SSL Cert Verification Error When Logging into MyPlex

[conallob]

When attempting to sign into my PlexPass account through PlexConnect, my AppleTV spins and spins and I see the following stack trace on my server running PlexConnect.

Stack Trace:

16:24:32 WebServer: File Not Found:
Traceback (most recent call last):
File "/usr/local/taku/PlexConnect/WebServer.py", line 229, in do_GET
XML = XMLConverter.XML_PMS2aTV(PMSaddress, self.path + query, options)
File "/usr/local/taku/PlexConnect/XMLConverter.py", line 241, in XML_PMS2aTV
(username, auth_token) = PlexAPI.MyPlexSignIn(parts[0], parts[1], options)
File "/usr/local/taku/PlexConnect/PlexAPI.py", line 583, in MyPlexSignIn
response = urlopener.open(request).read()
File "/usr/local/lib/python2.7/urllib2.py", line 431, in open
response = self._open(req, data)
File "/usr/local/lib/python2.7/urllib2.py", line 449, in _open
'_open', req)
File "/usr/local/lib/python2.7/urllib2.py", line 409, in _call_chain
result = func(*args)
File "/usr/local/lib/python2.7/urllib2.py", line 1240, in https_open
context=self._context)
File "/usr/local/lib/python2.7/urllib2.py", line 1197, in do_open
raise URLError(err)
URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)>

OS: FreeBSD 10.1-STABLE
Python Version: 2.7.9

I suspect PlexAPI.py needs to be tweaked to allow for custom SSL settings, such as a bundled CA file. I'm more familiar with requests instead of urllib2, but https://docs.python.org/2/library/ssl.html#ssl.SSLContext.load_verify_locations in combination with the Mozilla CA cert (see the certifi wrapper - https://pypi.python.org/pypi/certifi/ ) would be a good start

[freestream]

I can confirm that I have a similar issue with my installation. I'm also using FreeBSD with the current master (17197c2) and the versions bellow.

# python -V
Python 2.7.9
# python -c 'import ssl; print ssl.OPENSSL_VERSION'
OpenSSL 0.9.8za-freebsd 5 Jun 2014

This is my stacktrace:

00:12:08 WebServer: File Not Found:
Traceback (most recent call last):
  File "/opt/PlexConnect/WebServer.py", line 229, in do_GET
    XML = XMLConverter.XML_PMS2aTV(PMSaddress, self.path + query, options)
  File "/opt/PlexConnect/XMLConverter.py", line 241, in XML_PMS2aTV
    (username, auth_token) = PlexAPI.MyPlexSignIn(parts[0], parts[1], options)
  File "/opt/PlexConnect/PlexAPI.py", line 598, in MyPlexSignIn
    response = urlopener.open(request).read()
  File "/usr/local/lib/python2.7/urllib2.py", line 431, in open
    response = self._open(req, data)
  File "/usr/local/lib/python2.7/urllib2.py", line 449, in _open
    '_open', req)
  File "/usr/local/lib/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/usr/local/lib/python2.7/urllib2.py", line 1240, in https_open
    context=self._context)
  File "/usr/local/lib/python2.7/urllib2.py", line 1197, in do_open
    raise URLError(err)
URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)>

This is what happens when i try to login to my Plex account in my Apple TV. It can discover the Plex server but I cant by any means login to the Plex account. It does not matter what i write in the login form, I will always get the above stacktrace.

I'm not really familiar with python so I can't really say that my fix is the way to go but I managed to bypass the issue by adding import ssl on line 38 and ssl._create_default_https_context = ssl._create_unverified_context on line 378 in the file PlexAPI.py.

[IMNotMax]

@freestream You're great ! It works :)

[valyno]

Hello,

Thks for sharing.
I tried to find the location of where to insert the lines but I failed.
When I am going to the specific lines, I in the middle of nothing (I use nano to edit my files).
Would you mind giving some more details on where to insert the ones please?
Thks again,

Valyno

[freestream]

@valyno I hope this helps you. I guess you have a different version than the one I have.

Line 32-38

import sys
import struct
import time
import urllib2, socket, StringIO, gzip
from threading import Thread
import Queue
import ssl

Line 362-405

def getXMLFromPMS(baseURL, path, options={}, authtoken='', enableGzip=False):
    xargs = {}
    if not options==None:
        xargs = getXArgsDeviceInfo(options)
    if not authtoken=='':
        xargs['X-Plex-Token'] = authtoken

    dprint(__name__, 1, "URL: {0}{1}", baseURL, path)
    dprint(__name__, 1, "xargs: {0}", xargs)

    request = urllib2.Request(baseURL+path , None, xargs)
    request.add_header('User-agent', 'PlexConnect')
    if enableGzip:
        request.add_header('Accept-encoding', 'gzip')

    try:
        ssl._create_default_https_context = ssl._create_unverified_context
        response = urllib2.urlopen(request, timeout=20)
    except urllib2.URLError as e:
        dprint(__name__, 0, 'No Response from Plex Media Server')
        if hasattr(e, 'reason'):
            dprint(__name__, 0, "We failed to reach a server. Reason: {0}", e.reason)
        elif hasattr(e, 'code'):
            dprint(__name__, 0, "The server couldn't fulfill the request. Error code: {0}", e.code)
        return False
    except IOError:
        dprint(__name__, 0, 'Error loading response XML from Plex Media Server')
        return False

    if response.info().get('Content-Encoding') == 'gzip':
        buf = StringIO.StringIO(response.read())
        file = gzip.GzipFile(fileobj=buf)
        XML = etree.parse(file)
    else:
        # parse into etree
        XML = etree.parse(response)

    dprint(__name__, 1, "====== received PMS-XML ======")
    dprint(__name__, 1, XML.getroot())
    dprint(__name__, 1, "====== PMS-XML finished ======")

    #XMLTree = etree.ElementTree(etree.fromstring(response))

    return XML

[valyno]

@freestream thank you for your help, I will have a look!!

[BillyPrefect]

This is a couple months later. However, thank you. Same python version, same ssl version, same freebsd. I found I had a couple of differences in the code you suggested, but I went with your knowledge over my version. I was able to login without any grief after editing the PexAPI.py file to make the sections match. The second grouping was further down than in your range, but was easy enough to find based on the section lead.
Thank you! Immediately able to login to my plex account, and was able to play files without issues.