NetBox DNS-over-TLS sync fails certificate validation against an internal CA

The short answer: neither REQUESTS_CA_BUNDLE nor a NetBox configuration setting is the primary lever here. The netbox-dns plugin performs DNS queries — including DNS-over-TLS on port 853 — through dnspython, not the Python requests library. dnspython builds its TLS context with ssl.create_default_context(), which validates against the operating system CA store (e.g., /etc/ssl/certs on Debian/Ubuntu), not the certifi bundle that requests uses. So the supported fix is to install your internal CA into the OS trust store of every environment running NetBox code.

What is confirmed vs. assumed

Confirmed by how the pieces work: REQUESTS_CA_BUNDLE only affects code paths using requests; setting it for a dnspython-based DoT connection changes nothing and can create false confidence. Assumed, and worth verifying against your installed plugin version: that netbox-dns does not expose its own CA-file or ssl_context option. Some plugin versions allow passing a custom context to dns.query.tls; check the plugin's documentation or source for your release before relying on the OS store alone.

Installing the CA

On a bare-metal or VM deployment:

cp internal-ca.pem /usr/local/share/ca-certificates/internal-ca.crt
update-ca-certificates

In a containerized deployment, the trust store lives inside the image — updating the Docker host has no effect. Add the CA in your image build or mount it and run update-ca-certificates at startup.

What to restart

Restart every process that could execute a sync:

• The web service (netbox / gunicorn or uwsgi), for any sync triggered inline from the UI or API.
• The RQ worker (netbox-rq), because queued background jobs — the usual path for DNS sync — run there. This is the one people forget.

Making the failure observable

A validation failure raises ssl.SSLCertVerificationError: certificate verify failed from dnspython, visible in the worker logs (journalctl -u netbox-rq or docker logs on the worker container) and in the RQ job result. A silent skip looks different: the job completes with no error but no DNS update occurs — so check both the job status and the plugin's log output, not just the absence of exceptions.

Verify before and after

openssl s_client -connect dns-server:853 -CAfile /path/to/internal-ca.pem
# expect: Verify return code: 0 (ok)

python -c "import dns.query, dns.message; \
  print(dns.query.tls(dns.message.make_query('example.com','A'), 'dns-server'))"

Run the Python check inside the same environment NetBox uses (same container/venv). If both succeed and the worker has been restarted, a triggered sync should complete without SSLCertVerificationError. Do not work around a remaining failure by disabling verification — that removes authentication of your DNS endpoint entirely.