{"action":"created","issue":{"url":"https://api.github.com/repos/pithos/pithos/issues/251","labels_url":"https://api.github.com/repos/pithos/pithos/issues/251/labels{/name}","comments_url":"https://api.github.com/repos/pithos/pithos/issues/251/comments","events_url":"https://api.github.com/repos/pithos/pithos/issues/251/events","html_url":"https://github.com/pithos/pithos/issues/251","id":115625802,"number":251,"title":"[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:646)","user":{"login":"ShapeShifter499","id":388665,"avatar_url":"https://avatars.githubusercontent.com/u/388665?v=3","gravatar_id":"","url":"https://api.github.com/users/ShapeShifter499","html_url":"https://github.com/ShapeShifter499","followers_url":"https://api.github.com/users/ShapeShifter499/followers","following_url":"https://api.github.com/users/ShapeShifter499/following{/other_user}","gists_url":"https://api.github.com/users/ShapeShifter499/gists{/gist_id}","starred_url":"https://api.github.com/users/ShapeShifter499/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ShapeShifter499/subscriptions","organizations_url":"https://api.github.com/users/ShapeShifter499/orgs","repos_url":"https://api.github.com/users/ShapeShifter499/repos","events_url":"https://api.github.com/users/ShapeShifter499/events{/privacy}","received_events_url":"https://api.github.com/users/ShapeShifter499/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/pithos/pithos/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2015-11-07T02:21:45Z","updated_at":"2015-11-10T00:14:27Z","closed_at":null,"body":"Hi, \r\n\r\nToday I started to get the error as stated in the title, the full log is below. Any ideas? Maybe Pandora changed something?\r\n\r\nRegards, Lance\r\n\r\n```\r\n[raansu@Y40-80 ~]$ pithos\r\nsys:1: PyGIWarning: GstPbutils was imported without specifying a version first. Use gi.require_version('GstPbutils', '1.0') before import to ensure that the right version gets loaded.\r\nsys:1: PyGIWarning: Gtk was imported without specifying a version first. Use gi.require_version('Gtk', '3.0') before import to ensure that the right version gets loaded.\r\n/usr/lib/python3.5/site-packages/pithos/pithos.py:1119: PyGIWarning: Notify was imported without specifying a version first. Use gi.require_version('Notify', '0.7') before import to ensure that the right version gets loaded.\r\n  self.window = NewPithosWindow(self, self.options)\r\nERROR - pandora:json_call:127 - Network error: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:646)>\r\nERROR - pandora:json_call:127 - Network error: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:646)>\r\nERROR - pandora:json_call:127 - Network error: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:646)>\r\n[raansu@Y40-80 ~]$ \r\n```"},"comment":{"url":"https://api.github.com/repos/pithos/pithos/issues/comments/155240542","html_url":"https://github.com/pithos/pithos/issues/251#issuecomment-155240542","issue_url":"https://api.github.com/repos/pithos/pithos/issues/251","id":155240542,"user":{"login":"glennimoss","id":586087,"avatar_url":"https://avatars.githubusercontent.com/u/586087?v=3","gravatar_id":"","url":"https://api.github.com/users/glennimoss","html_url":"https://github.com/glennimoss","followers_url":"https://api.github.com/users/glennimoss/followers","following_url":"https://api.github.com/users/glennimoss/following{/other_user}","gists_url":"https://api.github.com/users/glennimoss/gists{/gist_id}","starred_url":"https://api.github.com/users/glennimoss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glennimoss/subscriptions","organizations_url":"https://api.github.com/users/glennimoss/orgs","repos_url":"https://api.github.com/users/glennimoss/repos","events_url":"https://api.github.com/users/glennimoss/events{/privacy}","received_events_url":"https://api.github.com/users/glennimoss/received_events","type":"User","site_admin":false},"created_at":"2015-11-10T00:14:27Z","updated_at":"2015-11-10T00:14:27Z","body":"The cert for internal-tuner.pandora.com is not self-signed:\r\n```\r\n$ openssl s_client -connect internal-tuner.pandora.com:443\r\n# ... snip ...\r\nCertificate chain\r\n 0 s:/C=US/ST=California/L=Oakland/O=Pandora Media, Inc./OU=operations/CN=internal-tuner.pandora.com\r\n   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International Server CA - G3\r\n# ... snip ...\r\n```\r\n\r\nThe issuer \"VeriSign Class 3 International Server CA\" is not in my system-level CA store. (Ubuntu 15.04)\r\nHowever, the real issue here is what I would consider a misconfiguration of their server. If you run `openssl s_client -connect tuner.pandora.com:443 -showcerts` You will see it list 3 distinct certificates. That is each certificate in the trust chain down to the root VeriSign cert, which is contained in the system CA store. Now running `openssl s_client -connect internal-tuner.pandora.com:443 -showcerts` You will see that it lists exactly 1 certificate. The internal-tuner server should also be sending the entire cert chain. If it did, we wouldn't have any problems. Their cert is properly signed by a trusted authority, however the system has no way of knowing how to link it back to some known root authority. The server is supposed to show you how to get there.\r\n\r\nOf course, none of this really helps us DO anything about it :P"}}