locked
SSLHandshakeException - interment problem when making calls against Bulk service RRS feed

  • Question

  • Hi,

    I am finding that I am intermittently getting an SSLHandshakeException when making calls against the Bing Ads API. For example when calling getDownloadStatus from the bulk service:

    Exception thrown: AxisFault
     faultCode: {http://schemas.xmlsoap.org/soap/envelope/}Server.userException
     faultSubcode:
     faultString: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
     faultActor:
     faultNode:
     faultDetail:
        {http://xml.apache.org/axis/}stackTrace:javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1731)
        at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)
        at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136)
        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:925)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1170)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1197)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1181)
        at org.apache.axis.components.net.JSSESocketFactory.create(JSSESocketFactory.java:186)
        at org.apache.axis.transport.http.HTTPSender.getSocket(HTTPSender.java:191)
        at org.apache.axis.transport.http.HTTPSender.writeToSocket(HTTPSender.java:404)
        at org.apache.axis.transport.http.HTTPSender.invoke(HTTPSender.java:138)
        at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)
        at org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)
        at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)
        at org.apache.axis.client.AxisClient.invoke(AxisClient.java:165)
        at org.apache.axis.client.Call.invokeEngine(Call.java:2784)
        at org.apache.axis.client.Call.invoke(Call.java:2767)
        at org.apache.axis.client.Call.invoke(Call.java:2443)
        at org.apache.axis.client.Call.invoke(Call.java:2366)
        at org.apache.axis.client.Call.invoke(Call.java:1812)
        at adcenter.bulk.BasicHttpBinding_IBulkServiceStub.getDownloadStatus(BasicHttpBinding_IBulkServiceStub.java:476)

    Also when calling downloadCampaignsByCampaignIds against the bulk service.

    As I say, this problem is intermittent - sometimes the call with work without problem, sometimes the SSLHandshakeException will be thrown.

    Any suggestions as to what the problem may be? One of the Bing Ads servers with an invalid SSL Certificate perhaps?

    Wednesday, February 6, 2013 6:05 AM

Answers

  • Hello all,

    Thank you for letting us know the issue and we can confirm that there was a system issue, engineering teams have since resolved the issue and users should be able to connect to the API service.

    Thursday, February 7, 2013 12:26 PM

All replies

  • I am now noticing this error in other applications in which we use the Bing Ads API, this time when making a call against the v7 reporting service. I started to notice this behaviour as of late last night. It definitely seems like this is an issue on the end of Bing, in which case it is a clear priority to fix asap.

    Microsoft -- Error encountered:

    Microsoft -- AxisFault

    faultCode: {schemas.xmlsoap.org/.../envelope}Server.userException

    faultSubcode:

    faultString: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

    faultActor:

    faultNode:

    faultDetail:

    {http://xml.apache.org/axis/}stackTrace:javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1697)

    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:257)

    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:251)

    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1165)

    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:154)

    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:609)

    at sun.security.ssl.Handshaker.process_record(Handshaker.java:545)

    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:945)

    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1190)

    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1217)

    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1201)

    at org.apache.axis.components.net.JSSESocketFactory.create(JSSESocketFactory.java:186)

    at org.apache.axis.transport.http.HTTPSender.getSocket(HTTPSender.java:191)

    at org.apache.axis.transport.http.HTTPSender.writeToSocket(HTTPSender.java:404)

    at org.apache.axis.transport.http.HTTPSender.invoke(HTTPSender.java:138)

    at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)

    at org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)

    at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)

    at org.apache.axis.client.AxisClient.invoke(AxisClient.java:165)

    at org.apache.axis.client.Call.invokeEngine(Call.java:2784)

    at org.apache.axis.client.Call.invoke(Call.java:2767)

    at org.apache.axis.client.Call.invoke(Call.java:2443)

    at org.apache.axis.client.Call.invoke(Call.java:2366)

    at org.apache.axis.client.Call.invoke(Call.java:1812)

    at com.microsoft.adcenter.v7.BasicHttpBinding_IReportingServiceStub.submitGenerateReport(BasicHttpBinding_IReportingServiceStub.java:1205)

    Wednesday, February 6, 2013 6:44 AM
  • In addition, it seems that this issue has occurred before community.bingads.microsoft.com/.../73139.aspx

    Wednesday, February 6, 2013 6:46 AM
  • I am getting this error, too. I restarted my processes as suggested by the linked issue, but that did not resolve the SSL errors.

    FYI: For me, the errors started to appear around 13 hours ago (2013-02-06 05:00:00 GMT).

    I was able to see one of the non-validating certificates. It looks like a self-signed cert created a few days ago.

    Wednesday, February 6, 2013 10:12 AM
  • We are getting this error too, using v8 reporting.  I have stopped and started the process that deals with the reporting API, to no avail.

    Wednesday, February 6, 2013 10:38 AM
  • I am seeing the same thing.  It is not consistent because they are only serving the bad certificate in a small percentage of the responses - in most cases the certificates are valid.

    Wednesday, February 6, 2013 11:03 AM
  • Any updates on this guys? I'd prefer not to start running our Bing Ads API processes again whilst the behaviour is unstable/unreliable.

    Wednesday, February 6, 2013 1:33 PM
  • I tweeted @BingAds and @BingAdsFeedback asking for an ETA to a fix and included a link to this discussion. I hope that brings attention to this issue.

    Wednesday, February 6, 2013 1:49 PM
  • I was seeing the same bad cert posted by jsjacob - signed by WMSvc-BY2ADCAPI36.

    The problem appears to have been resolved by Bing, and I am not seeing the errors anymore.

    Wednesday, February 6, 2013 1:50 PM
  • Hello all,

    Thank you for letting us know the issue and we can confirm that there was a system issue, engineering teams have since resolved the issue and users should be able to connect to the API service.

    Thursday, February 7, 2013 12:26 PM