Error when authenticating: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

  • Resolved Marty

    (@bozzmedia)


    6 years, 9 months ago

    This is on inmotionhosting on PHP 5.3 (Working on getting that upgraded now)

    I receive this error after plugging in the auth code: 

    Count: 2

Last Error: 2018-02-08 21:30:46: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

GAPI Error:

    Found this thread that seems to indicate a PHP issue on a different host:
    https://www.ads-software.com/support/topic/wp-error-message-error14090086ssl/#post-9376188

    Anyone else run into this? Thanks!

Viewing 15 replies - 16 through 30 (of 37 total)

  • https://downloads.www.ads-software.com/plugin/google-analytics-dashboard-for-wp.5.1.2.5.zip

    Have anyone of you contacted his hosting provider as suggested here https://www.ads-software.com/support/topic/error-when-authenticating-ssl3_get_server_certificatecertificate-verify-failed/#post-9956129 ?

    I rolled back from my server, the old version works fine again.

    @deconf: I haven’t contacted my hosting provider, largely because my sense from reading the above is that the old version of the plugin works. This makes it sound, of course, as though the issue is in the plugn. Can you explain what’s different in the new version compared to the old that would require something to be different on the provider side in order to work?

    Yes,

    On the new installs we’re gradually switching to a custom authentication endpoint, following Google’s API guidelines.

    The thing is that it seems that there’s an issue with some hosting providers, some sites being unable to properly connect to the new endpoint over SSL (which is gadwp.deconf.com).

    Since all the websites I manage work just fine and so does the develop environment, I suspect that the issue is caused by outdated root certificates of your hosting providers. That’s why I’ve asked you to contact your hosting providers, because without being able to replicate the error, you can imagine I can’t fix it.

    Furthermore, we’ll need to follow the guidelines at some point, so rolling back the version is a quick fix, but not a permanent one. I guess users usually prefer that, which is not quite constructive.

    • This reply was modified 6 years, 9 months ago by Alin Marcu.

    Thanks for the followup, @deconf; I’ve contacted my provider. We’ll see what they say.

    The issue is in 5.2.

    Is it because SSL 3 is INSECURE? I am experiencing error (60) as well on two sites that SSLlabs report SSL 3 insecure.

    The hosting provider has pointed me back to you. Alin do you have a way I can get you a login and you can troubleshoot?

    Your hosting provider needs to check the PHP cURL connection over SSL to https://gadwp.deconf.com, from your server. Basically the error means that your server is unable to connect to https://gadwp.deconf.com. Since all SSL checks pass for the endpoint, and the plugin works just fine for all the sites I manage on different hosting providers, I suspect that the issue is on the client side (the server hosting your website, in this case).

    @timnethersgmailcom – That’s unrelated to your website certificate.

    Since you posted here, let’s just ignore the other thread and just write here the following feedback.

    • This reply was modified 6 years, 9 months ago by Alin Marcu.
    • This reply was modified 6 years, 9 months ago by Alin Marcu.
    • This reply was modified 6 years, 9 months ago by Alin Marcu.

    Host says, “Yes I was able to cURL successfully, 0< HTTP/1.1 200 OK”

    From our server:

    curl -v https://gadwp.deconf.com/
    * About to connect() to gadwp.deconf.com port 443 (#0)
    * Trying 138.197.55.78… connected
    * Connected to gadwp.deconf.com (138.197.55.78) port 443 (#0)
    * Initializing NSS with certpath: sql:/etc/pki/nssdb
    * CAfile: /etc/pki/tls/certs/ca-bundle.crt
    CApath: none
    * SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    * Server certificate:
    * subject: CN=gadwp.deconf.com
    * start date: Jan 13 11:09:19 2018 GMT
    * expire date: Apr 13 11:09:19 2018 GMT
    * common name: gadwp.deconf.com
    * issuer: CN=Let’s Encrypt Authority X3,O=Let’s Encrypt,C=US
    > GET / HTTP/1.1
    > User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
    > Host: gadwp.deconf.com
    > Accept: */*
    >
    < HTTP/1.1 200 OK
    < Server: nginx
    < Date: Fri, 09 Feb 2018 19:39:07 GMT
    < Content-Type: text/html
    < Content-Length: 0
    < Last-Modified: Mon, 11 Dec 2017 14:31:47 GMT
    < Connection: keep-alive
    < ETag: “5a2e96d3-0”
    < Accept-Ranges: bytes
    <
    * Connection #0 to host gadwp.deconf.com left intact
    * Closing connection #0

    That’s a cURL test, not a PHP cURL test over SSL.

    I’ve created a PHP script, to test exactly what we need to test: https://gist.github.com/deconf/dafa7b42182a6d0b5838260f7b510ea5.

    You can either uploaded to your server and run it yourself or ask your hosting provider to test it.

    Let me know the results.

    We ran your github code – this is the result from the test:

    HTTP/1.1 200 OK
    Server: nginx
    Date: Fri, 09 Feb 2018 19:56:16 GMT
    Content-Type: text/html
    Content-Length: 0
    Last-Modified: Mon, 11 Dec 2017 14:31:47 GMT
    Connection: keep-alive
    ETag: “5a2e96d3-0”
    Accept-Ranges: bytes

    Ran: php gadwpendpointtest.php (with your code from our server via ssh)

    Can you check your PHP error log and see if there are any warnings regarding cacert.pem or any related cURL warnings?

    • This reply was modified 6 years, 9 months ago by Alin Marcu.

    Same problem on 2 of my websites. The Google Analytics Dashboard for WP worked fine. Then I updated to 5.2 on both websites. Now the plugin has stopped working. Error as below. All previous updates worked fine. So there is a bug in this 5.2. A roll back would be good.

    Count: 50
    Last Error: 2018-02-09 21:34:03: (60) SSL certificate problem: unable to get local issuer certificate
    GAPI Error:

    Sorry Alin, we have our php logs disabled for a specific reason we cannot discuss.

    Thanks for the fix in 5.2.1.

    Any chance you want to detail the change?

Viewing 15 replies - 16 through 30 (of 37 total)
  • The topic ‘Error when authenticating: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed’ is closed to new replies.