Re: [ferret_users] TLS SSL Error

To: Ryo Furue <furue@xxxxxxxxxx>

Subject: Re: [ferret_users] TLS SSL Error

From: Russell Price - NOAA Federal <russell.price@xxxxxxxx>

Date: Thu, 24 Feb 2022 07:10:52 -1000

Arc-authentication-results: i=2; mx.google.com; dkim=pass header.i=@noaa.gov header.s=google header.b=lW0FzX2h; spf=pass (google.com: domain of russell.price@xxxxxxxx designates 209.85.220.41 as permitted sender) smtp.mailfrom=russell.price@xxxxxxxx; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=noaa.gov

Arc-authentication-results: i=1; mx.google.com; dkim=pass header.i=@noaa.gov header.s=google header.b=lW0FzX2h; spf=pass (google.com: domain of russell.price@xxxxxxxx designates 209.85.220.41 as permitted sender) smtp.mailfrom=russell.price@xxxxxxxx; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=noaa.gov

Arc-message-signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-archive:list-help:list-post:list-id:mailing-list:precedence:cc :to:subject:message-id:date:from:in-reply-to:references:mime-version :dkim-signature; bh=nJfKqPetbL1E1QYVZ8uG4C6V1ZMttaTq1S9Dnejkqf0=; b=RUzmzyiEbVl+YCQaFB34sWcMj3kdu2yuV7JJubPn8LhRIH9lat5SXtV0mup++Y1kyG oul1af8HILLBnXlEkWku+w9/ZGkrGwkEoJleY8qi98TPUYSc/mDE4Sm8uxTHcf2RmyeD jkaXCTCJoPSPjVDAvmqRhh44a/aoZEPh/0THH5Xs02NfvUn/onqB/jEpMSU1/QqUpLMS YXGY8hbLsfHW4yJoQzqZuXW3ZkI3t9IIelglbLKsjtQCmSr2K9013+n8YPHfgmxDAvPv 67kbEq93YsTnHscFkVwn8Nu+mIazDmHbL5bdJue1OqDdSMedOr6lB/ZFOW7l/Uni08On 4hXQ==

Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=nJfKqPetbL1E1QYVZ8uG4C6V1ZMttaTq1S9Dnejkqf0=; b=gYyGJvwBCpR7GuPJtlw9gB/Zy6+o6FozW0vf1cAng2CgfUcoXMB3JG5KufEgFiHMHE dwC/i11zxJwSiUl2E2U8bt4tJZjyzeg/RGkkL+4ljj0+L+5mZi0iVWSXkhmsIRnch7Wl aO20WaTJeeN74yOSpoUvzmORbS5HFuPgm72/GeVBdQ+tTUKj83+gicoM0CtC5Io7UqhT jy1s2cjwhW5mjHEYELZjo0bnb7NDcoFCB+AB0+bvKjThna8dgyyX3lZ+JlCv0PREHBXT AqxDoXHIcO1GnrEl72OU+WVS//daLY4vTwfQwqsZ0JczJpZkVxCDpt9t7Rm3Z0aZeW1P exjA==

Arc-seal: i=2; a=rsa-sha256; t=1645722664; cv=pass; d=google.com; s=arc-20160816; b=shEAkZfvaE2jC1C4k0ybu6H4Zjz4Q7QyZRFUSHyWk7VJZrfNbFUeUF9SmNIdhk61Nb Au+LAGurBx7Au2VVlwD+rDkVcZ/yDK0i30sDmjK33jObWXLywTIADJ1A5rBuCSuXwi2f Wq7dNeZYD/roRG0Bio/MWAEdFmmO9mB6xfcmnnP57s4tQfn3JYQytrEbVlWfJt2rgY55 47ePRjjAT2VnOKmeWMjSIqFJDooKsJliSLTvNPOAtWHbtyhJzkZxOjyJ/eRqLoKk9lqa O6sVk9AL6qKznQcoBf7T2aXkR2cTxlslmoE1mRbD/mcKrmGsaxiW7itATz1E5we21lox 93ew==

Arc-seal: i=1; a=rsa-sha256; t=1645722664; cv=none; d=google.com; s=arc-20160816; b=o+jab3itdTo2a7PEY5a6gnujr9Nef3KvZqzMo28pHTwCx9fkgthLNBcu/hDnyMH7HH lGyQcJRDTT2b3gXgwmFMiCm4POXdEwwBAWIye/TR3UMDOysVaIT/M4Etcm+nvPN7pyJb PxxZ3dWo9RBAh5hd11KUCC+Jk8RfsN9LTxQrn94VFYJpcdytyWfzKTvArWHrCCN145Ts Y5/4GdqTeIH4Qw9+jUTcOt1NG28S+W/7MSOCovZLRVCo/bazht1KHU7oKwzEoeKn73lm dMHldpFXbm6+q0pUab5Ozjd4ijJQVh7czNIut0H6M2XqBk+AmhgJTbqr30d2ylWdnzEa nmfw==

Cc: ferret users <ferret_users@xxxxxxxx>

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=noaa.gov; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:x-original-sender:x-original-authentication-results:precedence :mailing-list:list-id:list-post:list-help:list-archive; bh=nJfKqPetbL1E1QYVZ8uG4C6V1ZMttaTq1S9Dnejkqf0=; b=VH6+/YKZmWKMI2jdY7Au+e/B2qArxyOVHknhBz3Qt9b5EttD/zlWbeRF04bYTj9Gwv I/f70EX+ZogqtinMrcMA2NRJj42PAv3W7YM/Rgx9/QzeNzH4CO4cgyeHaBLo3DREYLRJ ACBvgwbqstlbaALl08n5Caff8H2wNpp0ywRf4cDAkcC9jViGSaylwKB2/q0XYSw3w0Ul EUDWAzyF1l7qHwA3p8KMI1W58smgRn870AfwbnxsQWwl8ThtCCP4XqSjzYk1qcYrjG0F W15jj5AEJBsRbMzZ3U9kIQva2aI7az9sbb2EotTcD0EAWv+cQQCNTNhGagmCN7atIGh5 8sEQ==

