`remote error: unknown certificate` on Sierra about puma-dev

[holman]

› ps aux | grep puma
holman          91070   2.4  0.0  2444100   2136 s002  S+    5:36PM   0:00.01 grep puma
holman          90588   0.0  0.1 573532956  19080   ??  S     5:32PM   0:00.13 /usr/local/Cellar/puma-dev/0.7/bin/puma-dev -launchd -dir ~/.puma-dev -d dev -timeout 15m0s
holman          90058   0.0  0.0  2443784   1924 s001  S+    5:27PM   0:00.01 tail -f /Users/holman/Library/Logs/puma-dev.log
holman          90057   0.0  0.0  2475880   7984 s001  S+    5:27PM   0:00.04 /usr/bin/python /usr/local/bin/grc -es --colour=auto tail -f /Users/holman/Library/Logs/puma-dev.log

[evanphx]

What does safari say? Does it allow the access?
On Sat, Jul 30, 2016 at 5:37 PM Zach Holman [email protected]
wrote:

› ps aux | grep puma
holman 91070 2.4 0.0 2444100 2136 s002 S+ 5:36PM 0:00.01 grep puma
holman 90588 0.0 0.1 573532956 19080 ?? S 5:32PM 0:00.13 /usr/local/Cellar/puma-dev/0.7/bin/puma-dev -launchd -dir ~/.puma-dev -d dev -timeout 15m0s
holman 90058 0.0 0.0 2443784 1924 s001 S+ 5:27PM 0:00.01 tail -f /Users/holman/Library/Logs/puma-dev.log
holman 90057 0.0 0.0 2475880 7984 s001 S+ 5:27PM 0:00.04 /usr/bin/python /usr/local/bin/grc -es --colour=auto tail -f /Users/holman/Library/Logs/puma-dev.log

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#26 (comment), or mute
the thread
https://github.com/notifications/unsubscribe-auth/AAAAB5IZKoIoTs4NU1jBA_3s0OAdcblHks5qa-4xgaJpZM4JY7Uw
.

[holman]

Safari just gives the "Can't Open Page" page (can't establish a secure connection). I think I have a http => https thing setup somewhere.

Looks like Chrome also throws an error, but if I click in Advanced and say continue on anyway, it loads.

[evanphx]

Hm, maybe the loading of the cert into the keychain doesn't work on Sierra...

Also, try this: Run puma-dev which will run it and bind to ports 9280 and 9283. See if https://your_app.dev:9283 and see what the browsers say.

[holman]

Still the same result.

[evanphx]

In order to dynamically generate certificates SSL SNI is used, but since it works on Safari on El Cap I'd think it would work on Sierra...

What does curl say?

[holman]

curl output:

curl: (60) SSL certificate problem: Invalid certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

[evanphx]

Hm. That means that the installed cert in the keychain isn't working.

For fun, can you go through this and see if it fixes anything? https://support.apple.com/kb/PH18677?locale=en_US

[holman]

Sorta.

Safari wasn't showing anything in the error page, so instead I went into ~/Library/Application Support/io.puma.dev and double-clicked cert.pem to open it with Keychain. It asked me where to put it, so I saved it to System (it looks like puma set up the other one for login; not sure if that matters or not). After a fairly long 30-40s startup, it mostly worked aside from some ajax calls, but that might be a red herring since I can't get it to run again right now (after a rake restart that may or may not have worked).

I see the process list running spring app and spring server, along with a dozen or so fsevent_watch processes, but hitting my app at https://app.dev and https://app.dev:9283 both return can't connect to the server "app.dev" in Safari's error page. Nothing shows up in puma-dev.log anymore, either. Everything just hangs it seems.

[holman]

Went through a restart because, shruggggg, betas, and the hanging is still persisting. Puma is definitely starting the app in the background, but I can't get a response through any browser or curl.

[evanphx]

@holman Just so I have a clear picture of the issue, what about on port 80?

[holman]

Yeah, same hanging looks like.

[holman]

Uhhh... everything works now.

[holman]

Yeah something's still up. It was working totally fine, but I issued a rake restart and now it's definitely been hanging for a few minutes, both on http (80) and https. Not sure if it's just Thinking Really Hard right now or what's going on.

[evanphx]

Is this a rails 5 app? What does rake restart do?

