SSL Error

callumbee

Hi!,

First, wonderful app! Loving it so far and hope that I can carry on that love after solving this error!

So I have a library that sends a request to send an email via postmark. Trying to send said email gives this error in my logs: CURL ERROR: error setting certificate file: /Users/myusername/.indigo/ssl/ca-certificates/cert.pem

This is a little over my head to working this issue out. 😅

Indigo

Hey, thanks for your feedback! 🙂

Regarding your issue with CURL, can you add a bit more detail? Is it a PHP library you're using, which calls curl? If so, which library is it, and which PHP version? Are you explicitly providing the cert.pem path to curl (via config or somesuch)? I'm not completely understanding why it would even be necessary to provide the cert.pem path to curl.

Are you able to see the exact curl command that is being attempted by the library? If so, you might be able to run it directly in the terminal for debugging purposes.

Hopefully we can get to the bottom of this issue 🙂

callumbee

So I am just using CURL directly. Nothing extra but the bear basics to get it going. It works fine on my servers etc so it’s an issue with indigo.

Indigo

Ah, interesting! Does it give you the same error if you run your curl command in the terminal? Are you able to share an obfuscated version of the command that is failing so I can see if I can replicate it?

callumbee

        $headers = array(
            'Accept: application/json',
            'Content-Type: application/json',
            'X-Postmark-Server-Token: ' . $this->apiKey
        );
        
        $ch = curl_init();
        
        if (is_null($this->templateId)){

            curl_setopt($ch, CURLOPT_URL, 'https://api.postmarkapp.com/email');
        
        } else {
        
            curl_setopt($ch, CURLOPT_URL, 'https://api.postmarkapp.com/email/withTemplate');
        }

        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
        curl_setopt($ch, CURLOPT_POSTFIELDS, $encoded_data);
        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

        $return = curl_exec($ch);

        log_message('debug', 'POSTMARK JSON: ' . $encoded_data . "\nHeaders: \n\t" . implode("\n\t", $headers) . "\nReturn:\n$return");
        
        if (curl_error($ch) != ''){

            log_message('error', 'CURL ERROR: '.curl_error($ch));
        }

        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

        log_message('debug', 'POSTMARK http code:' . $httpCode);

So this is the code I am using. Works fine on my local terminal.

Indigo

So I set up what I think would be the simplest possible scenario for this, and it appears to work for me without any SSL error. The curl request fails with a 422 http response code (because I don't have a properly set up Postmark account), I think the existence of the Postmark error in the response tells me the SSL layer has worked fine. Would you agree?

debug: 
POSTMARK JSON: {"From":"sender@abc123.com","To":"recipient@abc123.com"}
Headers: 
	Accept: application/json
	Content-Type: application/json
	X-Postmark-Server-Token: cf1c1988-my-postmark-api-key-here
Return:
{"ErrorCode":1101,"Message":"The request specifies neither 'TemplateId' nor 'TemplateAlias'."}

debug: 
POSTMARK http code:422

If you can, grab my test files below, and see if you get the same response I do.

In Indigo > Open... and open the included curl-test.indigostack file
in the stack's Nginx, edit curl.test and assign the root to the curl-test folder you just downloaded
start the stack and visit https://curl.test

Download

callumbee

Sorry! That link gives me some nice JSON!

{"errors":[{"status":"500","code":"unknown"}]}

Indigo

Can you provide more detail on what you did? Did you install the Indigo stack from the zip file and then visit https://curl.test?

callumbee

That was this site. When trying to download that zip file. 🙂

Indigo

Ah, that's frustrating, sorry about that! I just turned on the attachments Flarum module and clearly it's not quite right... digging into it now.

Indigo

Grrr, not too sure what's going on with the upload extension. Might have to continue fighting that another day.

For now I've hardcoded a download link in the original post above, which should work for you if you don't mind giving it another try.

Indigo

Could you please confirm whether this link downloads the zip for you?

curl-test.zip

4kB

callumbee

Indigo

That worked there! 🙂

So this is what I get same issue!

debug: POSTMARK JSON: {"From":"sender@abc123.com","To":"recipient@abc123.com"} Headers: Accept: application/json Content-Type: application/json X-Postmark-Server-Token: cf1c1988-my-postmark-api-key-here Return: error: CURL ERROR: error setting certificate file: /Users/USERNAME/.indigo/ssl/ca-certificates/cert.pem debug: POSTMARK http code:0

So it's possibly something todo with my device. I will need to go and do some googling on this issue then!

callumbee

Ok, google wasn't that helpful. If it works for you and not me then I must have some issues with the certificates or permissions for accessing the file on my machine. There is nothing obvious with the permissions for anything in the .indigo folder. I setup a new account just in case there was some odd setup on my main account but the issue still persists.

How is /Users/USERNAME/.indigo/ssl/ca-certificates/cert.pem generated?

callumbee

So, new development I fudged the openssl.cafile and openssl.capath in the PHP INI file to point to this certificate that I downloaded into my downloads folder then restarting the stack and it works!

So the question is why it won't look in that .indigo file. When I restarted using the downloads folder for the first time Mac OS asked if I wanted to allow access to the folder. So there some odd Mac issue at place I think.

Indigo

Wow, great work getting it going! The bundled ~/.indigo/ssl/ca-certificates/cert.pem is originally provided to Indigo by Homebrew. That's because we run a build server which builds Indigo's services from Homebrew's, with the build scripts modified as needed to allow them to run completely standalone, independently from Homebrew. To be clear, you don't need Homebrew installed, and if you do install it, Indigo won't be affected, nor will it affect, your Homebrew install.

I'm sorry that I'm still at a bit of a loss understanding why the bundled certs are not working for you. I do some pretty complex inter-server communication stuff using my Indigo stacks (albeit using Guzzle not curl) so I can vouch that "it works for me" — for what that's worth ha! Given that you succeeded in getting it working, are you happy to leave the debugging there and move onwards?

callumbee

Indigo

So doing some more digging, theres nothing wrong with the certs but for some reason for me it doenst like accessing them when they are in the .indigo folder but anywhere else is fine.

Indigo

Wow, nice find. Very strange though, particularly since as mentioned I have successfully configured several other processes (eg Vite) to access them and it's worked fine.

Are you serving your PHP script via Indigo's Nginx or Apache, or are you running it from the command line? If the latter are you using Indigo's shell integration (ie running indigo.set.something.default) first?

callumbee

Indigo
I am using apache for serving as the server. Which may be a possibly cause?

Indigo

Sorry, I should have been more clear. If you were serving it from some non-Indigo server, or from the terminal without one of Indigo's services, it's possible there could be a user mismatch. By using Indigo's Apache everything should be running as a user that can access those certs. It's very strange indeed.

To debug, you could perhaps try creating an arbitrary file from the same PHP script, and check its ownership. If that's fine perhaps try reading the same file, then move that file into ~, then ~/.indigo etc until it breaks. I'm really not sure what you might get from that though as I still can't understand why it can't read it in the first place.