TFPHTTPClient : ESSL failed to create SSL context lazarus / 38-Networking and Web Programming ---------------------------------------------------------------------- guest58172 · 2017-12-06 18:12 I'm on Fedora 27 with libopenssl / libcrypto at 1.1.0g, Laz 1.6.4, FPC 3.0.2. A simple request gives the error "ESSL, Failed to create SSL context". I suspect that the versions the loader use to load the libraries are not up to date, see https://github.com/graemeg/freepascal/blob/master/packages/openssl/src /openssl.pas#L112 JustCode: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i program Project1; uses fphttpclient; procedure test;var  cli: TFPHTTPClient = nil;begin  cli := TFPHTTPClient.Create(nil);  try    cli.AddHeader('User-Agent','Mozilla/5.0 (compatible; fpweb)');    cli.Get('https://api.github.com/users/defunkt');  finally    cli.free;  end;end; begin  test();end. is enough to get the error. The same kind of request worked fine when i made the feature using another distribution (although once done i didn't use the feature so it could be broken too for months). What can i do ? ---------------------------------------------------------------------- guest58172 · 2017-12-06 18:15 And don't tell me "use wget / curl" please ---------------------------------------------------------------------- guest58172 · 2017-12-06 20:00 After modification of the version string the same error is still raised. I suspect an API breakage from 1.0.X to 1.1.X. Can anyone run the sample above with SSL 1.1 (1.1.0f or 1.1.0g) ? ---------------------------------------------------------------------- eolandro · 2018-08-27 02:04 Did you find answer? i'm stuck in the same error. ---------------------------------------------------------------------- Leledumbo · 2018-08-27 09:02 Working for me, but I have both 1.0.2.p and 1.1.0.i installed. Code: [Select]$ cat a.pas uses fphttpclient; procedure test; var   cli: TFPHTTPClient = nil; begin   cli := TFPHTTPClient.Create(nil);   try     cli.AddHeader('User-Agent','Mozilla/5.0 (compatible; fpweb)');     cli.Get('https://api.github.com/users/defunkt');   finally     cli.free;   end; end; begin   test(); end. $ fpc -S2 a.pas Hint: End of reading config file /etc/fpc.cfg Target OS: Linux for x86-64 Compiling a.pas Linking a a.pas(18,1) Warning: "crtbegin.o" not found, this will probably cause a linking failure a.pas(18,1) Warning: "crtend.o" not found, this will probably cause a linking failure 19 lines compiled, 0.4 sec 2 warning(s) issued 1 hint(s) issued $ ./a {"login":"defunkt","id":2,"node_id":"MDQ6VXNlcjI=","avatar_url":"https ://avatars0.githubusercontent.com/u/2?v=4","gravatar_id":"","url":"htt ps://api.github.com/users/defunkt","html_url":"https://github.com/defu nkt","followers_url":"https://api.github.com/users/defunkt/followers", "following_url":"https://api.github.com/users/defunkt/following{/other _user}","gists_url":"https://api.github.com/users/defunkt/gists{/gist_ id}","starred_url":"https://api.github.com/users/defunkt/starred{/owne r}{/repo}","subscriptions_url":"https://api.github.com/users/defunkt/s ubscriptions","organizations_url":"https://api.github.com/users/defunk t/orgs","repos_url":"https://api.github.com/users/defunkt/repos","even ts_url":"https://api.github.com/users/defunkt/events{/privacy}","recei ved_events_url":"https://api.github.com/users/defunkt/received_events" ,"type":"User","site_admin":true,"name":"Chris Wanstrath","company":"@github ","blog":"http://chriswanstrath.com/","location":"San Francisco","email":null,"hireable":null,"bio":"🍔 ","public_repos":107, "public_gists":273,"followers":20407,"following":210,"created_at":"200 7-10-20T05:24:19Z","updated_at":"2018-08-15T02:05:37Z"} ---------------------------------------------------------------------- eolandro · 2018-08-28 06:17 I'm still getting the error in debian unstable with openssl 1.1.0h-4. openssl from 1.0.X to 1.1 changes many things (includes, structs even version handling). IMO https://github.com/graemeg/freepascal/blob/master/packages/fcl- net/src/sslsockets.pp#L44 TSSLSocketHandler it must be create FCTX with some type like says TSSLContext.Create  in https://github.com/graemeg/freepascal/blob/mast er/packages/openssl/src/fpopenssl.pp#L177 but it seems don't initialize  TSSLSocketHandler.create in https://github.com/graemeg/freepascal/blob/master/packages/fcl- net/src/sslsockets.pp#L135 ---------------------------------------------------------------------- TCH · 2019-01-17 10:33 I've ran into this just now and i managed