Django paypalrestsdk error - OpenSSL.SSL.Error: [('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')]

Question

I am programming on Django and using paypalrestsdk https://github.com/paypal/PayPal-Python-SDK

I am getting this error:

OpenSSL.SSL.Error: [('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')]

Basically I have created BillingPlan(code snippet https://gist.github.com/axilaris/2f9cf8f5c27a8a2095c5c9abf0dc4121 ), and this appears:

Payment created successfully
2018-05-08 22:44:45,358 INFO Request[POST]: https://api.sandbox.paypal.com/v1/oauth2/token
2018-05-08 22:44:45,358 DEBUG Level: sandbox
2018-05-08 22:44:45,358 DEBUG Request: 
Headers: {'Authorization': 'Basic QVZ2cEhjMExScXFkcEFQZy1QZm1DU19jVlFNYTV1V3lsaXpBMXRpMDRjcm4tZF9jbWdyVFF5N0ZQOVZOcnlfdXRZN0IwZk91cEJSQlluVzM6RUpIcV9GLWwxbmNJLTY3YmFLYmREcWRJMVMtcGNOWkxwWjdvX29mcG10eGQ4ZlVRM2drQTFQR1J5ZzBOZER6VDY1dE5URlY2Y29lWDVVdHM=', 'Content-Type': 'application/x-www-form-urlencoded', 'Accept': 'application/json', 'User-Agent': 'PayPalSDK/PayPal-Python-SDK 1.13.1 (requests 2.12.1; python 3.6.3; OpenSSL 1.0.2k 26 Jan 2017)', 'PayPal-Request-Id': 'b337cb66-b036-4a0a-9f70-aaa7011e73bb'}
Body: grant_type=client_credentials
2018-05-08 22:44:45,362 DEBUG Starting new HTTPS connection (1): api.sandbox.paypal.com
From cffi callback <function _verify_callback at 0x12972a268>:
Traceback (most recent call last):
File "/Users/some/Documents/project/somedotcom/somedotcomenv/lib/python3.6/site-packages/OpenSSL/SSL.py", line 313, in wrapper
_lib.X509_up_ref(x509)
...
File "/Users/some/Documents/project/somedotcom/somedotcomenv/lib/python3.6/site-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')]

more complete detail of the traces can be found here: https://gist.github.com/axilaris/c181aaaa8261add4240fb2d042bd1ffc

How do I resolve this error ? Thanks.

my environment:

pyOpenSSL==17.5.0
paypalrestsdk==1.13.1 
Django==1.11.7
cryptography==2.1.3

Answer 1

PayPal's APIs require TLS 1.2 and my guess is that your underlying installed version of OpenSSL is a bit too old to support it.

Use the following to determine what version of OpenSSL you've got installed:

>>> import ssl
>>> print ssl.OPENSSL_VERSION
OpenSSL 1.0.2m  2 Nov 2017

If you're on anything lower than 1.0.1, you'll likely want to upgrade it using brew . In my experience, Mac OS X can have quite antiquated versions of it; I think mine was as low as 0.9.8.

Once you've upgraded OpenSSL and confirmed that in the python shell you see the new version, you can test it by running your code. If it still doesn't work, I suggest running the following to get some more fine-grained detail on the connection health:

openssl s_client -showcerts -connect api.sandbox.paypal.com:443