Error When Trying to Connect to Octoprint Via PrusaSlicer on Linux

[chemputer]

Version

2.2.0rc4, as well as 2.1.1, both have the issue. I've also tried both the .appimage versions, and the .tar.gz versions.

Operating system type + version

POP OS! 19.10 (based on Ubuntu 19.10) uname -a output: Linux (hostname) 5.3.0-7629-generic #31~1581628825~19.10~f90b7d5-Ubuntu SMP Fri Feb 14 19:56:45 UTC x86_64 x86_64 x86_64 GNU/Linux

Behavior

• Describe the problem
  I am attempting to connect to my octoprint instance via the built-in mechanism. It fails, saying the following in a pop-up window whenever I click test. This works aboslutely fine on my Windows 10 machine, running the same PrusaSlicer version, with the same OctoPrint instance, same hostname, and API key. They're both on the same network.

I've tried adding CA files, varying from Let's Encrypt's own, to the root certificate that my own browser seems to be accepting just fine, but nothing works. I suspect that it is due to the haproxy?

Could not connect to OctoPrint: Peer certificate cannot be authenticated with given CA certificates:
SSL certificate problem: unable to get local issuer certificate
[Error 60]
Note: OctoPrint version at least 1.1.0 is required.

• Steps needed to reproduce the problem
  Set up an octoprint version 1.4.0 instance, set it up behind haproxy, setup with a Let's Encrypt wildcard cert for one of my domains. I followed this guide to setup octoprint and haproxy, and then this guide to enable SSL, but instead of a self-signed cert, I used a Let's Encrypt Wildcard Cert. This is all running on an arm based Rock64. Try connecting PrusaSlicer on Linux to it.

• Expected Results
  For it to connect.

• Actual Results
  It fails to connect, giving the error mentioned above, and the cmd line output below when using --loglevel 4.

Is this a new feature request? No.

[2020-03-17 20:53:34.961254] [0x00007fba7440d540] [info]    OctoPrint: Get version at: http://octo.turnerb.com/api/version
[2020-03-17 20:53:34.981864] [0x00007fba7440d540] [error]   OctoPrint: Error getting version: Peer certificate cannot be authenticated with given CA certificates:
SSL certificate problem: unable to get local issuer certificate
[Error 60], HTTP 0, body: ``
[2020-03-17 20:54:14.104138] [0x00007fba7440d540] [info]    OctoPrint: Get version at: https://octo.turnerb.com/api/version
[2020-03-17 20:54:14.116921] [0x00007fba7440d540] [error]   OctoPrint: Error getting version: Peer certificate cannot be authenticated with given CA certificates:
SSL certificate problem: unable to get local issuer certificate
[Error 60], HTTP 0, body: ``

[bubnikv]

Does this help?

#2018 (comment)

[chemputer]

Well, I haven't tried it, but no. I don't want to use a self-signed certificate as I have a working, Let's Encrypt Certificate. I know that, as it works on every other place I use it (web servers, the octoprint server), and browsers and apps, and even the Windows version of PrusaSlicer recognizes it fine, and works. If you aren't familiar with those, they're certificates that are free, but that are signed by LE and countersigned by two other major CAs. PrusaSlicer should only need a CA file for self-signed SSL certs. Mine isn't self-signed. I'm not connecting via hostname or IP, I'm connecting via FQDN, with a the hostname being a subdomain of one of my domains, and DNS is set up appropriately. This is an issue with PrusaSlicer on Linux, not my setup. I wish it weren't.

…

On Mar 19, 2020, 11:42 AM, at 11:42 AM, "Vojtěch Bubník" ***@***.***> wrote: Does this help? #2018 (comment) -- You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub: #3857 (comment)

[bubnikv]

Could it be that your issue is the same as #3851 ?
That is, our build searches system certificates where they are NOT installed on your system?

