[1.2.0] Incorrect SSL certificate warning Astraweb

[buriedpast]

I'm experiencing a similar problem. Using sabnzbd on a 64-bit Windows 7 machine. Upgraded this morning from 1.1.1 to 1.2.0 and started getting the invalid security certificate warning when attempting to access Astraweb. When I used the test button to check the server, I received a similar warning.

Reverted back to 1.1.1 and I was able to test the server successfully. Apparently, 1.2.0 is doing something not done in the prior version. Any suggestions?

Should add that I'm attempting to access "ssl-us.astraweb.com". A check on Digicert shows checkmarks on all sections and states the certificate is successfully installed.

If not, I'll just wait until a subsequent version comes out or Astraweb corrects the problem if it exists on their end. At least I'll be able to download in the interim.

[sander]

I've split your post into a seperate topic: your post is about a newsserver, not a indexer. Different causes, so different topic.

What is the exact message you get?

Connecting does work on my SABnzbd:

Code: Select all

2017-01-24 18:19:13,270::INFO::[newswrapper:251] -1@ssl-us.astraweb.com: Connected using TLSv1 (AES256-SHA)
2017-01-24 18:19:31,864::INFO::[newswrapper:251] -1@ssl-us.astraweb.com: Connected using TLSv1.2 (ECDHE-RSA-AES256-GCM-SHA384)

Do you see those lines in your sabnzbd.log?

What happens if you connect to newsreader.eweka.nl with SSL?

[buriedpast]

First, sorry about hijacking the previous topic. I've played around and I can test the server if I disable certificate verification, the following message is received if testing with either default or strict being selected.

Code: Select all

 [Errno 10061] Failed to connect: Server ssl-us.astraweb.com uses an untrusted certificate [[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)] -1@ssl-us.astraweb.com:563

I'm not able to find the results of my most recent testing in the log file, but I have found an earlier entry in the log that shows:

Code: Select all

2017-01-24 10:28:47,545::INFO::[downloader:477] 5@ssl.astraweb.com: Initiating connection
2017-01-24 10:28:47,746::INFO::[newswrapper:290] Failed to connect: Server ssl-us.astraweb.com uses an untrusted certificate [[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)] 5@216.151.153.158:563

Is there a switch I need to set to enable more complete logging?

And I confess, I'm clueless as to how to connect to the newsreader ... I'll research further and get back.

[sander]

What happens if you fill out as newsserver in SABnzbd (just like you did for astraweb): newsreader.eweka.nl, with SSL, and then click on Test Server.

(I'm asking you this to find out if your SSL is working at all)

Is there a switch I need to set to enable more complete logging?

Not needed right now.

Does your logging show lines like this (with "Quickest"):

Code: Select all

2017-01-24 19:28:00,239::INFO::[happyeyeballs:138] Quickest IP address for ssl-us.astraweb.com (port 563, ssl True, preferipv6 True) is 207.246.207.139

2017-01-24 19:28:00,577::INFO::[happyeyeballs:138] Quickest IP address for ssl.astraweb.com (port 563, ssl True, preferipv6 True) is 193.202.122.65

[buriedpast]

God, I feel stupid ...

If I'm setting up under the servers tab, I assume I need to obtain a user name and password for eweka? Barring having to do that (and providing a payment method), I did check another newsserver I use, reader.xsusenet.com, and it tests successfully with either Default or Strict selected.

And I have some logs like that, but they're from earlier this morning. Shown is the most recent. Nothing shows in the log file since then, and that's after restarting Sabnzbd several times. Is it correct to assume a connection won't be logged when testing and will only show when something pushes from Sonarr?

Code: Select all

2017-01-24 10:28:21,183::INFO::[happyeyeballs:138] Quickest IP address for ssl-us.astraweb.com (port 563, ssl True, preferipv6 True) is 216.151.153.158

[sander]

If I'm setting up under the servers tab, I assume I need to obtain a user name and password for eweka?

No, not for testing the SSL/TLS.

[buriedpast]

After thinking about it a bit more, I retrieved a nzb file and forced a download. When I enable Default, I get the following:

Code: Select all

2017-01-24 15:05:40,664::INFO::[happyeyeballs:138] Quickest IP address for ssl-us.astraweb.com (port 563, ssl True, preferipv6 True) is 207.246.207.21
2017-01-24 15:05:40,671::INFO::[downloader:477] 2@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,676::INFO::[downloader:477] 3@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,683::INFO::[downloader:477] 4@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,688::INFO::[downloader:477] 5@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,696::INFO::[downloader:477] 6@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,701::INFO::[downloader:477] 7@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,707::INFO::[downloader:477] 8@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,713::INFO::[downloader:477] 9@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,719::INFO::[downloader:477] 10@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,726::INFO::[downloader:477] 11@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,730::INFO::[downloader:477] 12@ssl.astraweb.com: Initiating connection
2017-01-24 15:05:40,878::ERROR::[newswrapper:282] Server ssl-us.astraweb.com uses an untrusted certificate [[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)]
2017-01-24 15:05:40,878::INFO::[newswrapper:290] Failed to connect: Server ssl-us.astraweb.com uses an untrusted certificate [[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)] 2@207.246.207.21:563

I guess all of the initiating connection statements are a result of me setting 12 connections for the server.

