Log spam: "Authenticity is not established by certificate path validation"

SuperDicq commented

2022-12-05 22:49:52 +00:00

My logs are being spammed with this message. Does anyone have any idea what causes this?

2022-12-05 23-32-47 1-web.png

140 KiB

floatingghost commented

2022-12-05 23:27:04 +00:00

Owner

probably an old HTTP adapter

check that you haven't got any special options under :pleroma, :http or under Tesla

probably an old HTTP adapter check that you haven't got any special options under :pleroma, :http or under Tesla

paulyd commented

2022-12-06 00:55:40 +00:00

Contributor

I also see this error about 3-4 times per hour using the OTP release deployment method (I migrated from Pleroma to Akkoma).

I have no special settings under pleroma/http/tesla, and am on Debian 5-10-149.2 with ca-certificates installed.

I wonder if the OTP release is getting build in an environment without that dependency, we had this issue with a project at work a while back and it was the elixir-socket library not playing nice, but I don't see that in the dependencies here.

Edit:

Even more confusingly, on the instance the pemfiles exist for both CA Cert libraries and they both have certs.

iex(pleroma@127.0.0.1)1> CAStore.file_path()
"/opt/pleroma/lib/castore-0.1.18/priv/cacerts.pem"
iex(pleroma@127.0.0.1)2> :certifi.cacertfile()
'/opt/pleroma/lib/certifi-2.9.0/priv/cacerts.pem'

So I think I'm leaning closer to agree that there's a config issue somewhere with an adapter.

I also see this error about 3-4 times per hour using the OTP release deployment method (I migrated from Pleroma to Akkoma). I have no special settings under pleroma/http/tesla, and am on Debian 5-10-149.2 with ca-certificates installed. ~~I wonder if the OTP release is getting build in an environment without that dependency, we had this issue with a project at work a while back and it was the `elixir-socket` library not playing nice, but I don't see that in the dependencies here.~~ Edit: Even more confusingly, on the instance the pemfiles exist for both CA Cert libraries and they both have certs. ``` iex(pleroma@127.0.0.1)1> CAStore.file_path() "/opt/pleroma/lib/castore-0.1.18/priv/cacerts.pem" iex(pleroma@127.0.0.1)2> :certifi.cacertfile() '/opt/pleroma/lib/certifi-2.9.0/priv/cacerts.pem' ``` So I think I'm leaning closer to agree that there's a config issue somewhere with an adapter.

SuperDicq commented

2022-12-06 12:41:29 +00:00

Author

probably an old HTTP adapter

check that you haven't got any special options under :pleroma, :http or under Tesla

In my config I have the following:

config :pleroma, :http_security,
  sts: true

Could this be the cause?

> probably an old HTTP adapter > > check that you haven't got any special options under :pleroma, :http or under Tesla In my config I have the following: ``` config :pleroma, :http_security, sts: true ``` Could this be the cause?

Ghost commented

2022-12-06 13:42:55 +00:00

No it wouldn't. HSTS doesn't mess with that.

SuperDicq commented

2022-12-06 13:44:30 +00:00

Author

No it wouldn't. HSTS doesn't mess with that.

I also noticed this is enabled:

config :tesla, adapter: Tesla.Adapter.Gun

Could it be this? Just remove this line?

> No it wouldn't. HSTS doesn't mess with that. I also noticed this is enabled: ``` config :tesla, adapter: Tesla.Adapter.Gun ``` Could it be this? Just remove this line?

paulyd commented

2022-12-06 15:01:39 +00:00

Contributor

I am not sure if this applies to @SuperDicq's case but:

I am able to reproduce this by using the pleroma_ctl email test --to=... utility using the SMTP email adapter and ssl: true option.

I tried passing [tls_options: [certfile: CAStore.file_path()]] (as defined here) manually into the Swoosh config, and verified it is passed to the :gen_smtp_client and eventually to :socket, but it didn't seem to help.

Setting ssl: false also didn't seem to help.

I think this is because the version of gen-smtp that is bundled with Swoosh is not recent and does not include this commit and thus is filtering any addtional options from getting passed to the underlying socket.
3cfd421be0

If I get some time later today I'll try forcing an update of that dependency.

I also noticed in the reverse proxy hackney client ssl_options is also getting manually set. Generally anywhere ssl_options or tls_options is configured is a place I would start looking as it can potentially clobber default socket configurations.

I am not sure if this applies to @SuperDicq's case but: I am able to reproduce this by using the `pleroma_ctl email test --to=...` utility using the SMTP email adapter and `ssl: true` option. I tried passing `[tls_options: [certfile: CAStore.file_path()]]` [(as defined here)](https://www.erlang.org/doc/man/ssl.html#type-common_option) manually into the Swoosh config, and verified it is passed to the `:gen_smtp_client` and eventually to `:socket`, but it didn't seem to help. Setting `ssl: false` also didn't seem to help. I think this is because the version of gen-smtp that is bundled with Swoosh is not recent and does not include this commit and thus is filtering any addtional options from getting passed to the underlying socket. https://github.com/gen-smtp/gen_smtp/commit/3cfd421be0b6d317efe286f80e9ea9ea636a88f4 If I get some time later today I'll try forcing an update of that dependency. I also noticed in the reverse proxy hackney client `ssl_options` is also getting manually set. Generally anywhere `ssl_options` or `tls_options` is configured is a place I would start looking as it can potentially clobber default socket configurations.

floatingghost commented

2022-12-07 11:55:50 +00:00

Owner

@SuperDicq yes, it's that one!

config :tesla, adapter: Tesla.Adapter.Gun

just remove the line and this will go away

iirc anything that uses hackney or gun gets this error, Finch seems more stable

@SuperDicq yes, it's that one! `config :tesla, adapter: Tesla.Adapter.Gun` just remove the line and this will go away iirc anything that uses hackney or gun gets this error, Finch seems more stable

SuperDicq closed this issue

2022-12-07 12:02:57 +00:00

SuperDicq commented

2022-12-07 12:03:10 +00:00

Author

@SuperDicq yes, it's that one!

config :tesla, adapter: Tesla.Adapter.Gun

just remove the line and this will go away

iirc anything that uses hackney or gun gets this error, Finch seems more stable

That fixed it, thanks.

> @SuperDicq yes, it's that one! > > `config :tesla, adapter: Tesla.Adapter.Gun` > > just remove the line and this will go away > > iirc anything that uses hackney or gun gets this error, Finch seems more stable That fixed it, thanks.

Log spam: "Authenticity is not established by certificate path validation" #344