SSL Error Connecting on Mac OSX

JimmXinu · 01-29-2016, 10:52 AM

I've had a couple different FanFicFare users report that they're getting an SSLV3_ALERT_HANDSHAKE_FAILURE error when connecting to the site forums.sufficientvelocity.com. on Mac OSX. I don't see the problem on Windows.

My research suggests that this is likely caused by the SSL library not correctly switching to TLS from SSLv3 (or possibly not using Server Name Indication (SNI)?)

Python 2.7.9 or newer should work from what I've read. On Windows, Calibre is using 2.7.9 already.

Does Calibre carry it's own SSL libraries? Or does it depend on the installed OS libraries? I don't think that this is something that can be addressed in the plugin.

FanFicFare Mail List discussion (hijacked subject, SSL problem starts at Jan 21).

FanFicFare Forum discussion.

I believe that running this from command line should test the problem without needing to install FanFicFare:

Code:

calibre-debug -c "import urllib2 as u2 ; opener = u2.build_opener() ; opener.addheaders = [('User-Agent', '')] ; print opener.open('https://forums.sufficientvelocity.com').read()[:200]"

Any help or suggestions would be appreciated.

kovidgoyal · 01-29-2016, 12:51 PM

On OS X calibre uses the system openssl libraries. IIRC Apple ships fairly outdated openssl libraries. It is on my TODO list to build the OS X version of calibre with a bundled openssl.

kovidgoyal · 01-29-2016, 11:04 PM

I spent some time looking into this, and if I build calibre with a private copy of openssl on OS X, then I will also need to provide my own set of root certificates, because Apple does not provide access to its OS certificates, except through a private, undocumented API.

See https://bugs.python.org/issue17128 for details.

JimmXinu · 01-29-2016, 11:59 PM

That's inconsiderate of them...

I don't know much about it, but I've read of people updating their OpenSSL on OS X using homebrew?

kovidgoyal · 01-30-2016, 12:14 AM

The problem is not building openssl, the problem is providing access to some database of root certificates for the custom built openssl. homebrew includes a script that exports the apple certificates into a form useable by openssl. That solution is a horrible hack -- for obvious reasons.

I am looking into bundling the mozilla root certificate db with calibre for use on OS X. This is less than ideal, it means that the root cert store can get out of date unless the user updates calibre and the user cannot use the system keychain to manage the root certificates calibre uses -- but such is the price of using Appleware.

kovidgoyal · 01-30-2016, 02:34 AM

There you go: https://github.com/kovidgoyal/calibr...15f6f329f2f349

JimmXinu · 01-30-2016, 09:48 AM

Many thanks! I really appreciate it.

kovidgoyal · 01-30-2016, 12:17 PM

No biggie, like I said it was on my TODO list anyway, since I suspect Apple are going to remove openssl from OS X completely at some point.

01-29-2016, 10:52 AM	#1
JimmXinu Plugin Developer Posts: 6,333 Karma: 3966377 Join Date: Dec 2011 Location: Midwest USA Device: Kindle Paperwhite(10th)	SSL Error Connecting on Mac OSX I've had a couple different FanFicFare users report that they're getting an SSLV3_ALERT_HANDSHAKE_FAILURE error when connecting to the site forums.sufficientvelocity.com. on Mac OSX. I don't see the problem on Windows. My research suggests that this is likely caused by the SSL library not correctly switching to TLS from SSLv3 (or possibly not using Server Name Indication (SNI)?) Python 2.7.9 or newer should work from what I've read. On Windows, Calibre is using 2.7.9 already. Does Calibre carry it's own SSL libraries? Or does it depend on the installed OS libraries? I don't think that this is something that can be addressed in the plugin. FanFicFare Mail List discussion (hijacked subject, SSL problem starts at Jan 21). FanFicFare Forum discussion. I believe that running this from command line should test the problem without needing to install FanFicFare: Code: calibre-debug -c "import urllib2 as u2 ; opener = u2.build_opener() ; opener.addheaders = [('User-Agent', '')] ; print opener.open('https://forums.sufficientvelocity.com').read()[:200]" Any help or suggestions would be appreciated.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
mac osx open assign ebook viewer to epub files mac osx	asllearner	Devices	4	09-13-2013 04:17 AM
Sigil on Mac OSX 10.5.8	europas_ice	Sigil	6	05-08-2013 08:21 PM
Classic Rooting the Classic on Mac OSX?	foxglove	Barnes & Noble NOOK	1	09-05-2011 06:03 AM
How to use iLiad with Mac OsX?	jasem200	iRex	6	08-17-2008 10:48 AM
Mac OSX vs Windows XP	Alexander Turcic	Lounge	5	06-05-2003 01:30 PM

01-29-2016, 12:51 PM	#2
kovidgoyal creator of calibre Posts: 43,866 Karma: 22666666 Join Date: Oct 2006 Location: Mumbai, India Device: Various	On OS X calibre uses the system openssl libraries. IIRC Apple ships fairly outdated openssl libraries. It is on my TODO list to build the OS X version of calibre with a bundled openssl.

01-29-2016, 11:04 PM	#3
kovidgoyal creator of calibre Posts: 43,866 Karma: 22666666 Join Date: Oct 2006 Location: Mumbai, India Device: Various	I spent some time looking into this, and if I build calibre with a private copy of openssl on OS X, then I will also need to provide my own set of root certificates, because Apple does not provide access to its OS certificates, except through a private, undocumented API. See https://bugs.python.org/issue17128 for details.

01-29-2016, 11:59 PM	#4
JimmXinu Plugin Developer Posts: 6,333 Karma: 3966377 Join Date: Dec 2011 Location: Midwest USA Device: Kindle Paperwhite(10th)	That's inconsiderate of them... I don't know much about it, but I've read of people updating their OpenSSL on OS X using homebrew?

01-30-2016, 12:14 AM	#5
kovidgoyal creator of calibre Posts: 43,866 Karma: 22666666 Join Date: Oct 2006 Location: Mumbai, India Device: Various	The problem is not building openssl, the problem is providing access to some database of root certificates for the custom built openssl. homebrew includes a script that exports the apple certificates into a form useable by openssl. That solution is a horrible hack -- for obvious reasons. I am looking into bundling the mozilla root certificate db with calibre for use on OS X. This is less than ideal, it means that the root cert store can get out of date unless the user updates calibre and the user cannot use the system keychain to manage the root certificates calibre uses -- but such is the price of using Appleware.

01-30-2016, 02:34 AM	#6
kovidgoyal creator of calibre Posts: 43,866 Karma: 22666666 Join Date: Oct 2006 Location: Mumbai, India Device: Various	There you go: https://github.com/kovidgoyal/calibr...15f6f329f2f349

01-30-2016, 09:48 AM	#7
JimmXinu Plugin Developer Posts: 6,333 Karma: 3966377 Join Date: Dec 2011 Location: Midwest USA Device: Kindle Paperwhite(10th)	Many thanks! I really appreciate it.

01-30-2016, 12:17 PM	#8
kovidgoyal creator of calibre Posts: 43,866 Karma: 22666666 Join Date: Oct 2006 Location: Mumbai, India Device: Various	No biggie, like I said it was on my TODO list anyway, since I suspect Apple are going to remove openssl from OS X completely at some point.

Advert

Advert