SSL Error When Running RNM Command

[grahamturk]

Hello!

I followed the instructions to run the RNM workflow. When I ran the uo rnm command (with the --opendss flag), I got the following error:

Running RNM-US at https://rnm.urbanopt.net/api/v2/
Error: SSL_connect SYSCALL returned=5 errno=0 peeraddr=[2606:4700:3031::6815:4e9d]:443 state=error: certificate verify failed

Is there anywhere in the project I can update the certificates? Or is it possible that URL is no longer valid?

[kflemin]

Hi @grahamturk, have you tried following the resolution for "CERTIFICATE HAS EXPIRED" in the release notes and known issues page here: https://docs.urbanopt.net/developer_resources/known_issues.html?

Let me know if that doesn't fix the error and we can investigate further.

[grahamturk]

@kflemin unfortunately that didn't fix the problem. I am actually not using ReOpt for this workflow, just RNM. The error message comes right after the log message:
Running RNM-US at https://rnm.urbanopt.net/api/v2/

[kflemin]

@grahamturk, I know you are using the RNM workflow, but either tool could return the SSL connect error you are receiving, that is why I suggested rerunning certified-update.

I just reran the example RNM project successfully on my machine, and the RNM server is up and running...

1. Can you verify that you can access https://rnm.urbanopt.net ?
2. What do you get when you run the following command? ruby -ropenssl -e 'p OpenSSL::OPENSSL_VERSION'
3. Do you see any errors when you run the following? openssl s_client -showcerts -connect rnm.urbanopt.net:https

[grahamturk]

Hi @kflemin.

1. Confirming that I can access the RNM website
2. I get "OpenSSL 3.1.0 14 Mar 2023"
3. I am getting the following error:

CONNECTED(00000005)
8468385600:error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure:/AppleInternal/Library/BuildRoots/289ffcb4-455d-11ef-953d-e2437461156c/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/ssl/tls13_lib.c:129:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 287 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Start Time: 1745554124
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

[grahamturk]

Also figured I'd mention that I tried running the certified-update script and am getting the following error:

Updating ca-bundle from https://raw.githubusercontent.com/bagder/ca-bundle/master/ca-bundle.crt
./certified-update:13:in `initialize': No such file or directory @ rb_sysopen - https://raw.githubusercontent.com/bagder/ca-bundle/master/ca-bundle.crt (Errno::ENOENT)
	from ./certified-update:13:in `open'
	from ./certified-update:13:in `<main>'

I confirmed that I can access https://raw.githubusercontent.com/bagder/ca-bundle/master/ca-bundle.crt from my browser without issue.

[kflemin]

Ok, thanks for all of this information! First of all, I forgot that we got rid of the certified gem in URBANopt version 1.0 and above (Ruby 3 handles that functionality now, sorry about that).

We think this error is most likely related to your vpn/network. Here is a ruby script for you to run to help diagnose the issue. Run the script first and note what CA issuer is printed out. If it is not CA Issuer: /C=US/O=Google Trust Services/CN=WE1 then you will have to make your own custom CA bundle. Steps to create the custom CA bundle:

1. create an empty .pem file
2. manually download the https://raw.githubusercontent.com/bagder/ca-bundle/master/ca-bundle.crt you referenced and paste its contents into the new .pem file
3. Add the cert that was printed out by the script to the end of the .pem file and save
4. Set the SSL_CERT_FILE environment variable on your machine to point to this new .pem file. (You can also set the SSL_CERT_DIR environment variable if you have a directory of certs)

the script:

require 'net/http'
require 'openssl'
require 'uri'

uri  = URI("https://rnm.urbanopt.net/api/v2/simulations")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

http.start do |conn|
  response = conn.get(uri.request_uri)

  bufio = conn.instance_variable_get(:@socket)
  ssl_socket =
    if bufio.respond_to?(:io)
      bufio.io
    else
      bufio
    end

  # inspect the peer cert
  cert = ssl_socket.peer_cert
  puts "CA Issuer: #{cert.issuer}"
  
  puts "Cert:\n#{cert}"

  # (optional) print the body
  # puts response.body
end

Another thing that you can check if by any chance the CA Issuers does look correct, is to comment out the http.verify_mode = OpenSSL::SSL::VERIFY_NONE line out of the script and rerun. Let us know if that succeeds or not.

[grahamturk]

Hi @kflemin thanks for all the help with this! I ran the script and got (omitting the certificate itself)

CA Issuer: /C=US/O=Google Trust Services/CN=WE1
Cert:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

[tianci-cui]

Hi @kflemin I am having the same error as @grahamturk when running the RNM without the --opendss flag. I also got the same output as @grahamturk by running your test ruby script. Could you please help us solve this issue? Thank you!

[kflemin]

@grahamturk @tianci-cui what happens when you comment out the http.verify_mode = OpenSSL::SSL::VERIFY_NONE line out of the script and rerun?

[tianci-cui]

Thanks @kflemin I still got the same output

[tianci-cui]

@kflemin @grahamturk I would like to update that I had the above mentioned issue on my Mac but everything worked well on a Debian machine and we have set up an AWS Ubuntu 22.04 instance to run RNM-US.