ESM fold prediction service is broken

[tomgoddard]

The ESM fold prediction web page is broken. I'd like to know if the fold prediction service is no longer maintained. I added ESM fold prediction to the widely used ChimeraX molecular visualization program and am wondering if I need to remove it from our software.

Thanks!

Tom Goddard
ChimeraX developer
University of California, San Francisco

Here are details. The broken fold prediction web page is

https://esmatlas.com/resources?action=fold

Pasting any sequence such as

GENGEIPLEIRATTGAEVDTRAVTAVEMTEGTLGIFRLPEEDYTALENFRYNRVAGENWKPASTVIYVGGTYARLCAYAPYNSVEFKNSSLKTEAGLTMQTYAAEKDMRFAVSGGDEVWKKTPTAN

and pressing the enter key gives the message

"Error: There was an error"

Similarly the ESM folding web service as described here https://esmatlas.com/about#api

https://api.esmatlas.com/foldSequence/v1/pdb/

is broken. For instance

$ curl -X POST --data "GENGEIPLEIRATTGAEVDTRAVTAVEMTEGTLGIFRLPEEDYTALENFRYNRVAGENWKPASTVIYVGGTYARLCAYAPYNSVEFKNSSLKTEAGLTMQTYAAEKDMRFAVSGGDEVWKKTPTAN" https://api.esmatlas.com/foldSequence/v1/pdb/

gives error

{"message": "Internal server error"}

These errors may be due to an SSL certificate error on the Meta server. An ESM prediction can be run from the ChimeraX molecular visualization program (menu Tools / Structure Prediction / ESMFold) and the error message is

requests.exceptions.SSLError: HTTPSConnectionPool(host='api.esmatlas.com', port=443): Max retries exceeded with url: /foldSequence/v1/pdb (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)')))

Checking the certificate for api.esmatlas.com issued by DigiCert using https://www.digicert.com/help/ reports

"The server is not sending the required intermediate certificate.
This server needs to be configured to include DigiCert's intermediate certificate to avoid trust errors in web browsers."

[tomsercu]

Thanks for flagging this. Your analysis around certificate issue could be pointing in the right direction as we got that certificate about a year ago when we were still at Meta.
Let me see if we can manage a quickfix about this from the outside.
In the next couple of months we would expect there to be a solution to have an API endpoint for ESMFold to be supported long-term

[tomgoddard]

Thanks!

[nikita-smetanin]

Hi, thanks for spotting this. We'll be renewing the certificate this week.

[tomsercu]

Hi there Nikita 👋 Thanks for looking into this!

[tomgoddard]

DigiCert who issued the certificate says the current esmatlas.com certificate is valid from Sept 25, 2023 to Sept 22, 2024. So the problem does not appear to be that it is expired. Here is the report from DigiCert's SSL certificate checker.

[StephaneRedon]

Hello,

Thank you for this great API (and awesome research)!

This is just to confirm we're seeing the same issue here (integration in the SAMSON molecular design platform). From our server, when we do

curl -X POST --data "AAAAAAAAAA" https://api.esmatlas.com/foldSequence/v1/pdb/

we get

curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

and

echo | openssl s_client -showcerts -servername api.esmatlas.com -connect api.esmatlas.com:443

appears to report that the chain is broken

CONNECTED(00000003)
depth=0 C = US, ST = California, L = Menlo Park, O = "Meta Platforms, Inc.", CN = *.esmatlas.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = California, L = Menlo Park, O = "Meta Platforms, Inc.", CN = *.esmatlas.com
verify error:num=21:unable to verify the first certificate
verify return:1
[...]

Glad to know there are plans for a long-term supported API!

Thanks again,
Best,

Stephane

[StephaneRedon]

Poke 😀

[tomgoddard]

I'd also appreciate an update. We are releasing a new version of our ChimeraX molecular visualization software and need to decide if I remove ESMFold prediction.

[tomsercu]

It looks like everyting works again from my side. Do people still see issues? What kind of error message do you get from the API?

