Certificate verification error "bad handshake"

[weinsteing]

Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1612, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1598, in dispatch_request
return self.view_functionsrule.endpoint
File "/root/photoframe/routes/baseroute.py", line 62, in call
return self.handle(self.app, **kwargs)
File "/root/photoframe/routes/oauthlink.py", line 44, in handle
return self.redirect(self.servicemgr.oauthStart(kwargs['service']))
File "/root/photoframe/modules/servicemanager.py", line 199, in oauthStart
return svc.startOAuth()
File "/root/photoframe/services/base.py", line 274, in startOAuth
return self._OAUTH.initiate()
File "/root/photoframe/modules/oauth.py", line 122, in initiate
self.rid = self.getRedirectId()
File "/root/photoframe/modules/oauth.py", line 118, in getRedirectId
r = requests.get('%s/?register' % self.ridURI)
File "/usr/lib/python2.7/dist-packages/requests/api.py", line 70, in get
return request('get', url, params=params, **kwargs)
File "/usr/lib/python2.7/dist-packages/requests/api.py", line 56, in request
return session.request(method=method, url=url, **kwargs)
File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 488, in request
resp = self.send(prep, **send_kwargs)
File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 609, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python2.7/dist-packages/requests/adapters.py", line 497, in send
raise SSLError(e, request=request)
SSLError: ("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",)

[mrworf]

This can happen when the local time of the device is off. Does your pi have the current time?

[louislemas]

I am receiving the exact same error when trying to authorize GooglePhotos. I checked my Pi's time via SSH and it is local and correct.

[mrworf]

Did you just install the device (ie, new SD card) ?

[louislemas]

Yes, it was on a fresh install for me

[weinsteing]

Mine is not a fresh install.

[shermanpark]

I have the exact same error.
This is on a system that has been running for years

[weinsteing]

With 3 of us experiencing the same error, it sounds like the problem is being caused by something other than the timestamp. Would very much appreciate you looking for alternative reasons that this problem has occurred. Thanks and regards ... Gary

[weinsteing]

Would really appreciate you looking at this problem. There are no 4 of us experiencing it and its very frustrating not having a resolution to the problem. Thank you.

[mrworf]

Hi all, first of all, I understand the frustration and I am looking into the issue, but since this issue isn't (yet) showing on my own frames, it making this harder to troubleshoot. On top of that, I also work full-time and have a family, and with the holidays around the corner, the amount of spare time is minimal.

I hope to find some time during my holiday break to dig into this and also be able to replicate this issue for easier troubleshoot.

While this probably is disappointing to hear, I'd rather be honest with my situation than make promises I cannot keep.

However, something which would help me out a lot would be if you guys can login to the frame using SSH and provide the output from the following commands (run as root) which will give me some data to look into and compare with.

First, run find /usr -name libssl.so* and copy the first .so filename and then feed that into the following command (if none are found, replace /usr with / but be warned, you'll get permission errors that clutters the output)

grep --text -o 'OpenSSL [[:digit:]][^ ]*' /file/to/check

So, in my case,

ha@WorkHorse:~$ find /usr -name libssl.so*
/usr/lib/x86_64-linux-gnu/libssl.so.1.1
ha@WorkHorse:~$ grep --text -o 'OpenSSL [[:digit:]][^ ]*' /usr/lib/x86_64-linux-gnu/libssl.so.1.1
OpenSSL 1.1.1f

Next, run the following command to grab a complete list of installed packages

apt list --installed > packages.txt

Finally, share the OpenSSL version string (in my case, OpenSSL 1.1.1f) and attach the packages.txt file from the pi (you can use the scp command to copy it from your pi)

[weinsteing]

Dear Henric, firstly I wish you to say "Thank You" for taking the time and effort to develop this Photoframe application, which when it is running, we are delighted to be using. That is why it is frustrating when something occurs and prevents us from being able to see our photos.
Secondly, I really do appreciate that you have made it available free-of-charge and give up your time to investigate issues when they arise.
I'm not technical myself, and have asked someone who is to help me undertake the instructions above, and will send you this data asap.
In the meantime, I wish you and your family well over the festive break and very happy new year.

Thanks and regards ... Gary

[mrworf]

Thanks :) (and I hope my message didn't come across as whiny, that wasn't my intention). Me and my family and grandparents enjoy this as well, so I totally get you. I hope I'll have some positive information about this later this month.

[ZapPappy]

Hi Henric,

I'm also experiencing the same issue. And, in complete transparency, I'm just beginning my journey into PI and non-GUI interfaces. So, I'm sure the issue is my own inexperience. That said, I'm adding this comment so that:

1. I begin following this thread, and
2. You know how much I really appreciate your efforts, both to provide this application and to look into the issue.

With great appreciation,
Jeremy

[ZapPappy]

... amending with info I hope will be helpful:

1. Attached screenshot from the browser and local device
   

2. Google seems to have updated some of its API screens since you created your step-by-step directions. They're similar, but no longer exact. One thing that jums out at me is on the OAuth Consent Screen: should the user type be "Internal" or "External"? And, if External, will "Testing" suffice or "In production"? If I'm down the wrong Rabbit hole, I can leave it set to Internal. If External is needed, though, details about the specific settings may be helpful, too.

Again, I fear that I may be a victim of the limitations of my knowledge about both PI and Google's APIs. So, I apologize if this is unhelpful.

[mrworf]

Sounds like I'll need to create a test setup and update my steps.

And yes, any testing you want to do and subsequent findings is appreciated. But I have a feeling that the SSL issue stems from outdated software or certificates on the PI.