API Download Tool Error transferring data: SSL connect error

[lipster26]

Hello,

I'm getting Error transferring data: SSL connect error when using the Download tool to call to an API. I just upgraded to 2022.1. I reinstalled 2021.4 and it worked on that version. I've also verified the keys/client Id work on Postman. Any ideas what changed in the upgrade?

Thanks.

[KilianL]

Hi @lipster26 ,

If you verified this error for version 2022.1 and it works on 2021.4, please reach out to support to let them know about it. They will investigate if this needs to be fixed or if it is expected behavior. 

You can submit your case here: https://community.alteryx.com/t5/Support/bd-p/SupportPage

[glenebb]

Was a fix found for this? I too have upgraded to 2022.1 and am seeing the same SSL connect error

[apathetichell]

Have you turned off AMP? Sure AMP has nothing to do with an SSL certificate but it also tends to be a bit unstable.

[lipster26]

Still having the issue and I just tried with the newer designer version.

[apathetichell]

Newer designer is more likely to have AMP - which you don't want to be using. What happens if you try curling wherever you are trying to reach directly from a command prompt? do you get an error?

[EdP]

Defect GCSE-641 relates to an issue in 2022.1 in which fewer Cipher Suites are sent from the 2022.1 Download Tool than in past versions, leading to an SSL handshake failure.

[DominiqueCap]

Is there any update on the fix for this error? It is hugely frustrating! I am having to rerun my Workflow multiple times which is suboptimal.

[dvortsis]

I'm having the same issue with Version: 2022.1.1.40869 Patch: 2. What is the issue's status please?

I didn't experience issue while on 2021.4

[EdP]

@DominiqueCap @dvortsis 

In 2022.1, Alteryx updated the versions of OpenSSL and LibCurl. This upgrade closed out vulnerabilities found in SSL including CVE-2009-3555. This vulnerability refers to a server that does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL.

You can contact the site you wish to access to verify the site has been patched against CVE-2009-3555 and that their server(s) are upgraded to support RFC 5746.

If the site is not updating its support for RFC 5746 and you (and your IT) are not concerned with the additional security the newer standards include, please open a case and ask for me (Ed Phelps) and I can provide information on forcing access to these less secure sites.