HTTPoison.Error sending a mail with Brevo : {:options, :incompatible, [verify: :verify_peer, cacerts: :undefined]}

GoulvenClech

Hi everyone,

Recently, our transactional emails won’t launch and return HTTPoison.Error like :
%HTTPoison.Error{reason: {:options, :incompatible, [verify: :verify_peer, cacerts: :undefined]}, id: nil}

I’m using the Brevo API V3. And my guess is that’s a problem with SSL; I currently use [ssl: [{:versions, [:"tlsv1.2"]}]].

Any idea or lead to help me on this case?

Thanks.

UPDATE :
Linked to OTP 26 upgrade. I obtain some progress by changing my request otps like :

  def process_request_options(_options) do
    [
      ssl: [
        verify: :verify_peer,
        cacerts: :public_key.cacerts_get(),
        versions: [:"tlsv1.2"]
      ]
    ]

Now the error is :
%HTTPoison.Error{reason: {:tls_alert, {:handshake_failure, ~c"TLS client: In state certify at ssl_handshake.erl:2140 generated CLIENT ALERT: Fatal - Handshake Failure\n {bad_cert,hostname_check_failed}"}}, id: nil}

8 comments

#email #httpoison #brevo

0 3351 8

2023-10-10 16:49:20 UTC

Showing Posts 1 to 8

Show Best Posts
Show All (oldest first)
Show All (newest first)

D4no0

Have you upgraded to OTP-26? You can read about the new default feature introduced to OTP-26: Erlang/OTP 26 Highlights - Erlang/OTP

Post #1

GoulvenClech

Thanks @D4no0 , it’s surely that I upgraded recently to OTP 26.

Do you have any resources on how this translated into Elixir?

I suppose it’s something to change in Application.ensure_all_started(:ssl)?

Post #2

GoulvenClech

I tried :

 config :my_app, MyApp.Mailer,
    [...]
    allowed_tls_versions: [:tlsv1, :"tlsv1.1", :"tlsv1.2"],
    ssl: true,
    ssl_opts: [verify: :verify_peer, cacerts: :public_key.cacerts_get()],

Waiting for deploy on staging to see if it works. But does this seem like the right approach to you?

EDIT: No, sadly it didn’t change anything.

Post #3

quatermain

We use Finch with Brevo, we recently upgraded to Elixir 1.15.4 and OTP 26.0.2 and it works:

Finch.build(
   :delete,
   "https://api.sendinblue.com/v3/contacts/#{email}",
   [
      {"api-key", api_key()},
      {"content-type", "application/json"}
    ]
  )
 |> Finch.request(PlatformFinch)

 finch 0.16.0
 ssl_verify_fun 1.1.6
``

Post #4

GoulvenClech

I obtain some progress by changing my request otps like :

  def process_request_options(_options) do
    [
      ssl: [
        verify: :verify_peer,
        cacerts: :public_key.cacerts_get(),
        versions: [:"tlsv1.2"]
      ]
    ]

Post #5

ruslandoga

@GoulvenClech

Note that for wildcard certs you need to add an additional option, :customize_hostname_check

[
  ssl: [
    verify: :verify_peer,
    cacerts: :public_key.cacerts_get(),
    versions: [:"tlsv1.2"],
    customize_hostname_check: [
      match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
    ]
  ]
]

More info: Erlang standard library: ssl | EEF Security WG (note the depth option as well)

And for :public_key.cacerts_get() to work, you might need to first :public_key.cacerts_load() the certs (e.g. during application startup). Right now in your case it seems to be returning :undefined.

Post #6

GoulvenClech

It looks like it was that!

Thanks a lot @ruslandoga , I clearly pay my lack of understanding of SSL and how OTP deal with it. I’ll work on that.

Post #7

trechubet

Where are you adding those ssl params at? Is it in your config files?

I’m getting:

12:48:40.937 [error] Postgrex.Protocol (#PID<0.1735.0>) failed to connect: ** (DBConnection.ConnectionError) ssl connect: TLS client: In state certify at ssl_handshake.erl:2138 generated CLIENT ALERT: Fatal - Unknown CA
 - {:tls_alert, {:unknown_ca, ~c"TLS client: In state certify at ssl_handshake.erl:2138 generated CLIENT ALERT: Fatal - Unknown CA\n"}}

from

ssl: true,
ssl_opts: [
      verify: :verify_peer,
      cacerts: :public_key.cacerts_get(),
      versions: [:"tlsv1.2"],
      customize_hostname_check: [
             match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
      ]
]

Post #8

— All posts loaded —