0

When I start a LSBInitScript as a service I get an SSL error because my script uses an SSL certificate to operate. The certificate lies in the same directory as the script itself. Why do I get the error when starting as service but when called in the console I don't?

SSL Error when starting the service:

ubuntu@ip-0-0-0-0:/heartbeat/deviceAPI$ sudo service deviceAPIClient.service start
 * DeviceAPIClient process is not running
 * Starting the process DeviceAPIClient                                                       Traceback (most recent call last):
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 120, in <module>
    main()
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 90, in main
    res = register(instanceName)
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 40, in register
    verify = 'cloud-server-ca-chain.pem'
  File "/usr/lib/python2.7/dist-packages/requests/api.py", line 88, in post
    return request('post', url, data=data, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 455, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 558, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/adapters.py", line 385, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 185090050] _ssl.c:344: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib

No error when I start the python script in the console:

ubuntu@ip-0-0-0-0:/heartbeat/deviceAPI$ /heartbeat/deviceAPI/DeviceAPIClient.py
Successful registering at cloud with 02-57-49-9c-d4
Using API endpoint https://mydomain
Update API endpoint (not used in Demo) https://mydomain.com/device-api
Sending Data to Cloud...

Update

As suggested by @mrc02_kr I've put the certificate cloud-server-ca-chain.pem into the folder /etc/ssl/certs. The error changed to a private key issue ``SSL_CTX_use_PrivateKey_file`:

ubuntu@ip-0-0-0-0:/heartbeat/deviceAPI$ sudo service deviceAPIClient.service start
 * DeviceAPIClient process is not running
 * Starting the process DeviceAPIClient                                                       Traceback (most recent call last):
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 120, in <module>
    main()
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 90, in main
    res = register(instanceName)
  File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 40, in register
    verify = '/etc/ssl/certs/cloud-server-ca-chain.pem'
  File "/usr/lib/python2.7/dist-packages/requests/api.py", line 88, in post
    return request('post', url, data=data, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 455, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 558, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/adapters.py", line 385, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 336265218] _ssl.c:355: error:140B0002:SSL routines:SSL_CTX_use_PrivateKey_file:system lib

You need to know that the script uses a private key to identify itself and the certificate of the cloud server to identify the server.

Do I need to store the private key in a special folder as well?

Update 2

The private key I can install in /etc/ssl/private and adapt the script accordingly.

1 Answer 1

1

Probably there is error during service startup, because you provided relative path to certificate. There should be absolute path to certificate file. When the system starts a service it doesn't change $PWD to the script location.

You can copy certificate to /etc/ssl/certs (according to this answer) and change:

verify = 'cloud-server-ca-chain.pem'

to:

verify = '/etc/ssl/certs/cloud-server-ca-chain.pem'

in your code (File "/heartbeat/deviceAPI/DeviceAPIClient.py", line 40)

You can also modify your init script to change directory to location of certificate and then start Python program.

3
  • Thanks for the reply, that my be. The file cloud-server-ca-chain.pem lies next to the python script and as stated in the question it works when I call the script without service. What would be the benefit to put it into /etc/ssl/certs ? Commented Sep 7, 2017 at 12:37
  • It's doesn't matter that certificate lies in the same location as script. Try change directory to / and then run script from shell using absolute path. It should invoke error. When system starts a service it doesn't change $PWD to script location.
    – mrc02_kr
    Commented Sep 7, 2017 at 12:42
  • Thank you the hint that the system won't change to $PWD to the script location helped me to understand the problem. Commented Sep 7, 2017 at 12:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .