SSLError api.twingly.com != tw.ly

[wkoot]

When running Client.query().execute() :

SSLError: hostname 'api.twingly.com' doesn't match either of '*.tw.ly', 'tw.ly'

Apparently the certificate served on api.twingly.com is not the right one :)

[walro]

Strange, https://api.twingly.com/analytics/Default.aspx seems to be working fine in Chrome, which version of Python are you running? And which operative system?

I'll check with the Python client shortly.

[walro]

The client works fine here, using Python 2.7.11 on OSX 10.11.5.

[wkoot]

Python 2.7.3, both on Centos 5.11 and Ubuntu 12.04 LTS
When accessing https://api.twingly.com/analytics/Default.aspx with curl, the correct cert is served

[wkoot]

See also the server certificate as seen by openssl: "Wildcard/CN=*.tw.ly"

# openssl s_client -showcerts -connect api.twingly.com:443
CONNECTED(00000003)
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/OU=Domain Control Validated/OU=EssentialSSL Wildcard/CN=*.tw.ly
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
-----BEGIN CERTIFICATE-----
MIIFPjCCBCagAwIBAgIRAPZCgGg4BeN0G7Lyt4IHKzMwDQYJKoZIhvcNAQELBQAw
gZAxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTYwNAYD
VQQDEy1DT01PRE8gUlNBIERvbWFpbiBWYWxpZGF0aW9uIFNlY3VyZSBTZXJ2ZXIg
Q0EwHhcNMTUxMDAxMDAwMDAwWhcNMTYxMTE1MjM1OTU5WjBVMSEwHwYDVQQLExhE
b21haW4gQ29udHJvbCBWYWxpZGF0ZWQxHjAcBgNVBAsTFUVzc2VudGlhbFNTTCBX
aWxkY2FyZDEQMA4GA1UEAwwHKi50dy5seTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAO2r0VW8xpS4ZkxMSrte25MnMphe0W51yEJD0ftThvKppTThw08L
K4z8NcWBu+fdYfH3BrPO2H/k3m+HSjmYYrObjMkCxFZIWp1COn9pzw14uRHcCDek
B0U/W/5sCLjAwI3NOEckVdG8tX1FaoHvMZHauTWedXgyWJ49InIoegF03beOh7w2
ZvOKpU0ve1x6GRxc/ICqcImXPledjn1scETAOzGK0HhqpkxhxzcxSsGvBKh2exIM
ocqXWWaOeH1jO1CeTz2ce85r8BOzohZBLhQIhL6Mh8GM4sO2S5bf7Q3+Y32Sp7tb
Nx26VCAXFHhavKl9gIZ2AfqrhzfYD8KAhlsCAwEAAaOCAcswggHHMB8GA1UdIwQY
MBaAFJCvajqUWgvYkOoSVnPfQ7Q6KNrnMB0GA1UdDgQWBBQPpKoOihS5s8NfALod
5sORH+90bjAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAU
BggrBgEFBQcDAQYIKwYBBQUHAwIwTwYDVR0gBEgwRjA6BgsrBgEEAbIxAQICBzAr
MCkGCCsGAQUFBwIBFh1odHRwczovL3NlY3VyZS5jb21vZG8uY29tL0NQUzAIBgZn
gQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5jb21vZG9jYS5jb20v
Q09NT0RPUlNBRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZlckNBLmNybDCBhQYI
KwYBBQUHAQEEeTB3ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LmNvbW9kb2NhLmNv
bS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0MCQG
CCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wGQYDVR0RBBIwEIIH
Ki50dy5seYIFdHcubHkwDQYJKoZIhvcNAQELBQADggEBABKsuXh9LDzDAPtCbW3P
OObLn6rg5+uD3CXUwXY1L/buSwryc9ypDw4AV1WYmdgIhYKx8bddR5RnQyGexR3C
DHKR82yZgNRH1HBP/lh5xzKmeXkqCLoMU1x1XMbfrHd+7wCAVU6Cc2onW0uE0DUR
8ozkIQ5inSo3QdjNR95CsOi2nT3ndc8faXibjmSHDHkCyPh++Z3c3xkqQ66EfHJV
FHeFTdmhA3R6Vhg0pGp7Aj90YXhPB38DtfmI6ZoJ5uNsdjlF/QFbmvYb7JWPQ9U7
LfbhVkqXxvZ3k/pd1YUnnHD/infM7lesIjhXpSEfrh4cxULmsrJWs2JBPdVh+7iV
D/8=
-----END CERTIFICATE-----
 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
-----BEGIN CERTIFICATE-----
MIIGCDCCA/CgAwIBAgIQKy5u6tl1NmwUim7bo3yMBzANBgkqhkiG9w0BAQwFADCB
hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV
BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQwMjEy
MDAwMDAwWhcNMjkwMjExMjM1OTU5WjCBkDELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR
Q09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZh
bGlkYXRpb24gU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAI7CAhnhoFmk6zg1jSz9AdDTScBkxwtiBUUWOqigwAwCfx3M28Sh
bXcDow+G+eMGnD4LgYqbSRutA776S9uMIO3Vzl5ljj4Nr0zCsLdFXlIvNN5IJGS0
Qa4Al/e+Z96e0HqnU4A7fK31llVvl0cKfIWLIpeNs4TgllfQcBhglo/uLQeTnaG6
ytHNe+nEKpooIZFNb5JPJaXyejXdJtxGpdCsWTWM/06RQ1A/WZMebFEh7lgUq/51
UHg+TLAchhP6a5i84DuUHoVS3AOTJBhuyydRReZw3iVDpA3hSqXttn7IzW3uLh0n
c13cRTCAquOyQQuvvUSH2rnlG51/ruWFgqUCAwEAAaOCAWUwggFhMB8GA1UdIwQY
MBaAFLuvfgI9+qbxPISOre44mOzZMjLUMB0GA1UdDgQWBBSQr2o6lFoL2JDqElZz
30O0Oija5zAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNV
HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgG
BmeBDAECATBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNvbW9kb2NhLmNv
bS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcB
AQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9E
T1JTQUFkZFRydXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21v
ZG9jYS5jb20wDQYJKoZIhvcNAQEMBQADggIBAE4rdk+SHGI2ibp3wScF9BzWRJ2p
mj6q1WZmAT7qSeaiNbz69t2Vjpk1mA42GHWx3d1Qcnyu3HeIzg/3kCDKo2cuH1Z/
e+FE6kKVxF0NAVBGFfKBiVlsit2M8RKhjTpCipj4SzR7JzsItG8kO3KdY3RYPBps
P0/HEZrIqPW1N+8QRcZs2eBelSaz662jue5/DJpmNXMyYE7l3YphLG5SEXdoltMY
dVEVABt0iN3hxzgEQyjpFv3ZBdRdRydg1vs4O2xyopT4Qhrf7W8GjEXCBgCq5Ojc
2bXhc3js9iPc0d1sjhqPpepUfJa3w/5Vjo1JXvxku88+vZbrac2/4EjxYoIQ5QxG
V/Iz2tDIY+3GH5QFlkoakdH368+PUq4NCNk+qKBR6cGHdNXJ93SrLlP7u3r7l+L4
HyaPs9Kg4DdbKDsx5Q5XLVq4rXmsXiBmGqW5prU5wfWYQ//u+aen/e7KJD2AFsQX
j4rBYKEMrltDR5FL1ZoXX/nUh8HCjLfn4g8wGTeGrODcQgPmlKidrv0PJFGUzpII
0fxQ8ANAe4hZ7Q7drNJ3gjTcBpUC2JD5Leo31Rpg0Gcg19hCC0Wvgmje3WYkN5Ap
lBlGGSW4gNfL1IYoakRwJiNiqZ+Gb7+6kHDSVneFeO/qJakXzlByjAA6quPbYzSf
+AZxAeKCINT+b72x
-----END CERTIFICATE-----
 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
-----BEGIN CERTIFICATE-----
MIIFdDCCBFygAwIBAgIQJ2buVutJ846r13Ci/ITeIjANBgkqhkiG9w0BAQwFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow
gYUxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMSswKQYD
VQQDEyJDT01PRE8gUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkq
hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAkehUktIKVrGsDSTdxc9EZ3SZKzejfSNw
AHG8U9/E+ioSj0t/EFa9n3Byt2F/yUsPF6c947AEYe7/EZfH9IY+Cvo+XPmT5jR6
2RRr55yzhaCCenavcZDX7P0N+pxs+t+wgvQUfvm+xKYvT3+Zf7X8Z0NyvQwA1onr
ayzT7Y+YHBSrfuXjbvzYqOSSJNpDa2K4Vf3qwbxstovzDo2a5JtsaZn4eEgwRdWt
4Q08RWD8MpZRJ7xnw8outmvqRsfHIKCxH2XeSAi6pE6p8oNGN4Tr6MyBSENnTnIq
m1y9TBsoilwie7SrmNnu4FGDwwlGTm0+mfqVF9p8M1dBPI1R7Qu2XK8sYxrfV8g/
vOldxJuvRZnio1oktLqpVj3Pb6r/SVi+8Kj/9Lit6Tf7urj0Czr56ENCHonYhMsT
8dm74YlguIwoVqwUHZwK53Hrzw7dPamWoUi9PPevtQ0iTMARgexWO/bTouJbt7IE
IlKVgJNp6I5MZfGRAy1wdALqi2cVKWlSArvX31BqVUa/oKMoYX9w0MOiqiwhqkfO
KJwGRXa/ghgntNWutMtQ5mv0TIZxMOmm3xaG4Nj/QN370EKIf6MzOi5cHkERgWPO
GHFrK+ymircxXDpqR+DDeVnWIBqv8mqYqnK8V0rSS527EPywTEHl7R09XiidnMy/
s1Hap0flhFMCAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTvA73g
JMtUGjAdBgNVHQ4EFgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQD
AgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1UdHwQ9
MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVy
bmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6
Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAGS/g/FfmoXQ
zbihKVcN6Fr30ek+8nYEbvFScLsePP9NDXRqzIGCJdPDoCpdTPW6i6FtxFQJdcfj
Jw5dhHk3QBN39bSsHNA7qxcS1u80GH4r6XnTq1dFDK8o+tDb5VCViLvfhVdpfZLY
Uspzgb8c8+a4bmYRBbMelC1/kZWSWfFMzqORcUx8Rww7Cxn2obFshj5cqsQugsv5
B5a6SE2Q8pTIqXOi6wZ7I53eovNNVZ96YUWYGGjHXkBrI/V5eu+MtWuLt29G9Hvx
PUsE2JOAWVrgQSQdso8VYFhH2+9uRv0V9dlfmrPb2LjkQLPNlzmuhbsdjrzch5vR
pu/xO28QOG8=
-----END CERTIFICATE-----
---
Server certificate
subject=/OU=Domain Control Validated/OU=EssentialSSL Wildcard/CN=*.tw.ly
issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
---
No client certificate CA names sent
---
SSL handshake has read 4970 bytes and written 421 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 56BB3B1FB4AC06DF4E91CE1F365D6EE9BA0BB3954ADD1DB9A85B0C998C3FC4E6
    Session-ID-ctx:
    Master-Key: 415A0883BE312B70AC236547A5633921783D99EFFC92D8D8E44A12A33B3569986D44C8D149CC1D160C7694BDDCF77BA8
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 14 d4 5a 87 a0 51 3b b2-84 51 c9 65 6d 6b b8 ca   ..Z..Q;..Q.emk..
    0010 - 0e 55 cb 21 51 2e 9f ab-3e cf 20 89 ba 82 20 3b   .U.!Q...>. ... ;
    0020 - 29 d5 36 04 a2 21 49 d6-9d 6a bf d7 ae 3e e4 1b   ).6..!I..j...>..
    0030 - 19 b2 8a d7 0c 52 8e a6-e5 d9 90 91 31 68 99 68   .....R......1h.h
    0040 - ff 12 61 48 04 b9 d0 1c-8a 7b 18 a5 be 3c e9 5e   ..aH.....{...<.^
    0050 - 68 57 74 99 20 33 6f 51-31 6a 41 c0 bb de 6f 3b   hWt. 3oQ1jA...o;
    0060 - b5 d5 3d b8 c7 8e 47 89-96 cb e6 68 07 79 33 22   ..=...G....h.y3"
    0070 - 03 b0 6b f4 11 85 ef e9-fb 40 ff eb 1c b0 b2 8b   ..k......@......
    0080 - 65 1e 95 f1 e8 0f 54 c2-73 a5 e9 05 bc 32 a6 f3   e.....T.s....2..
    0090 - db 67 19 12 ec f0 45 6d-4f d8 0c 8e a7 1e 97 c4   .g....EmO.......
    00a0 - 92 35 b8 16 9a 32 a7 1e-8c 59 ec 3e e3 78 d9 81   .5...2...Y.>.x..