[holman]

Yup, Rails 5, so just a:

rake restart                             # Restart app by touching tmp/restart.txt

[evanphx]

@holman Could you just the output of ~/Library/Logs/puma-dev.log? I'd love to see what happens before (when working) and after you run rake restart

[holman]

Can't get it to work right now, but here's some snippets:

lorne[10882]: Use Ctrl-C to stop

    --- running `rake restart ---

! Killing 'lorne' (10882)
! Shutdown requested
* Directory for apps: /Users/holman/.puma-dev
* Domains: dev
* DNS Server port: 9253
* HTTP Server port: inherited from launchd
* HTTPS Server port: inherited from launchd
! Puma dev listening on http and https

    --- I believe this is when I first try to hit lorne.dev ---

! Booted app 'lorne' on socket /Users/holman/.puma-dev/lorne/tmp/puma-dev-11953.sock
lorne[12019]: Puma starting in single mode...
lorne[12019]: * Version 3.4.0 (ruby 2.3.1-p112), codename: Owl Bowl Brawl
lorne[12019]: * Min threads: 0, max threads: 5
lorne[12019]: * Environment: development
lorne[12019]: * Listening on unix:/Users/holman/.puma-dev/lorne/tmp/puma-dev-11953.sock
lorne[12019]: Use Ctrl-C to stop

...then hangs.

[holman]

(Ah, I think I also did a -setup or an -install in there too, which is why puma-dev itself is restarting in there.)

[holman]

Sorry for the issuespam, but this is a bit weird.

So I manually kill -9ed the puma-dev process (pkill -USR1 puma-dev and kill alone didn't kill any processes) and let it spin back up, then after 2-4 minutes it looks like it's running fine again. Seems like a really long startup time, though. This seems like a reliable way to start/restart the Rails processes, though.

[evanphx]

Maybe there is some DNS timeouts involved? Did the rails app itself take 2-4 minutes then or puma-dev?

[holman]

It looks like puma-dev came up pretty quickly, but loading the Rails app is taking awhile (judging from the logs, when it boots up). Ordinarily boot time takes like 2-3 seconds for me on this app, if that.

[holman]

After waiting a couple minutes for it to come up, I get this error:

lorne[18111]: Use Ctrl-C to stop
2016/08/01 18:57:00 http: proxy error: net/http: request canceled

...then it appears that everything comes up fast and good at that point. Maybe there's some timeout or something happening?

[evanphx]

@holman Does the Use Ctrl-C to stop show up minutes before the app seems actually ready?

[holman]

Yup. The ctrl+C part all happens in the first 3-4 seconds of the puma-dev process starting. It feels like it's showing up right around the time I'd expect the app boot time would be.

[holman]

Took a look at this on 0.8... this is what I'm seeing:

• Startup is still taking 1-2 minutes, but seems to be reliably coming up. Will muck with it today and see how things are shaking out.
• Already seeing puma-dev hitting my fans at around 50-56% CPU after spinning up after awhile. (This was an existing issue.) When it's running "normally" it's around 0.0 typically.
• The README's suggestion of pkill -USR1 puma-dev doesn't really do anything, from what I can tell. I have to manually tell it to kill -9 puma-dev and all the child processes to get them to restart.
• Along those lines, I need to killall fsevent_watch to kill the dozen or so watch processes; if I don't, they spawn new processes and I quickly end up with dozens and dozens of processes hanging around. (It'd be really great to get a puma-dev -restart here, btw.)

[evanphx]

@holman 5 seconds after hitting puma-dev to spin up the app, can you run curl -H "Host: puma-dev" localhost/status and gist the output? It might help us understand a bit more how the app is starting.

All your behaviors are quite odd actually. Just to be sure you're running 0.8, can you do puma-dev -uninstall then puma-dev -install?

As for restart, that's what pkill -USR1 puma-dev does, it sends kill signals to the apps. If it doesn't work, that probably means your app is hung?

[holman]

It's actually working pretty smoothly now it seems; pkill -USR1 puma-dev is definitely restarting the app, and it comes up within a couple of seconds. The only lingering problem is that it doesn't clear out the fsevent_watch processes, but that's not really a huge deal since it's not actually impacting anything, really.

I'm going to close this out; will let you know if things change! ⭐