In-reply-to: <CAEwQpaKB3Jihf+keLdR92fz0Hh7BN3rD=BnTsRu7Q4syRwgRrA@mail.gmail.com>

List-archive: <https://groups.google.com/a/noaa.gov/group/ferret_users/>

List-help: <https://support.google.com/a/noaa.gov/bin/topic.py?topic=25838>, <mailto:ferret_users+help@noaa.gov>

List-id: <ferret_users.noaa.gov>

List-post: <https://groups.google.com/a/noaa.gov/group/ferret_users/post>, <mailto:ferret_users@noaa.gov>

Mailing-list: list ferret_users@xxxxxxxx; contact ferret_users+owners@xxxxxxxx

References: <CAM-1ETmn47SFjT3TBYF-722ci2Otvs+R1+FogTPW8o2k+BVJMg@mail.gmail.com> <CAEwQpaKB3Jihf+keLdR92fz0Hh7BN3rD=BnTsRu7Q4syRwgRrA@mail.gmail.com>

Sender: owner-ferret_users@xxxxxxxx

Ryo,

Thank you for pointing me in the right direction with your wget error.

Though the Digicert site checker tool said that everything was correct for the cert chain on our Oceanwatch proxy, I downloaded and checked their current intermediate cert against the one we were using. They were different.

I replaced the older (2020), intermediate cert from DigiCert with the new one. PyFerret works now.

Thanks again, Sir!

Sincerely,

Russell

On Wed, Feb 23, 2022 at 8:07 PM Ryo Furue <furue@xxxxxxxxxx> wrote:

Dear Russell,

On Thu, Feb 24, 2022 at 5:51 AM Russell Price - NOAA Federal <russell.price@xxxxxxxx> wrote:
Hello,

Workstation system details: Redhat Linux 8.5 / kernel 4.18.0-348.12.2.el8_5.x86_64 / Python 3.9 / PyFerret 7.6.4

In attempting to access the following data set:

https://oceanwatch.pifsc.noaa.gov/erddap/griddap/CRW_sst_v3_1_monthly

I get the following error:

Error:curl error: SSL peer certificate or SSH remote key was not OK
curl error details:
Warning:oc_open: Could not read url
**netCDF error
NetCDF: I/O failure (OPeNDAP/netCDF Error code -68)
Data set: https://oceanwatch.pifsc.noaa.gov/erddap/griddap/CRW_sst_v3_1_monthly

I've verified that the host site has the certificate and certificate chain installed correctly, and the cert is not out-of-date or blacklisted.

This is the error message I get when trying to open the dataset via netCDF library:

syntax error, unexpected WORD_WORD, expecting SCAN_ATTR or SCAN_DATASET or SCAN_ERROR
context: <!DOCTYPE^ HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /erddap/griddap/CRW_sst_v3_1_monthly.ddson this server.</p></body></html>
ERROR: LoadError: NetCDF error: Opening path https://oceanwatch.pifsc.noaa.gov/erddap/griddap/CRW_sst_v3_1_monthly: NetCDF: Access failure (NetCDF error code: -77)

(I'm using netCDF library on Julia, but Julia is just printing the error message from the netCDF library. I don't know what version of netCDF library this is.)

Here is what I got when getting the contents of the URL using wget:

$ wget "https://oceanwatch.pifsc.noaa.gov/erddap/griddap/CRW_sst_v3_1_monthly"
--2022-02-24 15:00:01-- https://oceanwatch.pifsc.noaa.gov/erddap/griddap/CRW_sst_v3_1_monthly
Resolving oceanwatch.pifsc.noaa.gov (oceanwatch.pifsc.noaa.gov)... 205.156.57.205
Connecting to oceanwatch.pifsc.noaa.gov (oceanwatch.pifsc.noaa.gov)|205.156.57.205|:443... connected.
ERROR: cannot verify oceanwatch.pifsc.noaa.gov's certificate, issued by ‘CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US’:
Unable to locally verify the issuer's authority.
To connect to oceanwatch.pifsc.noaa.gov insecurely, use `--no-check-certificate'

When I specified --no-check-certificate, wget downloaded an HTML file, which I don't know is the correct one or not.

I've tested another OPeNDAP URL, which works both for Julia and wget.

So, my guess is that the server is broken in one way or another.

Regards,

Ryo

I can access the site fine with FireFox, Google Chrome, and Microsoft Explorer and Edge.

An older version of Ferret (7.5, running on CentOS 7.9 kernel 3.10.0-1160.53.1.el7.x86_64). doesn't have any issues with the site.

Can anyone provide guidance on what is going wrong here, and how to fix it? Or get around it....

Thank you,

Russell

--
Russell Price, UNIX Systems Administrator

Pacific Islands Fisheries Science Center

Information Technology Services, 3rd Floor, IRC
6AM-3:30PM M-Th; 6AM-2:30PM Fri / Out on Alt. Fri.

808-725-5312

Russell Price, UNIX Systems Administrator

Pacific Islands Fisheries Science Center

Information Technology Services, 3rd Floor, IRC

6AM-3:30PM M-Th; 6AM-2:30PM Fri / Out on Alt. Fri.

808-725-5312