For a very long time, I'm using nvpy as a SimpleNote client on my Debian systems. Recently, one of my systems stopped to sync with the web service abruptly. I thought about API changes or something similar, however when I tried to use the same application (same version) on other systems, everything is working perfectly.

I debugged the problem on my problematic system and found out the system is getting a SSL: CERTIFICATE_VERIFY_FAILED error while trying to communicate with the server. I tried to understand further, but I failed. Currently my knowledge about the problem is as follows:

  • System certificates are OK. Firefox can verify the SSL certificates wihtout any problems.
  • I've installed the python-certifi and python3-certifi packages, hence python can see the certificates.
  • Application is working fine on other two Debian systems. All are running Debian Testing and they're always up to date.
  • An independent installation of the software gets the same error, so the application is not corrupted, or stores something under its installation directory.

I'm missing something about python or some cache, but I was unable to find anything sensible.

Update 1:

Below are the requested information and results of my audit of three systems and the web application:

  • The application resides in https://simple-note.appspot.com/. An example REST endpoint is https://simple-note.appspot.com/api/login. Whole domain is signed by Google's CA authority G2, with a certificate until December 6, 2017. It's an 2048 Bit PKCS #1 SHA-256 w/ RSA.
  • When I survey my three systems, one system is completely same with the problematic system (checked /etc/ssl/certs with md5deep). One system has extra certs, but one of the normal, functioning system lacks these, so that's not the problem.
  • All systems have python-certifi package installed.

Result: All three systems have identical certificates, one have extra. Extra certificates doesn't matter, because one system with no-extra certificates have a functioning nvPY installation.

 Update 2:

It seems like the Python's urllib2 cannot find the certificates by itself. When I supply a custom context with the capath provided by certifi.where(), things return the normal. The strange part is, other systems don't need this custom context. I will try to find differences between the working and non-working systems next.

Update 3:

I've written a small tool which connects to arbitary URLs and tests connectivity with urllib2 and strangely, the tool works correctly. More strangely, transplanting the problematic code to my tool creates no problems (it works as it should). The problem is in nvPY's codebase. Will open a bug report and, will work from this point.

  • It it is not expired, the system in question does not know the CA/intermediate certificate. – Rui F Ribeiro Oct 1 '17 at 12:34
  • @RuiFRibeiro, thanks for the answer. Debian's CA certificate set is installed. python-certifi returns Debian's CA certificate collection. Also the relevant packages are the same versions in all three systems. This is why I'm confused. However, I will double check it again. – bayindirh Oct 1 '17 at 12:36
  • Please also add the numbers of bits of the key. – Rui F Ribeiro Oct 1 '17 at 13:47
  • @RuiFRibeiro I've added the information you requested. – bayindirh Oct 2 '17 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.