[buriedpast]

When I set up newsreader.eweka.nl, I input that address under "Host", enter "563" for "Port" and check the box next to "SSL". Click "Test Server" and I get the error " Server requires username and password."

[sander]

When I set up newsreader.eweka.nl, I input that address under "Host", enter "563" for "Port" and check the box next to "SSL". Click "Test Server" and I get the error " Server requires username and password."

OK, so the SSL/TSL is working. Good.

[sander]

Code: Select all

2017-01-24 15:05:40,664::INFO::[happyeyeballs:138] Quickest IP address for ssl-us.astraweb.com (port 563, ssl True, preferipv6 True) is 207.246.207.21
2017-01-24 15:05:40,671::INFO::[downloader:477] 2@ssl.astraweb.com: Initiating connection

ssl-us.astraweb.com and ssl.astraweb.com ... how is that possible? Have you filled out one server, or two, or more?

[buriedpast]

Only one, but there may be an artifact in there from some entry I made a long time ago. I'll set up another server using ssl-us and THEN delete the questionable server. Fingers crossed.

No joy ...

Code: Select all

2017-01-24 15:40:14,269::INFO::[happyeyeballs:138] Quickest IP address for ssl-us.astraweb.com (port 563, ssl True, preferipv6 True) is 207.246.207.158
2017-01-24 15:40:14,293::INFO::[downloader:477] 2@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,305::INFO::[downloader:477] 3@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,319::INFO::[downloader:477] 4@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,325::INFO::[downloader:477] 5@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,332::INFO::[downloader:477] 6@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,338::INFO::[downloader:477] 7@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,345::INFO::[downloader:477] 8@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,352::INFO::[downloader:477] 9@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,358::INFO::[downloader:477] 10@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,365::INFO::[downloader:477] 11@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,372::INFO::[downloader:477] 12@ssl-us.astraweb.com: Initiating connection
2017-01-24 15:40:14,473::ERROR::[newswrapper:282] Server ssl-us.astraweb.com uses an untrusted certificate [[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)]
2017-01-24 15:40:14,474::INFO::[newswrapper:290] Failed to connect: Server ssl-us.astraweb.com uses an untrusted certificate [[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)] 1@207.246.207.158:563

Looks like that was the case. But even when I eliminate the issue with two different servers, sabnzbd still sees an untrusted certificate.

[buriedpast]

Sander, you've been great in putting time into this issue. As a last ditch effort to figure out what's wrong, I completely uninstalled sabnzbd ... made sure both the \program files (x86) and users\appdata\local folders were fully deleted and rebooted the computer. Did a fresh install of sabnzbd 1.2.0 and entered the ssl-us.astraweb.com server, user name and password in the wizard when starting up. Just my luck, still got the invalid certificate message when testing the server entry.

Thought that maybe something related to whatever caused my log to show two different servers might be the culprit, which is why I clean installed and didn't restore the sabnzbd.ini file when testing. Oh well, restored my .ini file and I'm back to where I was. Thanks again for your effort.

And to compound the issue, I remote desktopped into a friends computer and tested their ssl-us.astraweb.com server entry ... it passes with both default and strict settings applied. Go figure ...

[safihre]

It has something to do with the certificate storage on your specific computer.
For some reason it doesn't like the certificate for Astraweb or one of the authorities that signed the certificate.
This could maybe be due to some security software you use?

[buriedpast]

This is a fairly recent clean install of Windows 7 Professional. The only security software installed is Symantec Endpoint Protection. I'll try disabling the anti-virus program and also updating certificate entries in Windows to see if that resolves the problem. I'll post results when I know something. Thanks again.

Update -
No luck there either. Performed Windows Update so that there are no outstanding updates needed and disabled Windows Defender and Symantec Endpoint Protection (yes, they were both running - my bad). Tried testing again with Default Certificate Verification and no luck, still got an error. I'm now back running only SEP, Defender is deactivated.

I'm out of options here. Barring any suggestions on how to check further, I'm faced with either a complete rebuild of my system or waiting for the computers electrons to realign and it fixing itself sometime in the future. I think I'll opt for the latter. Thanks again.

[timoj]

Try refreshing your HTTPS Certificate and HTTPS Key found under config/general, both requiring a reboot. I had the exact same problem and this resolved it.