[chemputer]

That's certainly possible. Is it specifically looking for a specific version of the file /etc/ssl/certs/ca-certificates.crt? If so, then yes, that could be the issue. In the /etc/ssl/certs folder, there are loads of .pem files, for all the root CAs, and a ca-certificates.crt Is there a way to get the ca-certificates.crt that it's looking for and just put it there? The only thing that makes me worry about that not being the problem is that even when specifying a CA file that I know will work with my cert in PrusaSlicer, it gives the same error. Here's the hash of the file, 794c2316e9c8d7e1a866dedcb160e916 ca-certificates.crt and I've attached it, as well, if that helps. Annnnd since I jumped the gun and replied by email (I'm editing this after the fact to add the cert), markdown doesn't work. Good to know. [ca-certificates.crt.txt](https://github.com/prusa3d/PrusaSlicer/files/4355720/ca-certificates.crt.txt)

[chemputer]

After further investigation, I do not believe it is similar to issue #3851. Here's the full output of PrusaSlicer from me opening it from the terminal, with --loglevel 5, going straight to printer settings, and hitting the test button on the octoprint setup. It looks, to me, like it's having issues with haproxy?

 % /opt/PrusaSlicer/prusa-slicer --loglevel 5 
[2020-03-19 12:30:43.224361] [0x00007f98c7da7540] [info]    Checking if indices need to be installed from resources...
[2020-03-19 12:30:43.276229] [0x00007f98c7da7540] [trace]   System language detected (user locales and such): en_US
[2020-03-19 12:30:43.276251] [0x00007f98c7da7540] [trace]   Switching wxLocales to en_US
[2020-03-19 12:30:43.657367] [0x00007f98c7da7540] [info]    Undo / Redo snapshot taken: New Project, Undo / Redo stack memory: 0MB Resident memory: 59MB; Shared memory: 41MB; Private memory: 17MB; Peak memory usage: 59MB
[2020-03-19 12:30:45.979216] [0x00007f98c7da7540] [info]    Checking for cached configuration updates...
[2020-03-19 12:30:45.979321] [0x00007f98c7da7540] [info]    Confing bundle not installed for vendor BIBO2Touch, skipping: 
[2020-03-19 12:30:45.979450] [0x00007f98c7da7540] [info]    Confing bundle not installed for vendor PrusaResearch, skipping: 
[2020-03-19 12:30:45.979518] [0x00007f98c7da7540] [info]    Confing bundle not installed for vendor BIBO, skipping: 
[2020-03-19 12:30:45.979557] [0x00007f98c7da7540] [info]    Confing bundle not installed for vendor LulzBot, skipping: 
[2020-03-19 12:30:45.980481] [0x00007f98c7da7540] [debug]   Vendor: Creality, version installed: 0.0.2, version cached: 0.0.2
[2020-03-19 12:30:45.980507] [0x00007f98c7da7540] [info]    No configuration updates available.
[2020-03-19 12:30:46.001038] [0x00007f98c4e18700] [info]    Downloading PrusaSlicer online version from: `https://files.prusa3d.com/wp-content/uploads/repository/PrusaSlicer-settings-master/live/PrusaSlicer.version`
*   Trying 185.115.1.124...
* TCP_NODELAY set
* Connected to files.prusa3d.com (185.115.1.124) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=files.prusa3d.com
*  start date: Mar 17 08:24:00 2020 GMT
*  expire date: Jun 15 08:24:00 2020 GMT
*  subjectAltName: host "files.prusa3d.com" matched cert's "files.prusa3d.com"
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
> GET /wp-content/uploads/repository/PrusaSlicer-settings-master/live/PrusaSlicer.version HTTP/1.1
Host: files.prusa3d.com
User-Agent: PrusaSlicer/2.2.0-rc4+linux-x64
Accept: */*

