, in _create
self.do_handshake()
~~~~~~~~~~~~~~~~~^^
File "/usr/local/lib/python3.13/ssl.py", line 1372, in do_handshake
self._sslobj.do_handshake()
~~~~~~~~~~~~~~~~~~~~~~~~~^^
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Subject Key Identifier (_ssl.c:1018)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/.venv/lib/python3.13/site-packages/sentry_sdk/transport.py", line 565, in send_envelope_wrapper
self._send_envelope(envelope)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
File "/.venv/lib/python3.13/site-packages/sentry_sdk/transport.py", line 499, in _send_envelope
self._send_request(
~~~~~~~~~~~~~~~~~~^
body.getvalue(),
^^^^^^^^^^^^^^^^
...<2 lines>...
envelope=envelope,
^^^^^^^^^^^^^^^^^^
)
^
File "/usr/src/sentry/src/sentry/utils/sdk.py", line 274, in patched_send_request
return _send_request(*args, **kwargs)
File "/.venv/lib/python3.13/site-packages/sentry_sdk/transport.py", line 351, in _send_request
response = self._request(
"POST",
...<2 lines>...
headers,
)
File "/.venv/lib/python3.13/site-packages/sentry_sdk/transport.py", line 768, in _request
response = self._pool.request(
method,
...<10 lines>...
},
)
File "/.venv/lib/python3.13/site-packages/httpcore/_sync/interfaces.py", line 43, in request
response = self.handle_request(request)
File "/.venv/lib/python3.13/site-packages/httpcore/_sync/connection_pool.py", line 268, in handle_request
raise exc
File "/.venv/lib/python3.13/site-packages/httpcore/_sync/connection_pool.py", line 251, in handle_request
response = connection.handle_request(request)
File "/.venv/lib/python3.13/site-packages/httpcore/_sync/connection.py", line 99, in handle_request
raise exc
File "/.venv/lib/python3.13/site-packages/httpcore/_sync/connection.py", line 76, in handle_request
stream = self._connect(request)
File "/.venv/lib/python3.13/site-packages/httpcore/_sync/connection.py", line 156, in _connect
stream = stream.start_tls(**kwargs)
File "/.venv/lib/python3.13/site-packages/httpcore/_backends/sync.py", line 152, in start_tls
with map_exceptions(exc_map):
~~~~~~~~~~~~~~^^^^^^^^^
File "/usr/local/lib/python3.13/contextlib.py", line 162, in exit
self.gen.throw(value)
~~~~~~~~~~~~~~^^^^^^^
File "/.venv/lib/python3.13/site-packages/httpcore/_exceptions.py", line 14, in map_exceptions
raise to_exc(exc) from exc
httpcore.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Subject Key Identifier (_ssl.c:1018)
02:21:55 [ERROR] sentry_sdk.errors: Internal error in sentry_sdk

Event ID

No response

[aldy505]

Do you by any chance, set up your sentry containers with TLS enabled? If so, where do you put your TLS termination?

[yyzhou0811]

Do you by any chance, set up your sentry containers with TLS enabled? If so, where do you put your TLS termination?

I’m not sure where TLS is enabled. I'm using the default configuration from docker-compose. Could you guide me on how to check or configure TLS in this setup? Thanks!

[aldy505]

Do you by any chance, set up your sentry containers with TLS enabled? If so, where do you put your TLS termination?

I’m not sure where TLS is enabled. I'm using the default configuration from docker-compose. Could you guide me on how to check or configure TLS in this setup? Thanks!

Did you put a reverse proxy in front of your whole Sentry installation, and did you put a TLS certificate so that you are accessing it with https?

How did you install your Sentry? The recommended approach is this:

git clone https://github.com/getsentry/self-hosted.git
cd self-hosted
git checkout 25.6.1
./install.sh
docker compose up -d --wait