Repository: DataDog/dd-agent

Issue:
sudo service datadog-agent info throwing CertificateError despite agent reporting just fine
We run all our Datadog agents behind an internal proxy. This appears to be working normally as they are reporting data just fine. 

However, when I run:

    sudo service datadog-agent info

I get the following exception:

    2017-04-11 21:06:29,353 | ERROR | dd.forwarder | checks.check_status(check_status.py:140) | Unable to validate API Key
    Traceback (most recent call last):
      File "/opt/datadog-agent/agent/checks/check_status.py", line 130, in validate_api_key
        params={'api_key': config.get('api_key')}, proxies=request_proxy, timeout=3)
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/requests/api.py", line 70, in get
        return request('get', url, params=params, **kwargs)
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/requests/api.py", line 56, in request
        return session.request(method=method, url=url, **kwargs)
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/requests/sessions.py", line 475, in request
        resp = self.send(prep, **send_kwargs)
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/requests/sessions.py", line 596, in send
        r = adapter.send(request, **kwargs)
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/requests/adapters.py", line 423, in send
        timeout=timeout
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 595, in urlopen
        chunked=chunked)
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 352, in _make_request
        self._validate_conn(conn)
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 831, in _validate_conn
        conn.connect()
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/requests/packages/urllib3/connection.py", line 305, in connect
        _match_hostname(cert, self.assert_hostname or hostname)
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/requests/packages/urllib3/connection.py", line 313, in _match_hostname
        match_hostname(cert, asserted_hostname)
      File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/backports/ssl_match_hostname/__init__.py", line 147, in match_hostname
        % (hostname, ', '.join(map(repr, dnsnames))))
    CertificateError: hostname 'our.proxy.net' doesn't match either of '*.agent.datadoghq.com', 'agent.datadoghq.com'

I just wasted half an hour trying to figure out if this was a valid problem or just a cosmetic error. It appears, as best I can tell, to be only cosmetic. 

Rather than throwing an exception, could you instead check the value for `skip_ssl_validation` and if set to `yes` then swallow the exception? 

Additionally, if we are clearly running a proxy in the `dd_url` field than make the unable-to-validate-api-key message a little more detailed so it's easier to understand why:

    Unable to validate API key. You appear to be running a proxy because the value of
    dd_url (set in /etc/dd-agent/datadog.conf) doesn't match [expected value].

This error is appearing on agent version 5.12.


Discussion:
Any update on this? 
Hi @jeffwidman, indeed it's probably an exception we can actually swallow, or maybe avoid it altogether by passing the corresponding flag to the `requests`  call (can't remember right now for sure, but I think that was the "right" way to do it).  

Resolving patch:
diff --git a/checks/check_status.py b/checks/check_status.py
--- a/checks/check_status.py
+++ b/checks/check_status.py
@@ -127,7 +127,8 @@ def validate_api_key(config):
         if proxy:
             request_proxy = {'https': "http://{user}:{password}@{host}:{port}".format(**proxy)}
         r = requests.get("%s/api/v1/validate" % config['dd_url'].rstrip('/'),
-            params={'api_key': config.get('api_key')}, proxies=request_proxy, timeout=3)
+            params={'api_key': config.get('api_key')}, proxies=request_proxy,
+            timeout=3, verify=(not config.get('skip_ssl_validation', False)))
 
         if r.status_code == 403:
             return "API Key is invalid"


Test patch: