Help required "untrusted certificate"

[kjc2401]

Can anyone help a newbie I have this error since updated this software using a QNAP

[Errno 111] Failed to connect: Server ssl.astraweb.com uses an untrusted certificate [[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)] -[email protected]:443

[sander]

Interesting, because ssl.astraweb.com has a correct SSL/TLS setup (see the three "OK"s) :

Code: Select all

python check_ssl_newsserver---to-csv.py ssl.astraweb.com
"ssl.astraweb.com","IPv4-only","TLSv1","200 news.astraweb.com NNRP Service Ready (posting ok) (yEnc enabled).","OK","OK","OK","-","-"

So the problem might be on your side, as in: no correct root certificates on your QNAP.

Which version of SABnbzd are you using?

[kjc2401]

thank you will check

[safihre]

Probably you run the package version that runs from our Develop branch on Github.. This is risky, since it's highly likely to contain bugs.
Recent versions of the QNAP packages now work from the Master branch, which is safe.
But for your specific error it means you should be able to go into Config > Servers and go into each server's settings to disable Certificate Verification.

[teracow]

Recent versions of the QNAP packages now work from the Master branch, which is safe.

Well, they did but now appears we're being switched to 'develop'. Maybe Clinton can look into this. Mine now shows as "develop [unknown]" but used to show "1.1.x"

Had to disable verification manually for all providers, as the new switch (in General) shows as unchecked, but Sab was still performing verification checks.

[safihre]

That switch is about https websites, not Newsservers. So for example when an NZB is fetched from an indexer. It says so in the little text

But interesting to see that apparently on QNAP there's certificate problems.. Will ask Clinton about this.

[kjc2401]

Thank's all for looking into this.

I can't connect the API key to couchpotato or sonarr now because of this.

I hope this can be fixed soon. I just downloaded the QPKG from the qnap forum and the version I have is the latest so not sure how it is a developers version.

Thanks

[sander]

Hi @kjc2401,

The short cut solution: do NOT use HTTPS nor NNTPS nor SSL on your QNAP. Use plain HTTP and plain NNTP on your QNAP. That will make the messages and symptoms go away.

Explanation: the problem is at the OS level of your QNAP NAS. SABnzbd cannot solve that for you. SABnzbd (with Python) is only the messenger and warns you about your QNAP's security problems.

For a newbie, it is probably hard to really fix this. Unless QNAP (the company) or the QNAP forum is willing and able to help you.

[safihre]

@kjc2401
What do you mean? Sonarr and CP won't connect?
CP will say it can't connect, but that's because of the develop version of SABnzbd you use. Sending NZB's should be fijne.
What error is Sonarr giving?

You do not need to use HTTPS when using Couchpotato or Sonarr to send NZB's, they are on the same device so why secure the connection from within the device?

[safihre]

Found some new info, that also in Sonarr the reason you get an error is because you are on the develop version of SABnzbd and both the Sonarr and CP check for stable versions:
https://forums.sonarr.tv/t/adding-sabnz ... narr/12278

These 2 problems are only related because you both are on develop, while you shouldn't be.
This package should keep you on the master branch:
https://github.com/clinton-hall/test/is ... -220954245

[kjc2401]

@safihre Yes sorry as your described in the first post that is the issue I am having.

I have tried to install that package you mentioned and it has still put my on the developer's version. I'm not sure how this has happened and I am struggling on what to do next. I know my way around this a little but don't understand git and how to choose different branches etc that are mentioned.

Thanks again for your help

[teracow]

That switch is about https websites, not Newsservers. So for example when an NZB is fetched from an indexer. It says so in the little text

You're right!

"Verify certificates when connecting to indexers and RSS-sources using HTTPS."

My bad. I should have read it properly. I guess that will happen when I wake up in the middle of the night to find that my NAS's networking service has crashed, then trying to troubleshoot missing qpkgs by restoring the .conf file from backups and having unexpectedly updated Sab which then required a forced update of Python, then finding that Sab wouldn't download from any of my providers. Yes, it was a bad night...

For the record, my Sab currently shows:

• Version: develop [unknown]
• Uptime: 6h
• Config File: //share/MD0_DATA/.qpkg/SABnzbdplus/Config/sabnzbd.ini
• Used cache: Cached 169 articles (124 MB)
• Parameters: SABnzbd.py -f //share/MD0_DATA/.qpkg/SABnzbdplus/Config/sabnzbd.ini --browser 0 --daemon --pid /tmp
• Python Version: 2.7.11 (default, Aug 18 2016, 12:54:38) [GCC 5.4.0] [UTF-8]
• OpenSSL: OpenSSL 1.0.2h 3 May 2016 [TLS v1.2, TLS v1.1, TLS v1]
• yEnc: Not available

[safihre]

The develop should be fine. Sonarr and CP throw warnings, but will still send NZB's

[teracow]

As my problem is off-topic, I've created a new thread here.

Thanks.