to solve it on my computer. It worked under Debian 8, but when i upgraded to Debian 9, then it broke. However, if you install libssl1.0.0 from the Debian 8 repo and downgrade your libssl-dev to the same version, then it will work, after you rebuilt your program. (Don't try to remove libssl-dev, it will broke tons of stuff, doCode: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i wget http://security.debian.org/debian- security/pool/updates/main/o/openssl/libssl- dev_1.0.1t-1+deb8u10_amd64.debdpkg -i libssl- dev_1.0.1t-1+deb8u10_amd64.debrm libssl- dev_1.0.1t-1+deb8u10_amd64.debinstead.) I do not know the whys, but this solved my problem. ---------------------------------------------------------------------- simonm · 2019-01-18 22:28 I had the same problem with debian 9 (testing). Without downgrading to debian 8 packages, I just installed the libssl1.0-dev package and all was good again. This process uninstalled the more recent version which is installed by the libssl-dev package and allows both libssl1.1 and libssl1.0.2 to be installed. Haven't had any problems yet with this setup. Like TCH, I have no idea why but when I get a chance I'll look into it deeper. ---------------------------------------------------------------------- bonmario · 2019-04-20 17:45 Quote from: Basile-B on December 06, 2017, 07:12:48 pmA simple request gives the error "ESSL, Failed to create SSL context". Hi, i have the same problem today, after upgrading my Ubuntu from 18.10 to 19.04. Someone know how i can solve it? Thanks, Mario ---------------------------------------------------------------------- bonmario · 2019-04-21 07:08 Some versions ... - openssl version1.1.1b-1ubuntu2 - libssl version 1.1.1b-1ubuntu2 - libssl-dev version 1.1.1b-1ubuntu2 - Lazarus 2.1.0 r61017 FPC 3.0.4 x86_64-linux-gtk2 Thanks, Mario ---------------------------------------------------------------------- Handoko · 2019-05-09 03:52 I got same error too after I upgraded to Ubuntu 19.04. Any suggestion what should I do? ---------------------------------------------------------------------- bonmario · 2019-05-09 05:54 You can try one of these: - use Synapse SVN: https://forum.lazarus.freepascal.org/index.php/topi c,45201.msg319446.html#msg319446 (this worked for me) - try to download fcl-web from SVN (i've never tried this solution). - download openssl 1.0 and modify fcl-web to use that version (i've never tried this solution). Hi, Mario ---------------------------------------------------------------------- bonmario · 2019-08-08 08:06 Hi, someone have found a solution in meantime to correct fcl-web's problem? Thanks, Mario ---------------------------------------------------------------------- Thaddy · 2019-08-08 08:51 The original code, one unit added, openssl version is 1.1.1c Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i program Project1;{$mode delphi} uses opensslsockets,fphttpclient; procedure test; var  cli: TFPHTTPClient = nil;begin  cli := TFPHTTPClient.Create(nil);  try    cli.AddHeader('User- Agent','Mozilla/5.0 (compatible; fpweb)');    cli.Get('https://api.github.com/users/defunkt');  finally    cli.free;  end;end; begin  test();end. Works like a charm ---------------------------------------------------------------------- rumen-lazarus · 2019-08-08 09:05 Hi,   Try this:       HttpClient.OnGetSocketHandler:=HttpClientGetSocketHandler;      ...... procedure TForm1.HttpClientGetSocketHandler(Sender: TObject;   const UseSSL: Boolean; out AHandler: TSocketHandler); begin   If UseSSL then begin     AHandler:=TSSLSocketHandler.Create;     TSSLSocketHandler(AHandler).SSLType:=stTLSv1_1;  // <--   end else begin       ....   end; end; ---------------------------------------------------------------------- trev · 2019-08-08 09:46 With FreeBSD, the solution was to upgrade to FPC trunk and it all works (recommended to me by a Linux user   (ref: https://forum.lazarus .freepascal.org/index.php/topic,45962.msg327743.html#msg327743) ---------------------------------------------------------------------- bonmario · 2019-08-08 09:49 Quote from: Thaddy on August 08, 2019, 10:51:41 amThe original code, one unit added, openssl version is 1.1.1c Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i program Project1;{$mode delphi} uses opensslsockets,fphttpclient; procedure test; var  cli: TFPHTTPClient = nil;begin  cli := TFPHTTPClient.Create(nil);  try    cli.AddHeader('User- Agent','Mozilla/5.0 (compatible; fpweb)');    cli.Get('https://api.github.com/users/defunkt');  finally    