Connection Errors with Python-based Connector Tools (when running the workflow)

[DaveF]

Issue

When using a Python-based Connector Tool (SharePoint Files, Power BI, Tableau Output, OneDrive, Salesforce Input, Azure Data Lake, Box Input and Output, etc) a variety of errors can appear when the workflow is run (at runtime). The GUI in designer will typically connect as expected. 

If the user is receiving one of these errors below, please check the steps below 

Failed to authenticate.

Connection to platform was not successful.

Failed to connect to platform

Older versions of Connector Tools will have an error similar to this:

Error establishing connection: HTTP error: SSLError(MaxRetryError("HTTPSConnectionPool(host='test.salesforce.com', port=443): Max retries exceeded with url: /path/file (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)'),))",),)

Environment

• Alteryx Designer and Server
• Connector tools
  • Specific to Python-based Connectors

Cause

The root certificate of the host you are trying to connect to is not in the Python-based tool's keystore, so a trusted connection cannot be made. This can happen for a variety of reasons, the most common is when there is a private CA Certificate on the internal network (example Netskope), VPN type solutions (example Zscaler), or proxy with a private CA Certificate.  

Solution

1. In a browser, go to the login page for the Data source related to the Connector Tool you are trying to use
   • (e.g. Salesforce Input -> https://login.salesforce.com, Microsoft Based Connector -> https://login.microsoftonline.com, Box Tools -> https://account.box.com/login, etc)
   • For older versions of the connector tools, go to the host specified in the SSL Error. 
2. Click the lock icon next to the URL in the browser, then click Certificate. These steps may be different on different browsers.

3. On the Certification Path tab, click the Root Certificate, then click View Certificate
4. Then, click Details, then Copy to File

5. Proceed through the Wizard, choosing Base-64 encoded format.

6. On the File to Export window, set a path to export the certificate to. Select Next and then Finish to export the certificate. If the export was successful, you will get a message.
7. Navigate to the location where you exported the certificate, right-click the .cer file and open with Notepad. Copy all the contents.
8. Navigate to the cacert.pem file located in the tool's certifi folder. For newer versions of the tools, there will be three folders, and the cacert.pem is in the ".venv" folder.
   • Example for Admin installs: C:\ProgramData\Alteryx\Tools\TOOLNAME_vX.x.x\Lib\site-packages\certifi\cacert.pem
   • Example for Non-Admin installs: C:\Users\{USERNAME}\AppData\Roaming\Alteryx\Tools\TOOLNAME_vX.x.x\Lib\site-packages\certifi\cacert.pem
   • Example for newer version of Admin installs: C:\ProgramData\Alteryx\Tools\TOOLNAME_vX.x.x_venv\Lib\site-packages\certifi\cacert.pem
   • Example for newer version of Non-Admin installs: C:\Users\{USERNAME}\AppData\Roaming\Alteryx\Tools\TOOLNAME_vX.x.x_venv\Lib\site-packages\certifi\cacert.pem
9. Right-click the cacert.pem file, and open in Notepad.
10. At the very end of the file, add a new line, paste the previously copied contents from the exported certificate in step 7, then save the file.
    image.png

A Note About Certificate-Based Network Authentication

If you connect to an enterprise network, either by working in the office or connecting to a Proxy, it's possible that your PC is using similar certificate files to authenticate to the network itself. If that is the case, the certificate(s) used to authenticate to the network/proxy must also be pasted into the cacert.pem file in the certifi folder of the connector tool(s) you use.

This type of certificate is usually found in MMC on your local PC. However, MMC typically contains a lot of certificates. For this reason, we recommend reaching out to your IT/Network team to identify the necessary certificate files for connecting to your network.

Additional Resources

• certifi - PyPi

[diaslemuel]

I am able to do this till point 9. Point 10 isnt found at  the said path. Also searching for cacert.pem is found in other folders

[Stu1]

I am having the same issue as the previous comment in that I have neither the file path and the certificate is exported with a file type .cer rather than .pem.

When I create the above file path and put the certificate in there using the above instructions then I get the same error. I am specifically trying to import the python package 'pyeasyga', importing of numpy and pandas is fine but then I have them installed somewhere on my machine anyway.

Can anyone advise?

[joeGade]

@DaveF  Did exactly as per provided solution ,still not working . 

[joeGade]

@DaveF 

Found one more solution. Looks like it’s a Proxy server issue in enterprise env's . I tested and its working  .

1.        Open your Salesforce input or output install location or look for sf_proxy.py in your C:/Drive

• Example for Admin installs: C:\ProgramData\Alteryx\Tools\SalesforceInput_v4.0.0\engine\sf_proxy.py
• Example for Non-Admin installs: C:\Users\{USERNAME}\AppData\Roaming\Alteryx\Tools\ SalesforceInput_v4.0.0\engine\sf_proxy.py

version number may be different based on what you installed 

2.        LOOK/search for this text

else:

os.environ['HTTP_PROXY'] = ''

os.environ['HTTPS_PROXY'] = ''

3)     put your Proxy host name in  between  quotes FOR HTTP AND HTTPS LIKE  'http://proxy.yourcompany.com:80'

See image below.

See image below . 

Solution based out of https://stackoverflow.com/questions/47960157/sslerror-httpsconnectionpoolhost-www-quandl-com-port-44...

[WeiJianWEE]

Thanks for the solution.

With regards to point 10, the certifi folder and cacert.pem are found in

c:\program files\alteryx\bin\miniconda3\pythontool_venv\lib\site-packages (0.5.5) instead.

Works well for me. 

[chardvinas]

If exporting and adding the Root certificate into cacert.pem doesn't work. Try exporting all the certificates in the hierarchy (from the Root to the last child node) and add them all in cacert.pem. It worked for me. 

[Alejandro_Murillo]

Hi everyone,

I followed the steps provided by DaveF, but I'm still getting the same error "Connection to Platform was not successful" while using the Tableau Output tool.

Do you have any other suggestions?

Thanks

[Franz]

I'm affraid changing anything in a registry is strictly forbidden in our enterprise environment. This option will not fly here..

[Jamaica_Caparros]

I am having a 'Maximum recursion depth exceeded' error when I use the sharepoint file input tool. can you please help on how I can modify the python code to adjust the limit?

[Franz]

G'Day, Jamaica_Caparros, 

I wish I could help but this is something for Alteryx support. Depending on the Sharepoint connector version used in your case there might be configuration options. Code changes is something that may be off-limits..But future versions of the connector could be made to fix your issue.

Thx.

[Deba93]

Hello everyone,

The tableau environment I am trying to connect isn't secure (doesn't have https but http), how will I go ahead with this? Any idea or thoughts on this.

[andreadelucacb]

hi all, 

I got this working, but was a little different from others experience outline above. So, this might be your case. 

my certificate file was located here:

hope this helps some other folks!

Andrea

[JirkaD]

I used these steps with my customer and it worked only for newly created workflows. To fix existing ones, we needed to remove the failing Tool, copy all the remaining content to an empty workflow, add a fresh copy of the Tool, and configure it accordingly. This helped to solve the issue completely.