ckan / ckan/datapusher

SSL connect fails - return of the "SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794"

Open
#131 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
82
Forks
157
PR merge metrics
No merged PRs in 30d

Description

http://stackoverflow.com/questions/43214581/ssl-connection-fails-to-datapusher-app-through-port-8800-with-nginx-reverse-pro

I am installing the [datapusher][1] service for [CKAN][2].
CKAN has been configured to use an NGINX reverse proxy that routes client requests, following [instructions here][3]. SSL certificate is installed and configured in NGINX.
When trying to use the datapusher app to upload a file, it fails and Apache log gives this error:

Mon Apr 03 13:49:10.979179 2017] [:error] [pid 15468] 2017-04-03 13:49:10,979 CRITI [ckanext.datapusher.plugin] {'status_code': 403, 'message': 'An Error occurred while sending the job: 403 Client Error: Forbidden', 'details': u'\\n\\n403 Forbidden\\n\\n

Forbidden

\\n

You don\\'t have permission to access /job\\non this server.

\\n
\\n
Apache/2.4.7 (Ubuntu) Server at 127.0.0.1 Port 8800
\\n\\n'}

When testing access to the datapusher's 8800 port through openssl this is the output:

[Mon Apr 03 13:49:10.981049 2017] [:error] [pid 15468] [remote 127.0.0.1:6855] Error - : notify() takes exactly 3 arguments (2 given)
open:/etc/ckan> openssl s_client -connect 127.0.0.1:8800
CONNECTED(00000003)
140385459791520:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 275 bytes

The datapusher docs give a workaround for bypassing SSL [here][4], using the `SSL_Verify` config. I tried this and there was no change.

I also tried hardcoding the SSL bypass as suggested in #83 , also to no affect.

I think that I need to either:
1. Force the nginx reverse proxy to allow SSL connections through port 8800 (in addition to 443). Or...
2. Configure ckan/datapusher/apache/nginx to bypass SSL/https on port 880.

Any suggestions?

[1]: https://github.com/ckan/datapusher
[2]: https://github.com/ckan/ckan
[3]: https://github.com/conwetlab/ckanext-oauth2/wiki/Starting-CKAN-over-HTTPs-using-Apache-and-Nginx
[4]: http://docs.ckan.org/projects/datapusher/en/latest/using.html#configuring-ssl-verification

Referencing: https://github.com/ckan/datapusher/issues/83

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.