[StephaneRedon]

Thanks for your reply. I still have the exact same errors as in my message above, copied again here :

From our server, when we do

curl -X POST --data "AAAAAAAAAA" https://api.esmatlas.com/foldSequence/v1/pdb/

we get

curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

and

echo | openssl s_client -showcerts -servername api.esmatlas.com -connect api.esmatlas.com:443

appears to report that the chain is broken

CONNECTED(00000003)
depth=0 C = US, ST = California, L = Menlo Park, O = "Meta Platforms, Inc.", CN = *.esmatlas.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = California, L = Menlo Park, O = "Meta Platforms, Inc.", CN = *.esmatlas.com
verify error:num=21:unable to verify the first certificate
verify return:1
[...]

Thanks,
Best,

Stephane

[tomsercu]

@nikitos9000 Any chance you can see what's going on from your side?

[tomgoddard]

I also get the SSL certificate verification failure on an Ubuntu 22.04 LTS system, but not on a macOS 13.5.2 system. Here is the error from Ubuntu 22.04:

$ curl -X POST --data "GENGEIPLEIRATTGAEVDTRAVTAVEMTEGTLGIFRLPEEDYTALENFRYNRVAGENWKPASTVIYVGGTYARLCAYAPYNSVEFKNSSLKTEAGLTMQTYAAEKDMRFAVSGGDEVWKKTPTAN" https://api.esmatlas.com/foldSequence/v1/pdb/
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

I'm not too knowledgable about SSL certificates but each computer has a list of root certificates usually provided by the operating system. And that is very likely the source of the problem, that Ubuntu does not have a needed certificate. Also ChimeraX calling ESMFold on Mac also fails because it uses the SSL root certificates provided by the Python certifi module which does not allow api.esmatlas.com to be verified. So the problem is wide-spread and has to be fixed by Meta properly setting up the SSL certificate for api.esmatlas.com.

DigitCert's SSL checker (https://www.digicert.com/help/) continues to say api.esmatlas.com is not sending the required intermediate certificate, pasted below. And DigiCert is the issuer of the esmatlas.com certificate so that is very likely the problem. It should be easy for Meta IT person to fix this routine SSL certificate setup issue.

[tomgoddard]

Here's another screen snapshot showing the DigiCert SSL certificate problem for api.esmatlas.com. My snapshot in the previous image obscured some of the web page.

[nikita-smetanin]

Yes sorry we have some troubles with the certificate, but you still can access the API if you ignore it with e.g. curl ... --insecure. We'll be fixing this at some point of time

[StephaneRedon]

Thank you for your reply. The curl example was just to easily show what's going on. Our server actually accesses the API using java, and I'm expecting many others have similar issues.

Thanks again,
best,

Stephane

[tomgoddard]

The ChimeraX app access the server via Python requests and enforces the certificate check. The DigiCert error says clearly what the problem is and provides links to how to fix it.

The server is not sending the required intermediate certificate.

This server needs to be configured to include DigiCert's intermediate certificate to avoid trust errors in web browsers.

If you manage this server, you can download the file from this link or from your customer account area.

Follow the directions on our certificate installation guide to install the missing intermediate.

If you have any problems correcting this issue, please contact our helpful support team and we would be happy to assist.

[falatfernando]

Any solutions yet?

[picousse]

Using PopOS (ubuntu) this does not seem te be resolved yet?

[buerbaumer]

Hi all,
Many thanks to the META team for sharing this great https://api.esmatlas.com/foldSequence endpoint! What a tool! Wow!

For those using
a.) the requests library in python and
b.) cannot wait for the SSL fix on META side endpoint and
c.) got a waiver from your IT-security :-),
change
response = requests.post('https://api.esmatlas.com/foldSequence/v1/pdb/', headers=headers, data=sequence)
to
response = requests.post('https://api.esmatlas.com/foldSequence/v1/pdb/', headers=headers, data=sequence, verify=False)
for the time being.

Regards,
Harald