# Excon SSL Verify issue for ONEBOX
**URL:** https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747
**Category:** Self-hosting
**Tags:** onebox
**Created:** [September 17, 2019, 2:31am UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747 "2019-09-17T02:31:16Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Brown\_Glenn](https://meta.discourse.org/u/Brown_Glenn)
#### Post date: [September 17, 2019, 2:31am UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747/1 "2019-09-17T02:31:16Z")
Hi Everyone,
I’ve just setup and started testing a Discourse server and so far it’s great. I have an issue where onebox fails to work due to what I think is a SSL inspection filter that fails to verify with excon gem. I have downloaded the custom root cert and added it to /etc/ssl/certs on host, and even inside the container (to test) to no avail. I still get the below error in the /log/rails/production.log any time I past a url for embedding.
Failed to onebox [youtube url] SSL\_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certifciate) (OpenSSL::SSL::SSLError) Unable to verify certificate.
It mentions changing the excon defaults to point to a different ssl\_path, but i’m unsure how I can do that safely and still allow discourse to update. Can anyone advise how I might be able to ensure that a custom root cer is seen as valid within excon? Is there a rails -r exec command I can put into the app.yml?
Thanks a bunch,
Glenn.
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [September 17, 2019, 12:25pm UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747/2 "2019-09-17T12:25:58Z")
Which URL is showing the issue? Are you using the official Docker based install of Discourse?
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [September 17, 2019, 4:30pm UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747/3 "2019-09-17T16:30:15Z")
Looks like by default [excon bundles its own certificate bundle](https://github.com/excon/excon/issues/212) but since other people had similar issues, he’s added the ability to configure it in the environment? And it’ll use the system one if the certificate is in properly.
It might need the hash link to work. Can you try the following and see if it solves the problem?
- do both:
- add your custom cert to `/etc/ssl/certs` _inside_ the container
- add the hash link: e.g.
---
### Author:  [@Brown\_Glenn](https://meta.discourse.org/u/Brown_Glenn)
#### Post date: [September 18, 2019, 2:30am UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747/5 "2019-09-18T02:30:04Z")
Thanks Michael,
I set the environment variable and created the hash, and I’m not seeing a visible SSL error now, but still onebox is not doing anything. Don’t know if Jeff has any advice on what I might be doing wrong? @codinghorror.
I’m concerned that making changes inside the container will just get destroyed upon a rebuild though, so i’m not sure what the best approach here is.
Glenn.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [September 18, 2019, 3:42am UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747/6 "2019-09-18T03:42:04Z")
> [@Brown\_Glenn](#):
>
> but still onebox is not doing anything
It may have cached the failure, but let’s test one thing at a time.
You shouldn’t need to add the environment variable, but you can check to see whether adding the certificate worked by doing, for example:
```plaintext
root:~# /var/discourse/launcher enter app
root@app:/var/www/discourse# rails console
[1] pry(main)> Net::HTTP.get URI 'https://meta.discourse.org/about.json'
```
If you get a result (and you didn’t before), that means the certificate is properly installed. Then you can add commands to the container definition to install that certificate on every rebuild so it’ll persist.
---
### Author:  [@Brown\_Glenn](https://meta.discourse.org/u/Brown_Glenn)
#### Post date: [September 18, 2019, 4:00am UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747/7 "2019-09-18T04:00:05Z")
Thanks Michael, the rails console command worked fine, it’s able to download the json file you linked.
I’m not sure if that wouldn’t have worked previously, but I had previously installed the root cer into /etc/ssl/certs/ and it wasn’t working still.
I ran **export SSL\_CERT\_DIR=“/etc/ssl/certs/”** in the container and the SSL error seemed to go away after that. At least i’m no longer seeing anything in the production.log
Thanks,
Glenn.
---
### Author:  [@Brown\_Glenn](https://meta.discourse.org/u/Brown_Glenn)
#### Post date: [September 18, 2019, 4:19am UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747/8 "2019-09-18T04:19:09Z")
Actually, I think I may have worked out the issue now. It’s an authentication prompt with the corporate filter I believe. I did the Net::HTTP.get in the console using a youtube oembed uri to retrieve the embed JSON and instead it provided back an authentication html document. So I think that’s what is getting in the way now. Thanks a bunch Michael.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [September 18, 2019, 5:23am UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747/9 "2019-09-18T05:23:58Z")
> [@Brown\_Glenn](#):
>
> I’m not sure if that wouldn’t have worked previously, but I had previously installed the root cer into /etc/ssl/certs/ and it wasn’t working still.
Did you also create the symlink? That’s a very important part.
To get the certificate permanently in place, you want to amend the `app.yml` file add or modify a `hooks` section to something like the following:
```plaintext
hooks:
before_code:
- file:
path: /etc/ssl/certs/custom-root.crt
chmod: 644
contents: |
-----BEGIN CERTIFICATE-----
…
-----END CERTIFICATE-----
- exec:
cmd:
- bash -c "ln -s custom-root.crt /etc/ssl/certs/$(openssl x509 -hash -noout -in /etc/ssl/certs/custom-root.crt).0"
```
> [@Brown\_Glenn](#):
>
> It’s an authentication prompt with the corporate filter I believe.
Ah, likely nothing we can add into the app.yml file to fix that.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [April 29, 2023, 1:33pm UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747/10 "2023-04-29T13:33:29Z")
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [April 29, 2023, 1:45pm UTC](https://meta.discourse.org/t/excon-ssl-verify-issue-for-onebox/128747/11 "2023-04-29T13:45:04Z")