gkleinig | Stripe Developers | Page 1

stiff perchBOT Mar 9, 2023, 9:00 AM

#

brittle dew Mar 9, 2023, 9:05 AM

#

I'm not aware of any ongoing issues impacting SSL/TLS no. Sounds like a potential server configuration issue.

spark jackal Mar 9, 2023, 9:07 AM

#

mm havent had any changes on the server

#

when I go to the URL mentioned in the error (https://api.stripe.com/) and look at the SSL details, sometimes I see a certificate which was renewed only yesterday, but other times I receive a certificate the expires in early April. That doesn't seem quite right to me, so it could be part of the problem

brittle dew Mar 9, 2023, 9:12 AM

#

Can you share a req_xxx ID or your acct_xxx?

spark jackal Mar 9, 2023, 9:14 AM

#

it's not getting far enough for there to be a request id - i'm using the stripe PHP wrapper and i suspect guzzle is failing

#

could it be related to this

#

acct_1038rB2B0N2DDYdB

brittle dew Mar 9, 2023, 9:18 AM

#

No, that's an ongoing issue related to availability of data in the Dashboard

#

Thanks, taking a look

spark jackal Mar 9, 2023, 9:20 AM

#

Thanks!

brittle dew Mar 9, 2023, 9:46 AM

#

Are you able to reproduce this issue from a different network?

spark jackal Mar 9, 2023, 9:47 AM

#

umm

#

well it looks like an issue between our web server and your API

#

rather than my local network

brittle dew Mar 9, 2023, 9:47 AM

#

Right, but are you able to initiate the API call(s) from your integration on a different server or locally?

spark jackal Mar 9, 2023, 9:48 AM

#

I could possibly try

brittle dew Mar 9, 2023, 9:48 AM

#

If so, do you see the same issues? We've no reports of other SSL issues, so this strikes us as a server configuration issue.

spark jackal Mar 9, 2023, 9:49 AM

#

we have 2 environments, one for dev and one for live

#

both are having the same issues

#

but they're from the same 'network' - part of AWS

#

ive just run the same test 5 times, the first 4 failed due to the SSL issue and the last one succeeded

brittle dew Mar 9, 2023, 9:51 AM

#

Then perhaps its a configuration issue with your AWS instance(s). Perhaps they're intercepting the HTTPS traffic and replacing the SSL?

spark jackal Mar 9, 2023, 9:51 AM

#

just sometimes? haha

brittle dew Mar 9, 2023, 9:52 AM

#

FWIW, you can temporarily disable the SSL verification in stripe-php: https://github.com/stripe/stripe-php/blob/master/lib/Stripe.php#L35

GitHub

stripe-php/Stripe.php at master · stripe/stripe-php

PHP library for the Stripe API. . Contribute to stripe/stripe-php development by creating an account on GitHub.

brittle dew Mar 9, 2023, 9:52 AM

#

spark jackal just sometimes? haha

Have you tried a network request from another server/localhost yet?

spark jackal Mar 9, 2023, 9:53 AM

#

one sec ill try disabling the cert verification

brittle dew Mar 9, 2023, 9:54 AM

#

We don't really recommend doing that permanently. You likely want to be verifying the authenticity of the API responses

#

But as a temporary measure its fine until root cause is resolved.

spark jackal Mar 9, 2023, 9:56 AM

#

ok switching that off seems to have fixed the issue on our dev server

#

ok so do you have any tips on how i could make the request to your APIs locally so i can test the ssl issue?

