Unable to connect Airflow to a Trino over https with a self signed certificate

[soenkeliebau]

I am trying to set up a Trino Connection from an Airflow, with the connection being https and requiring username and password.

The issue I seem to be encountering is that I have a self signed certificate on the Trino side, so need to skip ssl verification, or provide a ca cert to be trusted.

Looking through the docs and code I couldn't find any options to configure a CA, so tried disabling ssl verification.

The code suggested to me that {"verify":false} in the extra field should do the trick, but I still get

Max retries exceeded with url: /v1/statement (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain

Am I missing something obvious here?

[potiuk]

Looking at the docs https://airflow.apache.org/docs/apache-airflow-providers-trino/stable/connections.html and Hook code you should set cert paths. and set "auth" = "cert" in extra as well. (if in doubt and miss it in the docs - we are open-source project so you can always look at the Hook source code, that's the beauty of using free and open-source project).

Not sure about verify but I think it is to make a connection and check that the host is reachable, not whether to verify certs (Again - just by looking at the code, no idea if this is good interpretation).

And once you make it work, updates to the docstrings/documentation to clarify those points are more than welcome ! It's as easy as "Suggest a change on this page" and you will be able to clarify what you found for others (and give back to the community for the free software you have) :)

[nchao-ciitizen]

In case others run into this issue, the solution from @potiuk is not quite right.

The verify parameter can actually take as an input a string that is the path to your cert. In the trino provider source code, you will find that the parameter gets passed to trino.dbapi.connect, which actually can accept a cert path string as an input: https://github.com/trinodb/trino-python-client?tab=readme-ov-file#self-signed-certificates

So simply use {"verify": "<path/to/your/self-signed-cert>"} to use a self-signed cert or any cert backed by a CA that is not commonly recognized.