< HTTP/1.1 200 OK
< Server: nginx
< Date: Thu, 19 Mar 2020 16:30:47 GMT
< Content-Length: 6
< Connection: keep-alive
< Last-Modified: Thu, 19 Mar 2020 16:16:21 GMT
< ETag: "6-5a1377d53d265"
< Accept-Ranges: bytes
< 
* Connection #0 to host files.prusa3d.com left intact
[2020-03-19 12:30:48.012612] [0x00007f98c4e18700] [info]    Got PrusaSlicer online version: `2.1.1`. Sending to GUI thread...
[2020-03-19 12:30:48.013842] [0x00007f98c4e18700] [info]    Syncing configuration cache
[2020-03-19 12:30:48.013864] [0x00007f98c4e18700] [warning] No such vendor: BIBO2Touch
[2020-03-19 12:30:48.013872] [0x00007f98c4e18700] [warning] No such vendor: PrusaResearch
[2020-03-19 12:30:48.013880] [0x00007f98c4e18700] [warning] No such vendor: BIBO
[2020-03-19 12:30:48.013887] [0x00007f98c4e18700] [warning] No such vendor: LulzBot
[2020-03-19 12:30:48.013905] [0x00007f98c4e18700] [info]    Downloading index for vendor: Creality
[2020-03-19 12:30:48.013940] [0x00007f98c4e18700] [info]    Get: `http://files.prusa3d.com/wp-content/uploads/repository/PrusaSlicer-settings-master/live/Creality//index.idx`
	-> `/home/turnerb/.PrusaSlicer/cache/Creality.idx-update`
	via tmp path `/home/turnerb/.PrusaSlicer/cache/Creality.idx-update.5933.download`
*   Trying 185.115.1.124...
* TCP_NODELAY set
* Connected to files.prusa3d.com (185.115.1.124) port 80 (#0)
> GET /wp-content/uploads/repository/PrusaSlicer-settings-master/live/Creality//index.idx HTTP/1.1
Host: files.prusa3d.com
User-Agent: PrusaSlicer/2.2.0-rc4+linux-x64
Accept: */*

< HTTP/1.1 301 Moved Permanently
< Server: nginx
< Date: Thu, 19 Mar 2020 16:30:48 GMT
< Content-Type: text/html; charset=iso-8859-1
< Content-Length: 398
< Connection: keep-alive
< Location: https://files.prusa3d.com/wp-content/uploads/repository/PrusaSlicer-settings-master/live/Creality/index.idx
< 
* Ignoring the response-body
* Connection #0 to host files.prusa3d.com left intact
* Issue another request to this URL: 'https://files.prusa3d.com/wp-content/uploads/repository/PrusaSlicer-settings-master/live/Creality/index.idx'
*   Trying 185.115.1.124...
* TCP_NODELAY set
* Connected to files.prusa3d.com (185.115.1.124) port 443 (#1)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=files.prusa3d.com
*  start date: Mar 17 08:24:00 2020 GMT
*  expire date: Jun 15 08:24:00 2020 GMT
*  subjectAltName: host "files.prusa3d.com" matched cert's "files.prusa3d.com"
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
> GET /wp-content/uploads/repository/PrusaSlicer-settings-master/live/Creality/index.idx HTTP/1.1
Host: files.prusa3d.com
User-Agent: PrusaSlicer/2.2.0-rc4+linux-x64
Accept: */*

< HTTP/1.1 200 OK
< Server: nginx
< Date: Thu, 19 Mar 2020 16:30:48 GMT
< Content-Length: 585
< Connection: keep-alive
< Last-Modified: Thu, 19 Mar 2020 16:16:21 GMT
< ETag: "249-5a1377d53e5f2"
< Accept-Ranges: bytes
< 
* Connection #1 to host files.prusa3d.com left intact
[2020-03-19 12:30:48.744232] [0x00007f98c4e18700] [debug]   Got index for vendor: Creality: current version: 0.0.2, recommended version: 0.0.2
[2020-03-19 12:30:50.838755] [0x00007f98c7da7540] [info]    OctoPrint: Get version at: http://octo.turnerb.com/api/version
*   Trying 192.168.20.22...
* TCP_NODELAY set
* Connected to octo.turnerb.com (192.168.20.22) port 80 (#0)
> GET /api/version HTTP/1.1
Host: octo.turnerb.com
User-Agent: PrusaSlicer/2.2.0-rc4+linux-x64
Accept: */*
X-Api-Key: B4740BA1A28E471EBE3BF2A92C0458EC

