Getting an SSLError

When I try to get push messaging to clients working I get the following error produced by OpenSSL probably.

Traceback (most recent call last):
  File "manage.py", line 22, in <module>
    execute_from_command_line(sys.argv)
  File "/usr/local/lib/python2.7/dist-packages/django/core/management/__init__.py", line 367, in execute_from_command_line
    utility.execute()
  File "/usr/local/lib/python2.7/dist-packages/django/core/management/__init__.py", line 359, in execute
    self.fetch_command(subcommand).run_from_argv(self.argv)
  File "/usr/local/lib/python2.7/dist-packages/django/core/management/base.py", line 294, in run_from_argv
    self.execute(*args, **cmd_options)
  File "/usr/local/lib/python2.7/dist-packages/django/core/management/base.py", line 345, in execute
    output = self.handle(*args, **options)
  File "/home/sem/scorpios-web/ScorpiosWeb/sc/management/commands/updateborrels.py", line 36, in handle
    webpush(subscription_info, data=str(message), vapid_private_key=vapid_path, vapid_claims=claims)
  File "/usr/local/lib/python2.7/dist-packages/pywebpush/__init__.py", line 356, in webpush
    curl=curl,
  File "/usr/local/lib/python2.7/dist-packages/pywebpush/__init__.py", line 288, in send
    headers=headers)
  File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 112, in post
    return request('post', url, data=data, json=json, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 58, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 513, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 623, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')],)",)

import os
from datetime import date
from pywebpush import webpush, WebPushException, WebPusher
from django.core.management import BaseCommand

from sc.models import PushSubscription
from sc.models.Drinks import DrinksDag, DrinksEvening


class Command(BaseCommand):
    help = 'Cronjob to automatically update this drinks evening'

    def handle(self, *args, **options):
        now = date.today()
        drinks_day = DrinksDay.get_is_drinks_date(now)
        if drinks_day:
            DrinksEvening(date=now).save()
            if not drinks_day.is_recurring():
                drinks_day.delete()

            devices = PushSubscription.objects.all()

            for device in devices:
                subscription_info = {'endpoint': device.endpoint, 'keys': {'auth': device.auth, 'p256dh': device.p256dh}}
                message_title = "Drinks evening update"
                message_body = "Good evening participant"

                message = {'title': message_title, 'body': message_body}
                try:
                    vapid_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), '../../../private_key.pem')
                    claims = {'sub': '[e-mail]', 'aud': 'https://fcm.googleapis.com'}

                    webpush(subscription_info, data=str(message), vapid_private_key=vapid_path, vapid_claims=claims)
                except WebPushException as e:
                    print("Unable to webpush: {}", repr(e))

My endpoint is in the form of https://fcm.googleapis.com/fcm/send/ { private endpoint }.

Do you have an idea what is going wrong, I have generated the private_key.pem with this vapid library (python) and I also generated the application server public key and pasted that in the javascript client side. Thanks

[jrconlin]

@lazzetta: Does the above TLS 1.2 fix not work for you? If not, what is the exact error you’re seeing? Also, what version of openssllib are you running?

[jrconlin]

Ok, that’s a very different error. That error is returned if the server you’re connecting to has an expired, mis-labeled, or otherwise invalid certificate. A quick search produced this link which might be useful.

I don’t know what server you’re trying to connect to, or the route you might be taking, but I’d probably investigate that first.