SSL Validation Issue (Error -40) to deny.io

[johnnyman727]

Originally reported on the forums, sending a request to deny.io throws an error on Tessel but completes in Node. Code and Error are below.

https.js

var https = require('https');

var options = {
  hostname: 'deny.io',
  port: 443,
  path: '/',
  method: 'GET'
};

var req = https.request(options, function(res) {
  console.log("statusCode: ", res.statusCode);
  console.log("headers: ", res.headers);

  res.on('data', function(d) {
    process.stdout.write(d);
  });
});

req.end();

req.on('error', function(e) {
  console.error(e);
});

Response:

➜  sandbox  tessel run https.js 
TESSEL! Connected to TM-00-04-f000da30-00584f36-4aa02586.
INFO Bundling directory /Users/Jon/Work/technical/sandbox (~2.75 MB)
INFO Deploying bundle (3.53 MB)...
INFO Running script...
Error: Could not validate SSL request (error -40)
stack traceback:
    [T]:src/colony/modules/dns.js:30: in function <[T]:src/colony/modules/dns.js:17>

[kwisatz]

I have a similar issue with the https module when using it with tessel.
My code is practically identical to what was posted above. Only that for my server, the error code is "-256":

Error: Could not validate SSL request (error -256)
stack traceback:
    [T]:src/colony/modules/dns.js:26: in function <[T]:src/colony/modules/dns.js:17>

When running this directly in nodejs, it works just fine.

[instanceof]

I am seeing a similar error when making https PUT calls to myjson.com after several iterations (~18) once a minute apart.

Error: Could not validate SSL request (error -256)
stack traceback:
    [T]:src/colony/modules/dns.js:30: in function <[T]:src/colony/modules/dns.js:17>

[dshanley]

Happening for me as well trying to POST using https library to Parse:

Error: Could not validate SSL request (error -178)
at _new (src/colony/lua/colony-init.lua:493)
at createSession ([T]:src/colony/modules/net.js:274)
at <anonymous> ([T]:src/colony/modules/net.js:249)

[johnnyman727]

Based on a short investigation, it looks like these errors are happening because the SSL library Tessel uses (axtls) may be too old to support newer forms of cryptography.

[amitm94305]

@johnnyman727 - I am running into this issue as well with my Tessel board. Do you folks have a plan to upgrade the SSL library ?

[johnnyman727]

@amitm94305, currently, we don't have plans to upgrade the SSL library but we will be releasing a proxy server solution soon which should get around this issue.

[amitm94305]

@johnnyman727 - Any update on when you will have a solution to this issue ?

[johnnyman727]

@amitm94305 Unfortunately, I don't have a definitive answer of when we'll have the proxy server readily available. If you'd like to do some beta testing, you can check out this branch and give it a try. We aren't fully supporting the proxy server at the moment but it should be more or less functional.

[josephwegner]

Wait... Honestly? You don't have plans to upgrade the SSL library? Isn't one of the major advantages of the Tessel that it has good WiFi support? And with the SSL Everywhere movement, and old protocols quickly being deprecated, that means I really can't do any useful calls with the Tessel?

A proxy server isn't really a solution. It will still have to be using an old SSL method, which means all of the data sent from my Tessel is insecure...

Is there a good reason not to update the SSL library? It seems to me that you're essentially removing the capability for any internet-dependent projects.

[jiahuang]

@josephwegner Wifi has never worked as well on Tessel as we would have liked, mainly due to our poor choice of using the CC3000 wifi chip. There are multiple issues with the chip's firmware that I won't go into here. TI, the chip manufacturer, has also stopped recommending the CC3000 for any new designs, and there hasn't been a firmware update fixing any of the issues we've reported.

At this point we're focusing our efforts on Tessel 2, which was designed with a chip used in wifi routers and doesn't have any of the issues that Tessel 1 does with wifi support.