< HTTP/1.1 301 Moved Permanently
< Content-length: 0
< Location: https://octo.turnerb.com/api/version
< 
* Connection #0 to host octo.turnerb.com left intact
* Issue another request to this URL: 'https://octo.turnerb.com/api/version'
*   Trying 192.168.20.22...
* TCP_NODELAY set
* Connected to octo.turnerb.com (192.168.20.22) port 443 (#1)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 1
[2020-03-19 12:30:50.977718] [0x00007f98c7da7540] [error]   OctoPrint: Error getting version: Peer certificate cannot be authenticated with given CA certificates:
SSL certificate problem: unable to get local issuer certificate
[Error 60], HTTP 0, body: ``

This is my haproxy.cfg on my octoprint server. I'm not sure if it's relevant, but if there's anything I can change to make it work, I would love to know, assuming that's the cause.

global
        maxconn 4096
        user haproxy
        group haproxy
        daemon
	log 127.0.0.1 local1 debug
	tune.ssl.default-dh-param 2048

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        retries 3
        option redispatch
        option http-server-close
        option forwardfor
        maxconn 2000
        timeout connect 5s
        timeout client  15min
        timeout server  15min

frontend public
        bind :::80 v4v6
        bind :::443 v4v6 ssl crt /etc/haproxy/ssl/turnerb-wildcard-ecdsa.pem
        option forwardfor except 127.0.0.1
        redirect scheme https code 301 if !{ ssl_fc }
        use_backend webcam if { path_beg /webcam/ }
	#	use_backend gstreamer if { path_beg /gstreamer/ }
	use_backend webcam2 if { path_beg /webcam2/ }
	default_backend octoprint

backend octoprint
        acl needs_scheme req.hdr_cnt(X-Scheme) eq 0

        reqrep ^([^\ :]*)\ /(.*) \1\ /\2
        reqadd X-Scheme:\ https if needs_scheme { ssl_fc }
        reqadd X-Scheme:\ http if needs_scheme !{ ssl_fc }
        option forwardfor
        server octoprint1 127.0.0.1:5000
        errorfile 503 /etc/haproxy/errors/503.http

backend webcam
        reqrep ^([^\ :]*)\ /webcam/(.*)     \1\ /\2
        server webcam1  127.0.0.1:8080
        errorfile 503 /etc/haproxy/errors/503.http

backend webcam2
        reqrep ^([^\ :]*)\ /webcam2/(.*)     \1\ /\2
        server webcam12  127.0.0.1:8081
        errorfile 503 /etc/haproxy/errors/503.http

[chemputer]

Okay, I decided on the nuclear option, to just bypass haproxy completely, and use :5000 (the port directly to octoprint) instead of using the SSL secured haproxy, so it's working, but not "as it should". It's just really, really weird that it works fine with haproxy on Windows, but not on Linux. Is that something that could be fixed?

[bubnikv]

The developer who was responsible for the OctoPrint integration is no more with us and I personally don't know the details of the Linux SSL certificates. I don't know whether you are doing something wrong, or whether PrusaSlicer is broken in general, or whether this is some distro specific / binary incompatibility issue. If you are a developer, it would be great if you can compile PrusaSlicer from the sources and test it. It may be that the build will work correctly as it it will match your distro. You may also try the non-appimage binary build, the AppImage integration may be the culprit, see the following discussion: #3388 (comment) Did PrusaSlicer OctoPrint over SLL worked at all in some older versions for you? čt 19. 3. 2020 v 17:41 odesílatel Ben Turner <notifications@github.com> napsal:

…

Okay, I decided on the nuclear option, to just bypass haproxy completely, and use :5000 (the port directly to octoprint) instead of using the SSL secured haproxy, so it's working, but not "as it should". It's just really, really weird that it works fine with haproxy on Windows, but not on Linux. Is that something that could be fixed? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#3857 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABMPSI4F5GZX6XTKTNCVL4DRIJDJ5ANCNFSM4LOBAACQ> .