cli.free;  end;end; begin  test();end. Works like a charm I have this error: Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i httpget.pas(6,22) Fatal: Impossibile trovare opensslsockets usato da httpget dell'Analizzatore Progetti.Translated is "Cant' found opensslsockets used from httpget" I' using Lazarus 2.1.0 r61610M FPC 3.0.4 x86_64-linux-gtk2 Quote from: rumen-lazarus on August 08, 2019, 11:05:47 am  Hi,   Try this:       HttpClient.OnGetSocketHandler:=HttpClientGetSocketHandler;      ...... procedure TForm1.HttpClientGetSocketHandler(Sender: TObject;   const UseSSL: Boolean; out AHandler: TSocketHandler); begin   If UseSSL then begin     AHandler:=TSSLSocketHandler.Create;     TSSLSocketHandler(AHandler).SSLType:=stTLSv1_1;  // <--   end else begin       ....   end; end; Adding "ssockets" at uses, now seems works fine. Thanks, Mario ---------------------------------------------------------------------- dbannon · 2019-08-26 00:36 Quote from: bonmario on August 08, 2019, 11:49:50 amQuote from: Thaddy on August 08, 2019, 10:51:41 amuses opensslsockets,fphttpclient; Translated is "Cant' found opensslsockets used from httpget" Adding "ssockets" at uses, now seems works fine. I also cannot find the opensslsockets unit that Thaddy mentions. It does not appear on wiki, its not in the online package manager, just where does it come from ?   I do seem to have ssockets installed but using it makes no difference and I get a compiler message saying the build did not use it. Quote from: rumen-lazarus on August 08, 2019, 11:05:47 am      HttpClient.OnGetSocketHandler:=HttpClientGetSocketHandler; ...... rumen-lazarus's solution ?  Is that an edit of the original fpc source ? in my case /usr/share/fpcsrc/3.0.4/packages/fcl- web/base/fphttpclient.pp ? Scope seems to be TForm1 ??  Is he overriding the fpc source in his own (TForm1) code ? Davo ---------------------------------------------------------------------- dbannon · 2019-08-26 08:28 OK, had a play with rumen-lazarus's solution. It requires {$mode delphi} or an "@" used in call to change the OnGetSocketHandler - Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i Client.OnGetSocketHandler := @HttpClientGetSocketHandler;And it requires sslsockets and ssockets added to uses. The latter up in the interface because we have to put the prototype for our new HttpClientGetSocketHandler() up there and it takes a parameter of TSocketHandler type. So, my new handler looks like this - Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i procedure TForm1.HttpClientGetSocketHandler(Sender: TObject;  const UseSSL: Boolean; out AHandler: TSocketHandler);begin  If UseSSL then begin    AHandler := TSSLSocketHandler.Create;    TSSLSocketHandler(AHandler).SSLType:=stTLSv1_1;  // <--  end else    AHandler := TSocketHandler.Create;end; And it does work for some https sites but not all. I suspect the 'not all' is due to redirects not being followed, as per https://forum.laza rus.freepascal.org/index.php/topic,39206.msg318360.html In my case, it does not work for github generating - ESocketError - Connect to github.com:443 failed. wget has no problem getting the same file. Davo ---------------------------------------------------------------------- dbannon · 2019-08-29 01:51 A further update in case someone finds this thread. See https://forum.lazarus.freepascal.org/index.php/topic,46560.0.html The sslType needs to be stTLSv1_2 to work reliably with all (?) https: sites. Thanks GetMem. Davo ---------------------------------------------------------------------- Renat.Su · 2019-08-29 11:35 Quote from: dbannon on August 26, 2019, 02:36:15 amQuote from: bonmario on August 08, 2019, 11:49:50 amQuote from: Thaddy on August 08, 2019, 10:51:41 amuses opensslsockets,fphttpclient; Translated is "Cant' found opensslsockets used from httpget" Adding "ssockets" at uses, now seems works fine. I also cannot find the opensslsockets unit that Thaddy mentions. It does not appear on wiki, its not in the online package manager, just where does it come from ?  It is in trunk fpc code ---------------------------------------------------------------------- dbannon · 2019-09-02 11:20 Quote from: Renat.Su on August 29, 2019, 01:35:03 pmQuote from: dbannon on August 26, 2019, 02:36:15 am... I also cannot find the opensslsockets unit that Thaddy mentions. It does not appear on wiki, its not in the online package manager, just where does it come from ?  It is in trunk fpc code Ah, thanks. That explains why we could not find it. Davo