cert_expiry cannot connect to non-standard port

[danodemano]

Home Assistant release (hass --version):
0.57.3

Python release (python3 --version):
3.5.3

Component/platform:
cert_expiry

Description of problem:
Unable to connect to router to check certificate on port 4444

Expected:
Should be able to get cert from non-standard port

Problem-relevant configuration.yaml entries and steps to reproduce:

- platform: cert_expiry
  name: gateway.danodemano.com
  port: 4444
  host: gateway.danodemano.com

Traceback (if applicable):

2017-11-12 17:35:35 ERROR (Thread-6) [homeassistant.components.sensor.cert_expiry] Cannot connect to gateway.danodemano.com

Additional info:
ssl-cert-check from the Home Assistant server can check it without issue:

root@ha:~# ssl-cert-check -s gateway.danodemano.com -p 4444

Host                                            Status       Expires      Days
----------------------------------------------- ------------ ------------ ----
gateway.danodemano.com:4444                     Expiring     Dec 7 2017   25

[fabaff]

I guess that it's failing because Python tries to verify the certificate (PEP476).

[danodemano]

@fabaff - not sure what you mean by tries to verify, it's a valid CA signed cert from LetsEncrypt. The rest of my LetsEncrypt certs on port 443 validate just fine. Only seems to be this one on a non-standard port.

[fabaff]

With a self-signed certificate running on port 8123 I'm able to trigger this SSL error.

ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)

This is what I was talking about in the previous comment but it should work with Let's Encrypt and it seems to.

[danodemano]

@fabaff - That's different than the error I got though. And my cert is not not self-signed. I would get it if the check failed on a self-signed cert. My other LetsEncrypt certs work fine so the only difference seems to be the port number. Maybe not even honoring the port number? No idea.

[balloobbot]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.

Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍

[danodemano]

This is still a problem in the most current version (as of this writing) which I am running: 0.64.3

Same error too:

2018-03-02 17:38:31 ERROR (Thread-12) [homeassistant.components.sensor.cert_expiry] Cannot connect to gateway.danodemano.com

[Martinvdm]

Same issue in my setup. Using port 8123.

  - platform: cert_expiry
    scan_interval:
     minutes: 360
    host: myhost.mydomain.com
    port: 8123

Related: #8683
a delay on startup should fix it

[danodemano]

@Martinvdm - I'm not sure that's related nor that a delay on startup would resolve it. Unless I'm not understanding your statement. Even my HA instance running for days on end is never able to check this cert and always fails with the same error. It really acts like it's not using the port number provided.

[benleb]

I am experiencing the same issue for many weeks or month, but probably I finally found a workaround...

This configuration has the "cannot connect to..." problem:

- platform: cert_expiry
  name: bbb.de
  host: bbb.de
- platform: cert_expiry
  name: aaa.bbb.de
  host: aaa.bbb.de
  port: 8123

but if I change it to:

- platform: cert_expiry
  name: bbb.de
  host: bbb.de
  port: 443
- platform: cert_expiry
  name: aaa.bbb.de
  host: aaa.bbb.de
  port: 8123

it magically works. Can somebody confirm or deny this adventurous fix? I know this sounds a little strange...

[danodemano]

@benleb - just to confirm all you did was add the port to the ones that are on standard 443 and the other one started working? Cause yeah I just tried it and that doesn't resolve the issue for me. Same error:

2018-06-16 22:51:51 ERROR (Thread-21) [homeassistant.components.sensor.cert_expiry] Cannot connect to gateway.danodemano.com

[benleb]

yeah, I added the "port" option to all cert_expiry sensor instead of just to that one with a custom port. but yes, it seems very odd, but both show correct expiry days now...

i added your domain/port to my hass to test but the certificate seems not really valid?! It looks happily green in my Chrome but...

[homeassistant.components.sensor.cert_expiry] Cannot connect to gateway.danodemano.com: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:833)

testing with openssl gives

$ openssl s_client -connect gateway.danodemano.com:4444
CONNECTED(00000003)
depth=0 CN = gateway.danodemano.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = gateway.danodemano.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/CN=gateway.danodemano.com
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGFTCCBP2gAwIBAgISAw0XS8ZOYpO9ARTGP6kcqm2LMA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xODA0MTYwNTMxMjhaFw0x
...
UfjARO79yG3R5YZoqwT80xLMCHf451LCFfuN+AyuqI+pJFYNPqHdOs2SOnRu41eM
kTVeBGx9l30ukgOfaWbMZ/DlIagjFIJS9Q==
-----END CERTIFICATE-----
subject=/CN=gateway.danodemano.com
issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 2247 bytes and written 302 bytes
Verification error: unable to verify the first certificate

?!

[danodemano]

@benleb - huh, you are correct. It's showing the chain is broken:

What's even more strange is you got an entirely different error than mine that just says cannot connect. Let me see if I can fix the chain then I'll try it again.

[benleb]

I forgot to mention that I am using Python 3.6 - maybe this makes also a difference?! But I am using py36 since weeks and the sensor works just since a few days... it seems not the main cause of this...

Do you or someone else use IPv6? Or the hass machine has an IPv6 assigned but is unused/automatically configured?