SSLError: [SSL: SSLV3_ALERT_CERTIFICATE_UNKNOWN] sslv3 alert certificate unknown

[Nick Terry]

I'm running Calibre 3.17 in content server mode on port 443 with a third party trusted TLS certificate. When I browse to the DNS name of the server which correctly matches the common name on the certificate using Chrome it works fine with no certificate errors. When I use Calibre Companion (from an Android 6.0.1 device) however the connection fails and I can see the following error logged in the Calibre content server logs:

Unhandled exception in state: State: do_ssl_handshake Client: <client ip>:47777 Request: WebSocketConnection
Traceback (most recent call last):
File "site-packages\calibre\srv\loop.py", line 565, in tick
File "site-packages\calibre\srv\loop.py", line 177, in do_ssl_handshake
SSLEOFError: EOF occurred in violation of protocol (_ssl.c:590)

Unhandled exception in state: State: do_ssl_handshake Client: <client ip>:38446 Request: WebSocketConnection
Traceback (most recent call last):
File "site-packages\calibre\srv\loop.py", line 565, in tick
File "site-packages\calibre\srv\loop.py", line 177, in do_ssl_handshake
SSLError: [SSL: SSLV3_ALERT_CERTIFICATE_UNKNOWN] sslv3 alert certificate unknown (_ssl.c:590)

Calibre Companion works fine if I setup the Calibre content server not to use TLS and just use a plain HTTP port 80 listener. When seeing the SSLv3 error I thought it might be something to do with me tightening the security on the web server running the Calibre content server as I had disabled SSLv3 a while ago for security best practices. As a test I re-enabled SSLv3 on the server but the problem remains. Does anyone know what the error is about here? I am thinking of setting up a reverse proxy to sit in front of the Calibre content server to do the TLS piece and proxy to the Calibre content server listening on port 80 with no TLS but I suspect the problem might remain?