    Start Time: 1466433253
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---

[wkoot]

Alternatively, nmap finds "commonName=*.twingly.com" (which is probably also what happens on your mac and the browser)

# nmap --script ssl-cert -p 443 api.twingly.com

Starting Nmap 6.49BETA5 ( https://nmap.org ) at 2016-06-20 16:38 CEST
Nmap scan report for api.twingly.com (80.252.171.80)
Host is up (0.020s latency).
rDNS record for 80.252.171.80: gateway.datacenter.tw.ly
PORT    STATE SERVICE
443/tcp open  https
| ssl-cert: Subject: commonName=*.twingly.com
| Issuer: commonName=COMODO RSA Domain Validation Secure Server CA/organizationName=COMODO CA Limited/stateOrProvinceName=Greater Manchester/countryName=GB
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2015-10-07T00:00:00
| Not valid after:  2016-10-23T23:59:59
| MD5:   f9ca adcf 3cec 8e3e 820a 30ec eaef cae9
|_SHA-1: 8841 07c2 79dc 3206 c284 f528 72ed 5b46 1868 9cd0

Nmap done: 1 IP address (1 host up) scanned in 0.64 seconds

[walro]

Ah, yes. You'll need at least Python 2.7.9 for SNI support. See for instance: http://docs.python-requests.org/en/master/community/faq/#what-are-hostname-doesn-t-match-errors where it states:

Python3 and Python 2.7.9+ include native support for SNI in their SSL modules. For information on using SNI with Requests on Python < 2.7.9 refer to this Stack Overflow answer.

So you could either upgrade to >= 2.7.9 or try to follow the steps given in the SO thread.

[walro]

We'll update our documentation to make this clear. Thanks for finding this!

[wkoot]

Ubuntu 12.04 LTS does not have this Python version :( See https://bugs.launchpad.net/ubuntu/+source/python-defaults/+bug/1401322
I'll check to see if injecting the SNI support is possible

[dentarg]

Great, let us know how it goes!

[wkoot]

Works with pip install ndg-httpsclient, calling inject_into_urllib3() before query.execute().