Re: [ferret_users] TLS SSL Error

To: Ryo Furue <furue@xxxxxxxxxx>

Subject: Re: [ferret_users] TLS SSL Error

From: Russell Price - NOAA Federal <russell.price@xxxxxxxx>

Date: Thu, 24 Feb 2022 06:28:51 -1000

Arc-authentication-results: i=2; mx.google.com; dkim=pass header.i=@noaa.gov header.s=google header.b=n6DR2G2e; spf=pass (google.com: domain of russell.price@xxxxxxxx designates 209.85.220.41 as permitted sender) smtp.mailfrom=russell.price@xxxxxxxx; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=noaa.gov

Arc-authentication-results: i=1; mx.google.com; dkim=pass header.i=@noaa.gov header.s=google header.b=n6DR2G2e; spf=pass (google.com: domain of russell.price@xxxxxxxx designates 209.85.220.41 as permitted sender) smtp.mailfrom=russell.price@xxxxxxxx; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=noaa.gov

Arc-message-signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-archive:list-help:list-post:list-id:mailing-list:precedence:cc :to:subject:message-id:date:from:in-reply-to:references:mime-version :dkim-signature; bh=vVTFpN6/LsvsXXeHr/tbltoZC9O/w1ykmwOQM7Nd2dY=; b=0EUWDLtaWNQnVhbumqQyplNOIwqlWR2TU0EZQNp29Uirny1juxvgw7lTFc94d3rEUD ke8Kwoiqm7gOJH7MVIqHn9PTourV2WN1n4bPTXm35rN5hU/+FrtkGb0VWNNkSplNxglC RIlcSIc1WNooBYxHaXsUP+cuzbTfFSAXcZ95H+Zeim/uPD0B1jY4MP00taldbmiXdVxn TkExP7pdLk6twxnQiSn8Mjfrm7KDzQPdCjaU/cnyg4/EZv1JvSEEQAAUrZlGlWwVPLNq dFOPQSmsE3PWcxe1q+VXM/hYR7GvYV0gfaQvjCj5FqxsZBQtG83kyaercelqgYaaLL8E NEiw==

Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=vVTFpN6/LsvsXXeHr/tbltoZC9O/w1ykmwOQM7Nd2dY=; b=nDgrddMFqSbv15+tgSOBJkCL6ROtmpbnhWuKkrxd2Zg/WrAttvx/GxEJDAeFor9xe8 ZiVtOiEmTBLla0wSUPsirP0s9D+WnIZPr856TR+vjsD+tEqpcepMSM/n61U24sXjbBnv BxcjNYMzSVmqiu5O7GYBb9d2Dgr+XQGhiONEv5r0YCF1DcthvKdEp2j2S2MMZwQbk6Y1 r56/S263YJ7P0Aho0VUbyeHV5LXg0FC7UU6yxIIkXw7xdJzSwG9hQOlBxmhqZ7hwnJhS 9FdSIqd4Z+9DjADFca9JMF9UxSOByAMV+wm7bJc6TTzNmAFrVO/cvlwnrkExKOqn7IRU 0q4g==

Arc-seal: i=2; a=rsa-sha256; t=1645720143; cv=pass; d=google.com; s=arc-20160816; b=UrmhpFpq9ahqpw5BNpnTwVwkDivziHhEcmck+Hj6fCHVYdZLvl38Ax9eqaJwHd94D2 Sw1QS4MRZstyIw8+6VpJAyvIeIIPwiJEeX8xVrBfCL7+1D41WhqMCF65FC9we7UMbbmW VzxEhvzFu/L2ooAqL++DJtJ9oy7FHktOGEy0n+G5ViOwBrgxfgJbQ2cRJxoTxMOuWwLj MJILoCjDxi2fZU/CzC1g5Qh7VdXazSWBQ48lnXXHxc3izfrquk1lZuqaCtoeFuzGMpnn mSvDPO7ZOFn0J4PKsZAKMfW0jJwnVefVo9mOB3HjYqQftW7zkZB1MRpR2dIwnkRo9yB9 nXYw==

Arc-seal: i=1; a=rsa-sha256; t=1645720143; cv=none; d=google.com; s=arc-20160816; b=01f4k2gRmfHoqWz7IKgXTEpWQY2aCN+tUFF3NF3R2WW6YXJevU0UWxmBSVC+BWgiJ+ hCJkPnedDJyoYD54/OwSqa7FFy+eX888g2FUwa2EOvg5ap8dQmuNms6MXmRZ0mPu6jOM ke/tErjh0MfV7s6lehh48iRgMfWNjQoTkhdjdzmaQ07oPUprNGPYYMTZ/opdgiHEpx/y B4hroeVRnSnxeuHGvM4mG8QPtdwsU2ylqkrbKseQ2OheNp7xbq+zeLfQJDsGnLjExJnE zhaOzAa13liGvF2mzum2PPq33zzehGC9Z73epgM/+I7ylqAjAfEvU7EwDXXOegBOMCm5 XECQ==

Cc: ferret users <ferret_users@xxxxxxxx>

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=noaa.gov; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:x-original-sender:x-original-authentication-results:precedence :mailing-list:list-id:list-post:list-help:list-archive; bh=vVTFpN6/LsvsXXeHr/tbltoZC9O/w1ykmwOQM7Nd2dY=; b=KP82tVKb9VyOTrTJkaumF2to4FucppbBsj+cdt+m8LZcBHfPKkst4fTjC7ID4dO3Vr D8mUKjub2WKxmPUqmHEp/FqhubBzI5bSwe4vbPwOPjEMKzZ/jHbPVe0/xZXvupr8j6X3 GbZlq/s2quyY8O4QGSEOqPiB4CMYD68lwaOH+eIZ0rza+eV1iyxDfzUWsd2OzOuWRnVa 8VW6DbY0zyRjDy6JOvt3CiY+dYESUomHgfhI8QXOUuZEgIwfRCz3bkcMi8JUsDbOaUor kKr5Wq5eEdvKQQC++AOrmfR06zk2lESAOsJ6AxfVpWvw7MJy8sh9VkIiEU/cLe1jYvBC V/4Q==

