0

When I start a LSBInitScript as a service I get an SSL error because my script uses an SSL certificate to operate. The certificate lies in the same directory as the script itself. Why do I get the error when starting as service but when called in the console I don't?

SSL Error when starting the service:

ubuntu@ip-0-0-0-0:/heartbeat/deviceAPI$ sudo service deviceAPIClient.service start
 * DeviceAPIClient process is not running
 * Starting the process DeviceAPIClient                                                       Traceback (most recent call last):
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 120, in <module>
    main()
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 90, in main
    res = register(instanceName)
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 40, in register
    verify = 'cloud-server-ca-chain.pem'
  File "/usr/lib/python2.7/dist-packages/requests/api.py", line 88, in post
    return request('post', url, data=data, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 455, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 558, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/adapters.py", line 385, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 185090050] _ssl.c:344: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib

No error when I start the python script in the console:

ubuntu@ip-0-0-0-0:/heartbeat/deviceAPI$ /heartbeat/deviceAPI/DeviceAPIClient.py
Successful registering at cloud with 02-57-49-9c-d4
Using API endpoint https://mydomain
Update API endpoint (not used in Demo) https://mydomain.com/device-api
Sending Data to Cloud...

Update

As suggested by @mrc02_kr I've put the certificate cloud-server-ca-chain.pem into the folder /etc/ssl/certs. The error changed to a private key issue ``SSL_CTX_use_PrivateKey_file`:

ubuntu@ip-0-0-0-0:/heartbeat/deviceAPI$ sudo service deviceAPIClient.service start
 * DeviceAPIClient process is not running
 * Starting the process DeviceAPIClient                                                       Traceback (most recent call last):
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 120, in <module>
    main()
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 90, in main
    res = register(instanceName)
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 40, in register
    verify = '/etc/ssl/certs/cloud-server-ca-chain.pem'
  File "/usr/lib/python2.7/dist-packages/requests/api.py", line 88, in post
    return request('post', url, data=data, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 455, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 558, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/adapters.py", line 385, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 336265218] _ssl.c:355: error:140B0002:SSL routines:SSL_CTX_use_PrivateKey_file:system lib

You need to know that the script uses a private key to identify itself and the certificate of the cloud server to identify the server.

Do I need to store the private key in a special folder as well?

Update 2

The private key I can install in /etc/ssl/private and adapt the script accordingly.

1

Probably there is error during service startup, because you provided relative path to certificate. There should be absolute path to certificate file. When the system starts a service it doesn't change $PWD to the script location.

You can copy certificate to /etc/ssl/certs (according to this answer) and change:

verify = 'cloud-server-ca-chain.pem'

to:

verify = '/etc/ssl/certs/cloud-server-ca-chain.pem'

in your code (File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 40)

You can also modify your init script to change directory to location of certificate and then start Python program.

  • Thanks for the reply, that my be. The file cloud-server-ca-chain.pem lies next to the python script and as stated in the question it works when I call the script without service. What would be the benefit to put it into /etc/ssl/certs ? – Bruno Bieri Sep 7 '17 at 12:37
  • It's doesn't matter that certificate lies in the same location as script. Try change directory to / and then run script from shell using absolute path. It should invoke error. When system starts a service it doesn't change $PWD to script location. – mrc02_kr Sep 7 '17 at 12:42
  • Thank you the hint that the system won't change to $PWD to the script location helped me to understand the problem. – Bruno Bieri Sep 7 '17 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.