APNS ssl://gateway.sandbox.push.apple.com:2195 connection fails

Question

i try to make a push-notification server. I get connection to ssl://gateway.sandbox.push.apple.com:2195 with telnet.

telnet gateway.sandbox.push.apple.com 2195
Trying 17.172.232.229...
Connected to gateway.sandbox.push-apple.com.akadns.net.
Escape character is '^]'.

my *.pem is ok (I use it on another server). I use the SAME project on an other Server and it works there but the clone on an other Server doesn't.

I get these Errors:

Warning: stream_socket_client() [function.stream-socket-client]: SSL operation failed with code 1. OpenSSL Error messages: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired in /var/www/try.php on line 69

Warning: stream_socket_client() [function.stream-socket-client]: Failed to enable crypto in /var/www/try.php on line 69

Warning: stream_socket_client() [function.stream-socket-client]: unable to connect to ssl://gateway.sandbox.push.apple.com:2195 (Unknown error) in /var/www/try.php on line 69

The certificate is NOT expired, it works on the other Server and the date is the same.

Does someone has a clue what the mistake could be?

I work on

Apache/2.2.9 (Debian) PHP/5.2.17-0.dotdeb.0 with Suhosin-Patch mod_ssl/2.2.9 OpenSSL/0.9.8g

EDIT: It seems, that using the same certificate on different servers doesn't work. Maybe this is blocked by Apples servers.

I have been getting the same errors today. Perhaps it is something on Apple's side. I am digging in now... — coneybeare, Jun 17 '11 at 13:23
I just solved this error for my self today. I noticed that my Entrust cert was bad so I re-made it and viola. It's odd that you can't connect without it, but w/e. — Jacksonkr, Apr 04 '13 at 13:13
maybe this solves my problem... don't know. I'm using JavAPNS now on an other server =) — Starbax, Apr 04 '13 at 13:19

score 14 · Answer 1 · edited Jul 04 '14 at 04:41

I use apn_on_rails for this, but I think it will work for you as long as you are using a pem file. I fixed this by re-downloading the certificate and intermediate certificate, regenerating the push notification pem file using these instructions:

Once you have the certificate from Apple for your application, export your key and the apple certificate as p12 files. Here is a quick walkthrough on how to do this:

1. Click the disclosure arrow next to your certificate in Keychain Access and select the certificate and the key. 
2. Right click and choose `Export 2 items…`. 
3. Choose the p12 format from the drop down and name it `cert.p12`.

Now covert the p12 file to a pem file:  

  $ openssl pkcs12 -in cert.p12 -out apple_push_notification_production.pem -nodes -clcerts

I already tried this, this doesn't work for me. =( but I know in the most cases the certificate is the problem. but my certificate is Ok, it works fine on an onter server — Starbax, Aug 25 '11 at 11:58

score 6 · Answer 2 · edited Dec 20 '11 at 11:09

6

This kind of error occur in two situation:

When the 2195 port is block.
When the .pem file is not made correctly (as in my case).

Try these two points. You will surely not get any error.

edited Dec 20 '11 at 11:09

Yi Jiang

49,435
16
136
136

answered Dec 20 '11 at 10:53

Himanshu Mohan

722
9
30

1

To 1. when port 2195 is blocked telnet wouldn't work. To 2. I work with the same *.pem file on an other server and it works there. – Starbax Dec 20 '11 at 14:07
I could add my case as a 3rd point that to verify the path of *.pem file on your server – Haithem Rihane Oct 08 '13 at 16:37
but in cake php where to include .pem file.if you have idea please share. – Raghul Rajendran Jan 12 '16 at 13:41
HI @Starbax , Please accept any answer so that it will be helpful to others. – Himanshu Mohan Nov 24 '17 at 05:47
Hi @HimanshuMohan, I cannot accept any answer, none of them helped me, never found the problem. This post is > 6 years old. regards – Starbax Dec 06 '17 at 15:21

score 3 · Answer 3 · answered Aug 27 '15 at 03:10

I had the same problem but the solution in my case was that pem certificate that required absolute path

Use the absolute path for the private key instead of relative path.
Make sure the php user (or webserver user, depending.. www-data, apache, nginx, www...) is allowed to read it (chown, chmod).

from here

score 2 · Answer 4 · answered Jul 05 '12 at 07:19

2

Some random finding from the internet which could help:

It may be a certificate problem. Try the stream options allow_self_signed and verify_peer to check that.

Try to use explicitely sslv2:// or sslv3:// ?

Permission problem on "/dev/urandom"

answered Jul 05 '12 at 07:19

user1316813

55
1

score 1 · Answer 5 · answered Jan 19 '13 at 05:04

You mention:

I use the SAME project on an other Server and it works there but the clone on an other Server doesn't.

I've found that .pem certificates don't transfer. Here are the steps I followed to get an app that works on one OS X machine to work on another (don't know how to do it for non-Apple machines):

Copy over the first Server's .p12 file (Certificate and companion private-key).
Copy that .p12 file into your keychain. It will become a certificate there.
Export that certificate (with companion private key) to a new .p12 file.
Use openssl to convert that new .p12 file into a new .pem file
You can now use the new .pem file in your openssl command on the new server.

Hope this is helpful

I never did tis on any server... but my question is nearly 2Jears old =) maybe import the p12 or pem into the servers keychain did the trick and I don't remember doing this =) Since 1 jear I used to do this with JavaPNS this works better then easyApns. ;) — Starbax, Jan 19 '13 at 09:14

score 1 · Answer 6 · answered Oct 26 '11 at 09:19

1

Maybe your ISP block ports 2195 and 2196. I had the same problem, asked them to open it and that worked for me.

answered Oct 26 '11 at 09:19

dgeneva

19
1

3

as I said in my discription telnet works, it wouldn't work if the ports are blocked – Starbax Dec 20 '11 at 14:26

score 0 · Answer 7 · answered Mar 06 '15 at 13:28

0

I had a similar issue on my Linux box. To me, it was the SELinux issue.

So in your /etc/selinux/config file, set the SELINUX=enforcing to SELINUX=disabled. And restart. Thats it.

answered Mar 06 '15 at 13:28

Kashif

79
1
1

score -7 · Answer 8 · answered Nov 27 '12 at 12:04

-7

try...
telnet gateway.sandbox.push.apple.com:2195 instead of ... telnet gateway.sandbox.push.apple.com 2195

answered Nov 27 '12 at 12:04

user1633492

415
1
4
2

APNS ssl://gateway.sandbox.push.apple.com:2195 connection fails

8 Answers8

Linked