In-reply-to: <CAEwQpaKB3Jihf+keLdR92fz0Hh7BN3rD=BnTsRu7Q4syRwgRrA@mail.gmail.com>

List-archive: <https://groups.google.com/a/noaa.gov/group/ferret_users/>

List-help: <https://support.google.com/a/noaa.gov/bin/topic.py?topic=25838>, <mailto:ferret_users+help@noaa.gov>

List-id: <ferret_users.noaa.gov>

List-post: <https://groups.google.com/a/noaa.gov/group/ferret_users/post>, <mailto:ferret_users@noaa.gov>

Mailing-list: list ferret_users@xxxxxxxx; contact ferret_users+owners@xxxxxxxx

References: <CAM-1ETmn47SFjT3TBYF-722ci2Otvs+R1+FogTPW8o2k+BVJMg@mail.gmail.com> <CAEwQpaKB3Jihf+keLdR92fz0Hh7BN3rD=BnTsRu7Q4syRwgRrA@mail.gmail.com>

Sender: owner-ferret_users@xxxxxxxx

Thank you Ryo for the test results.

I already verified with the vendor (DigiCert), tool that the certificate is installed correctly. But I'm beginning to think that there is something else that might be causing this problem.

The diagnostic you obtained from wget seems to point to the chain file. I'll verify that by comparing ours with what is currently available on the vendor's site.

Funny... I tried using wget myself, and it didn't object. Maybe I have an older version in play.

On Wed, Feb 23, 2022 at 8:07 PM Ryo Furue <furue@xxxxxxxxxx> wrote:

Dear Russell,

On Thu, Feb 24, 2022 at 5:51 AM Russell Price - NOAA Federal <russell.price@xxxxxxxx> wrote:
Hello,

Workstation system details: Redhat Linux 8.5 / kernel 4.18.0-348.12.2.el8_5.x86_64 / Python 3.9 / PyFerret 7.6.4

In attempting to access the following data set:

https://oceanwatch.pifsc.noaa.gov/erddap/griddap/CRW_sst_v3_1_monthly

I get the following error:

Error:curl error: SSL peer certificate or SSH remote key was not OK
curl error details:
Warning:oc_open: Could not read url
**netCDF error
NetCDF: I/O failure (OPeNDAP/netCDF Error code -68)
Data set: https://oceanwatch.pifsc.noaa.gov/erddap/griddap/CRW_sst_v3_1_monthly

I've verified that the host site has the certificate and certificate chain installed correctly, and the cert is not out-of-date or blacklisted.

This is the error message I get when trying to open the dataset via netCDF library:

syntax error, unexpected WORD_WORD, expecting SCAN_ATTR or SCAN_DATASET or SCAN_ERROR
context: <!DOCTYPE^ HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /erddap/griddap/CRW_sst_v3_1_monthly.ddson this server.</p></body></html>
ERROR: LoadError: NetCDF error: Opening path https://oceanwatch.pifsc.noaa.gov/erddap/griddap/CRW_sst_v3_1_monthly: NetCDF: Access failure (NetCDF error code: -77)

(I'm using netCDF library on Julia, but Julia is just printing the error message from the netCDF library. I don't know what version of netCDF library this is.)

Here is what I got when getting the contents of the URL using wget:

$ wget "https://oceanwatch.pifsc.noaa.gov/erddap/griddap/CRW_sst_v3_1_monthly"
--2022-02-24 15:00:01-- https://oceanwatch.pifsc.noaa.gov/erddap/griddap/CRW_sst_v3_1_monthly
Resolving oceanwatch.pifsc.noaa.gov (oceanwatch.pifsc.noaa.gov)... 205.156.57.205
Connecting to oceanwatch.pifsc.noaa.gov (oceanwatch.pifsc.noaa.gov)|205.156.57.205|:443... connected.
ERROR: cannot verify oceanwatch.pifsc.noaa.gov's certificate, issued by ‘CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US’:
Unable to locally verify the issuer's authority.
To connect to oceanwatch.pifsc.noaa.gov insecurely, use `--no-check-certificate'

When I specified --no-check-certificate, wget downloaded an HTML file, which I don't know is the correct one or not.

I've tested another OPeNDAP URL, which works both for Julia and wget.

So, my guess is that the server is broken in one way or another.

Regards,

Ryo

I can access the site fine with FireFox, Google Chrome, and Microsoft Explorer and Edge.

An older version of Ferret (7.5, running on CentOS 7.9 kernel 3.10.0-1160.53.1.el7.x86_64). doesn't have any issues with the site.

Can anyone provide guidance on what is going wrong here, and how to fix it? Or get around it....

Thank you,

Russell

--
Russell Price, UNIX Systems Administrator

Pacific Islands Fisheries Science Center

Information Technology Services, 3rd Floor, IRC
6AM-3:30PM M-Th; 6AM-2:30PM Fri / Out on Alt. Fri.

808-725-5312

Russell Price, UNIX Systems Administrator

Pacific Islands Fisheries Science Center

Information Technology Services, 3rd Floor, IRC

6AM-3:30PM M-Th; 6AM-2:30PM Fri / Out on Alt. Fri.

808-725-5312