Photoshop API SSL error server-to-server

Report · May 26, 2023

ClientId:
0e6d8028a3d340fe9c7202f7a3151ef7

Description of issue:
We are trying to connect photoshop to the authorization service from a remote server, it is located in Germany Server IP:
91.107.225.32, but we get a ssl error due to which we cannot connect to you for authorization. We are using python urllib library for making requests

Error message:
Traceback (most recent call last):
File "/usr/local/lib/python3.8/urllib/request.py", line 1354, in do_open
h.request(req.get_method(), req.selector, req.data, headers,
File "/usr/local/lib/python3.8/http/client.py", line 1256, in request
self._send_request(method, url, body, headers, encode_chunked)
File "/usr/local/lib/python3.8/http/client.py", line 1302, in _send_request
self.endheaders(body, encode_chunked=encode_chunked)
File "/usr/local/lib/python3.8/http/client.py", line 1251, in endheaders
self._send_output(message_body, encode_chunked=encode_chunked)
File "/usr/local/lib/python3.8/http/client.py", line 1011, in _send_output
self.send(msg)
File "/usr/local/lib/python3.8/http/client.py", line 951, in send
self.connect()
File "/usr/local/lib/python3.8/http/client.py", line 1425, in connect
self.sock = self._context.wrap_socket(self.sock,
File "/usr/local/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/local/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/local/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:1131)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/app/core/integrations/photoshop/api.py", line 92, in token
response = urllib.request.urlopen(request).read()
File "/usr/local/lib/python3.8/urllib/request.py", line 222, in urlopen
return opener.open(url, data, timeout)
File "/usr/local/lib/python3.8/urllib/request.py", line 525, in open
response = self._open(req, data)
File "/usr/local/lib/python3.8/urllib/request.py", line 542, in _open
result = self._call_chain(self.handle_open, protocol, protocol +
File "/usr/local/lib/python3.8/urllib/request.py", line 502, in _call_chain
result = func(*args)
File "/usr/local/lib/python3.8/urllib/request.py", line 1397, in https_open
return self.do_open(http.client.HTTPSConnection, req,
File "/usr/local/lib/python3.8/urllib/request.py", line 1357, in do_open
raise URLError(err)
urllib.error.URLError: <urlopen error EOF occurred in violation of protocol (_ssl.c:1131)>

root@core-worker-1:~# curl -v https://ims-na1.adobelogin.com
* Trying 34.250.85.196:443...
* TCP_NODELAY set
* Connected to ims-na1.adobelogin.com (34.250.85.196) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to ims-na1.adobelogin.com:443
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to ims-na1.adobelogin.com:443

What happened:
SSL error

What were you expecting to happen:
Expected to receive a response from your server with JWT token

Code payload: (Please attach as a txt. file)

Report · Jun 02, 2023

Are you still experiencing this?

Report · Jun 05, 2023

Yes, we are still experiencing this, we have been waiting for a response from technical support for many days.
Can anyone help us?

Report · Jun 05, 2023

I want to make sure I'm reading right - so you can't even do a curl w/o an error?

Report · Jun 05, 2023

Also, are you behind a proxy server?

Report · Jun 06, 2023

Yes, we can't make a request via curl.
This problem is only in the service for obtaining an authorization token.
On other requests, they send us a code 400, etc..., that there is no authorized token when sending the request.
(i.e. everything works as it should)

Report · Jun 06, 2023

Cool, and is there any kind of proxy or vpn involved?

Report · Jun 06, 2023

No proxy or VPN, the scheme is standard:
Load balancer -> nginx ingress -> service.
At the same time on another server in our Kubernetes cluster works fine without problems
But note that they do not respond to only one server!

Report · Jun 06, 2023

That's weird. But I have to say, if it works for one machine, and not the other, the problem has to be on your end somehow, right? (To be clear, not trying to deflect the blame here, but technically it does seem as if it's something machine specific.)

Report · Jun 06, 2023

Let me make it clear that the main service is available and responding, everything is fine.
Any other vendor works as well.

The only problem is with the authorization service because it cuts the connection.
If the problem is on our side, please specify what can cause it?

Report · Jun 06, 2023

Honestly I wouldn't know what to suggest outside of Googling, for example: https://stackoverflow.com/questions/45300911/curl-35-openssl-ssl-connect-ssl-error-syscall-in-connec.... There is an internal Slack for our service, will try to raise this here and see.

Report · Jan 16, 2024

It appears that you are having an SSL problem while attempting to connect to the Adobe authorization service from your remote server in Germany (Note: Location Mentioned As Per Question). The error indicates that there was an issue with the SSL handshake during the connection attempt.

Here are some steps you can use to troubleshoot and resolve the problem:

Check SSL/TLS Versions:

Make that your Python environment on the remote server supports the SSL/TLS versions required by the Adobe authorization service. You may need to update your Python version or alter your SSL/TLS settings.

Verify CA Certificates:

Confirm that your server's CA certificates are up to current. The error notice indicates that the certificate locations have been correctly set, but it is still a good idea to check for any issues with the CA certificates.

Check Server Connectivity:

To test connectivity to the Adobe authorization service, run the curl command. Based on the information you supplied, it appears that there may be an issue connecting to ims-na1.adobelogin.com. Check that your server can access Adobe's servers and that there are no network difficulties.

Firewall and Security Software:

Check that your server's outgoing connections are not being blocked by firewalls or other security tools. Check the server-side and network-level firewalls to make sure they are not interfering.

Verify IP Whitelisting:

Some services, such as Adobe, may require IP whitelisting in order to communicate with other servers. Confirm that your server's IP address (91.107.225.32) is whitelisted by Adobe Side.

SSL Debugging:

Enable SSL debugging in Python to obtain more information about the SSL handshake procedure. You can accomplish this by setting the PYTHONHTTPSVERIFY environment variable to zero before initiating the request. This can provide extra information about the SSL error.

----------------------------

Python Code:

import os
os.environ['PYTHONHTTPSVERIFY'] = '0'

----------------------------

Add this code before making the request, and then check the additional output for any SSL-related problems.

Contact Adobe Support:

If the problem persists, consider contacting Adobe support for help. They may have specific tips or insights into the mistake you're experiencing.

Remember to apply modifications carefully, especially when altering SSL/TLS configurations, and to ensure that your activities are consistent with security best practices.

-------------------------------------------------------------

To know more about SSL Handshake Errors 525 check the Blog:
https://www.cheapsslshop.com/blog/how-to-fix-ssl-handshake-failed-error-code-525

-------------------------------------------------------------

Adobe Community

Photoshop API SSL error server-to-server