For a very long time, I'm using nvpy as a SimpleNote client on my Debian systems. Recently, one of my systems stopped to sync with the web service abruptly. I thought about API changes or something similar, however when I tried to use the same application (same version) on other systems, everything is working perfectly.
I debugged the problem on my problematic system and found out the system is getting a
SSL: CERTIFICATE_VERIFY_FAILED error while trying to communicate with the server. I tried to understand further, but I failed. Currently my knowledge about the problem is as follows:
- System certificates are OK. Firefox can verify the SSL certificates wihtout any problems.
- I've installed the
python3-certifipackages, hence python can see the certificates.
- Application is working fine on other two Debian systems. All are running Debian Testing and they're always up to date.
- An independent installation of the software gets the same error, so the application is not corrupted, or stores something under its installation directory.
I'm missing something about python or some cache, but I was unable to find anything sensible.
Below are the requested information and results of my audit of three systems and the web application:
- The application resides in https://simple-note.appspot.com/. An example REST endpoint is https://simple-note.appspot.com/api/login. Whole domain is signed by Google's CA authority G2, with a certificate until December 6, 2017. It's an 2048 Bit PKCS #1 SHA-256 w/ RSA.
- When I survey my three systems, one system is completely same with the problematic system (checked
md5deep). One system has extra certs, but one of the normal, functioning system lacks these, so that's not the problem.
- All systems have
Result: All three systems have identical certificates, one have extra. Extra certificates doesn't matter, because one system with no-extra certificates have a functioning
It seems like the Python's
urllib2 cannot find the certificates by itself. When I supply a custom context with the
capath provided by
certifi.where(), things return the normal. The strange part is, other systems don't need this custom context. I will try to find differences between the working and non-working systems next.
I've written a small tool which connects to arbitary URLs and tests connectivity with
urllib2 and strangely, the tool works correctly. More strangely, transplanting the problematic code to my tool creates no problems (it works as it should). The problem is in
nvPY's codebase. Will open a bug report and, will work from this point.