#

I just wanted to highlight this again in case you missed it to see if it might provide any clues:

#

Interestingly enough, when I go to the URL mentioned in the error (https://api.stripe.com/) and look at the SSL details, sometimes I see a certificate which was renewed only yesterday, but other times I receive a certificate the expires in early April.

brittle dew Mar 9, 2023, 10:03 AM

#

Bear with me a moment

spark jackal Mar 9, 2023, 10:03 AM

#

sure

brittle dew Mar 9, 2023, 10:09 AM

#

QQ: your servers are set to the correct time yes?

spark jackal Mar 9, 2023, 10:10 AM

#

umm yep

brittle dew Mar 9, 2023, 10:10 AM

#

i.e. UTC, and don't wrongly think the certs have expired.

spark jackal Mar 9, 2023, 10:10 AM

#

let me double check which timezone they're set to

brittle dew Mar 9, 2023, 10:10 AM

#

Ok, just wanting to check all avenues here. There's potentially something related at our end that may also be impacting you (just discovered it), but haven't confirmed yet.

spark jackal Mar 9, 2023, 10:14 AM

#

Thu Mar 9 10:13:54 UTC 2023

#

direct from the server yep

brittle dew Mar 9, 2023, 10:16 AM

#

thanks

#

Are you pinning our certificates by any chance?

spark jackal Mar 9, 2023, 10:18 AM

#

not that i'm aware of! how would i determine that?

brittle dew Mar 9, 2023, 10:22 AM

#

https://docs.aws.amazon.com/acm/latest/userguide/acm-bestpractices.html#best-practices-pinning

Best practices - AWS Certificate Manager

Learn best practices of AWS Certificate Manager (ACM) and integrated services.

#

It seems we issued new certs recently, but if your pinning them (which we don't recommend) then the ones you're app is using will have expired.

spark jackal Mar 9, 2023, 10:24 AM

#

ok - super weird that it's happening intermittently but ill forward this info on to our sysadmin team and see what we can figure out

#

thanks heaaaps for your help

brittle dew Mar 9, 2023, 10:25 AM

#

of course, do let us know if that doesn't resolve the issue.

spark jackal Mar 9, 2023, 10:26 AM

#

will do! hope you have a great day / evening wherever you are 🙂

brittle dew Mar 9, 2023, 10:26 AM

#

you too!

spark jackal Mar 9, 2023, 10:26 AM

#

you guys make a kick-ass product and api ❤️

#

just showing some tests using openssl s_client -showcerts -connect api.stripe.com:443

prisma ivy Mar 9, 2023, 10:41 AM

#

Hi! I'm taking over this thread.

#

Let me know if you have any other questions.

spark jackal Mar 9, 2023, 10:42 AM

#

Hi Soma, just trying to get to the bottom of this SSL issue :0

brittle dew Mar 9, 2023, 10:43 AM

#

Have you confirmed whether you're pinning the certificates? https://stripe.com/docs/tls-certificates#certificate-pinning

TLS Certificates

Learn how to make sure your integration securely communicates with Stripe.

spark jackal Mar 9, 2023, 10:44 AM

#

i have yes, we're not pinning certificates

brittle dew Mar 9, 2023, 10:44 AM

#

api.stripe.com can resolve to many IPs (https://stripe.com/docs/ips#ip-addresses) some of which may have the old certificate still (that your app is using). Which likely explains why the occasional request is fine.

Domains and IP Addresses

Ensure your integration is always communicating with Stripe.

#

The internal issue I referred to earlier was related to certificate pinning.

spark jackal Mar 9, 2023, 10:47 AM

#

That makes sense. Is it possible that one of the IPs is being served with an old / expired cert?

brittle dew Mar 9, 2023, 10:59 AM

#

Still checking on this internally, bear with us.

brittle dew Mar 9, 2023, 11:31 AM

#

Hey there, we're rolling back some newly revised certificates which should hopefully resolve this

#

Will let you know when that's done

spark jackal Mar 9, 2023, 11:43 AM

#

Ahh fantastic ok! Thanks for the update

brittle dew Mar 9, 2023, 12:25 PM

#

Ok, I believe this should now be mitigated.

spark jackal Mar 9, 2023, 12:47 PM

#

Fantastic, thanks for that. I’ll switch the certificate verification back on in the morning and test it all out 🙂

brittle dew Mar 9, 2023, 12:49 PM

#

np. If still affected, I'd recommend writing in to support: http://support.stripe.com/contact

Stripe: Help & Support

Find help and support for Stripe. Our support center provides answers on all types of situations, including account information, charges and refunds, and subscriptions information. Get your questions answered and find international support for Stripe.

#gkleinig