[Area5142]

A quick way to run the PrusaSlicer binary without AppImage container redirection is to extract the files from the AppImage:
./PrusaSlicer-2.2.0-rc4+linux-x64-202003151142.AppImage --appimage-extract

This will extract to a local directory. Go to:

cd squashfs-root/src/bin/bin
./prusa-slicer

This will run the binary outside the AppImage container.
I use this as test of 3D Mouse detection problem in #3388.

[chemputer]

That's good to know, I wasn't aware that was functionality in appimage. That's pretty neat.

I've tested both the prebuilt Linux binary on it's own, as well as the appimage. I haven't tried extracting it from the appimage, though. I can't imagine that would give different results, but I'll try it if it might help.

As far as the previous question whether or not it worked in a previous version, I've only tested 2.1.1 and 2.2.0rc4, and neither of them seem to work with octoprint over SSL (at least via haproxy). The problem is the same on both.

If you look at the log I posted from running the prebuilt Linux binary prusa-slicer from terminal with --loglevel 5, it shows that it's "unable to get local issuer certificate".

Again, strangely, this works perfectly on Windows 10. I can't figure out which CA file it's using to do so.

I have not tried building it from source yet, but I will try that to see if it makes any difference.

I'm happy to fire up a few VMs and test with different distros if that would be beneficial.

I'll also see if switching my haproxy.cfg back (temporarily, of course) to HTTP only and removing the SSL element 'fixes' anything (as it works fine when connecting directly to the OctoPrint instance over HTTP, which I'm kind of assuming at this point is probably just what I will have to live with), and given the logs from running it in the terminal I'm fairly sure it's an SSL issue.

I appreciate the help from both of you.

[bubnikv]

Note to myself.
I suppose we need to detect the distro and estimate location of the certificate authority file in runtime from our binary builds and we need to set

curl_easy_setopt(curl_handle, CURLOPT_CAINFO, "path_to_ca_file");

https://curl.haxx.se/libcurl/c/CURLOPT_CAINFO.html

If you compile PrusaSlicer with static dependencies, you may want to edit
deps/deps-linux.cmake
and replace
--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt
with your location. I bet it will work then.

I believe the following is reasonably up to date:
https://github.com/prusa3d/PrusaSlicer/blob/master/doc/How%20to%20build%20-%20Linux%20et%20al.md

[Area5142]

@chemputer
If you need to compile PrusaSlicer from source take a look at the shell script I posted on #3388 (BuildPS.sh.zip). It will install needed tools and build the binary on Linux Mint 19.3 x64 (Ubuntu).

[bubnikv]

I'm happy to fire up a few VMs and test with different distros if that would be beneficial.

You may certainly try that. Not many people connect to OctoPrint over SSL, and even less on Linux and yet even less on non-Debian based distros, so your is really an edge case.

I have asked @tamasmeszaros from our team to test the SSL connection to OctoPrint as he has a Raspberry PI at home and he is a avid Linux user. We may ask him to detect the CA file in runtime, though it feels like a possible security risk to me.

[bubnikv]

What a hell

https://gitlab.com/probono/platformissues/blob/master/README.md#certificates

openssl/openssl#7481

[bubnikv]

You may likely fix it for yourself by symlinking your system's certificate file to the Debian way, for example on Fedora, you may try
ln -s /etc/pki/tls/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt
but it is quite an invasive hack.