SSLPeerUnverifiedException

[DeveloperP]

Hi

I update SSL cert for my app.

I got notification from fitbit, but in some case its give me SSLPeerUnverifiedException.

The error is come 5% of notification.

Please provide best solution for this issue.

Thanks

[JeremiahFitbit]

This means that Fitbit is having difficulty validating your TLS certificate for your server. What is the domain of your subscriber?

[DeveloperP]

We have checked the TLS certificate of server, and it is fine.

My Domain is https://preventioncloud.com/

Please review if possible and offer another solution for my issue.

Just to reaffirm,  I am not getting this error for all notifications, only for some notification.

[JeremiahFitbit]

It just means that, occassionally, a secure connection to your app fails. Fitbit is not seeing this behavior in other apps, which means that it is specific to your app. I cannot provide any additional investigation at this time.

You can try using Runscope to monitor all requests sent to your subscriber. Instructions are at https://wiki.fitbit.com/display/API/Debugging

[Extracon]

Hello,

We also started seeing the SSLPeerUnverifiedException when we updated our SSL cert earlier this year.  For us, it happened 100% of the time once the cert was updated.  We ended up just changing our subscription endpoint to be HTTP rather than HTTPS, but would like to change back.

I just tried changing to HTTPS and immediately saw the SSLPeerUnverifiedException for all message delivery attempts in the subscriber details log. I had to change back to HTTP. 

Our cert supports TLS 1.0, 1.1, & 1.2.  I'm guessing there is something with the configuration of our cert that is incompatible with Fitbit, but I haven't been able to determine what the problem is.

Thanks for any information that you can provide.

Kevin

[JeremiahFitbit]

From the Fitbit Subscription API docs:

We support TLS(v 1.0)/SSL protocol for the subscriber endpoints. Please, note that we are not supporting self-signed certificates. We support only HTTPS connections to port 443. TLS+SNI is not supported at this time. Note that TLS v. 1.1. and 1.2 are not supported at this point.

If you have a certificate issued by GoDaddy, there is a long standing problem that GoDaddy needs to resolve to properly work with Java, which Fitbit uses. The proble is documented at http://stackoverflow.com/questions/18746565/godaddy-ssl-cert-not-working-with-java and the contact information to complain to GoDaddy is there as well.

If your certificate passes Symantec's SSL Toolbox test and complies with the information in the docs, Fitbit should be able to communicate with your subscriber.

[Extracon]

Thank you for this information.  The article regarding GoDaddy is very useful.

-Kevin

[JeremiahFitbit · Accepted solution]

Go Daddy Class 2 Certification Authority G2 CA SHA-2 certificates are now supported. Please see https://community.fitbit.com/t5/Web-API/Why-am-I-seeing-SSLPeerUnverifiedException-errors-in-my-subs...