# Python TLS Connection Reset By Peer **URL:** \ **Category:** Connectors & Integrations\ **Tags:** python, tls\ **Created:** [August 14, 2023, 5:13pm UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741 "2023-08-14T17:13:50Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![MrSmart](https://avatars.discourse-cdn.com/v4/letter/m/e19adc/32.png) [@MrSmart](https://community.solace.com/u/MrSmart)\ **Post date:** [August 14, 2023, 5:13pm UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/1 "2023-08-14T17:13:50Z")
I’m a bit at loss here, Solace shows everything is ready to accept TLS connections but it refuses with the following error on the client side: `solace.messaging.errors.pubsubplus_client_error.PubSubPlusCoreClientError: {'caller_description': 'do_connect', 'return_code': 'Not ready', 'sub_code': 'SOLCLIENT_SUBCODE_COMMUNICATION_ERROR', 'error_info_sub_code': 14, 'error_info_contents': 'TCP: Could not read from socket 8, error = Connection reset by peer (104)'}` Port 55443 is being listened to on the server, the port is open in the Firewall Security Group. ![image.png](https://canada1.discourse-cdn.com/solace/optimized/1X/40d4cfc72918031d9482ae62cecb2d0d2f874046_2_690x21.png) Solace TLS Status on VPN: ![image.png](https://canada1.discourse-cdn.com/solace/original/1X/275a6a075e6cf25d969359df3e0b7c4a5f7313f2.png) General TLS Settings: ![image.png](https://canada1.discourse-cdn.com/solace/original/1X/075bed6ae4ff0572c264ac8ad7fd8402c900e6d8.png) And some python code: `broker_props = { "solace.messaging.transport.host": f"tcp://{host1}:55443,tcp://{host2}:55443", "solace.messaging.service.vpn-name": "default", "solace.messaging.authentication.scheme.basic.username": credentials_username, "solace.messaging.authentication.scheme.basic.password": credentials_password }` Same result with both security strategies: `#transport_security_strategy = TLS.create().with_certificate_validation(True, False, "/etc/ssl/certs/ca-certificates.crt") transport_security_strategy = TLS.create().without_certificate_validation()` And our connection: `messaging_service = MessagingService.builder().from_properties(broker_props).with_reconnection_retry_strategy(RetryStrategy.parametrized_retry(20,3)).with_transport_security_strategy(transport_security_strategy).build()` `messaging_service.connect() ` ---
**Author:** ![MrSmart](https://avatars.discourse-cdn.com/v4/letter/m/e19adc/32.png) [@MrSmart](https://community.solace.com/u/MrSmart)\ **Post date:** [August 14, 2023, 5:20pm UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/2 "2023-08-14T17:20:20Z")
Just to add, connections via port 55555 work fine, messages are being accepted ---
**Author:** ![amackenzie](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/amackenzie/32/1168_2.png) [@amackenzie](https://community.solace.com/u/amackenzie)\ **Post date:** [August 14, 2023, 7:18pm UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/3 "2023-08-14T19:18:30Z")
You should be using tcps:// as the protocol, I believe. ---
**Author:** ![MrSmart](https://avatars.discourse-cdn.com/v4/letter/m/e19adc/32.png) [@MrSmart](https://community.solace.com/u/MrSmart)\ **Post date:** [August 14, 2023, 7:31pm UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/4 "2023-08-14T19:31:26Z")
That actually did the trick, now it says: `solace.messaging.errors.pubsubplus_client_error.PubSubPlusCoreClientError: SESSION CREATION UNSUCCESSFUL. Untrusted certificate. {'caller_description': 'do_connect', 'return_code': 'Not ready', 'sub_code': 'SOLCLIENT_SUBCODE_UNTRUSTED_CERTIFICATE', 'error_info_sub_code': 99, 'error_info_contents': "Session '(c0,s1)_default': The peer certificate is not trusted, rc='unable to get local issuer certificate'"}` There is a working Let’s Encrypt certificate active inside the broker. I link to the default Ubuntu CA Trust Store ![image.png](https://canada1.discourse-cdn.com/solace/original/1X/f0c6e15f40d5d346046505394b6fb623a3bd69c0.png) When I use `without_certificate_validation()` the connection works fine! So thank you for that at least 🙂 ---
**Author:** ![marc](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/marc/32/2191_2.png) [@marc](https://community.solace.com/u/marc)\ **Post date:** [August 16, 2023, 7:07pm UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/5 "2023-08-16T19:07:45Z")
Hi @MrSmart , Did you verify that LetsEncrypt is a valid certificate authority per your system? I tried a quick google but couldn’t find a default list for ubuntu. Maybe try something like this: > Hope that helps! ---
**Author:** ![MrSmart](https://avatars.discourse-cdn.com/v4/letter/m/e19adc/32.png) [@MrSmart](https://community.solace.com/u/MrSmart)\ **Post date:** [August 18, 2023, 8:44am UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/6 "2023-08-18T08:44:02Z")
Hi @marc.dipasquale , This is what Let’s Encrypt mentions on their site: ![image.png](https://canada1.discourse-cdn.com/solace/original/1X/2659b76a9f68a1f16c48ae738383e0f12ce05d78.png) This is what the Ubuntu server gives back when listing all certificate subjects: ![image.png](https://canada1.discourse-cdn.com/solace/original/2X/6/6ceb99779c921f7157e5a66258203bfbcca2eec9.png) So I guess this should be able to work somehow. But it doesn’t. ---
**Author:** ![amackenzie](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/amackenzie/32/1168_2.png) [@amackenzie](https://community.solace.com/u/amackenzie)\ **Post date:** [August 18, 2023, 9:24am UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/7 "2023-08-18T09:24:27Z")
The 3rd parameter of the `with_certificate_validation()` method is `trust_store_file_path`. Have you tried passing `/etc/ssl/certs`? ---
**Author:** ![MrSmart](https://avatars.discourse-cdn.com/v4/letter/m/e19adc/32.png) [@MrSmart](https://community.solace.com/u/MrSmart)\ **Post date:** [August 18, 2023, 9:56am UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/8 "2023-08-18T09:56:00Z")
Well, it gave me something: 2023-08-18 09:54:55,794 [WARNING] solace.messaging.core: [\_solace\_transport.py:84] [[SERVICE: 0x7f726dc14280] - [APP ID: eupq01/796/00000001/cyDP6jieow]] {‘caller\_description’: ‘From service event callback’, ‘return\_code’: ‘Ok’, ‘sub\_code’: ‘SOLCLIENT\_SUBCODE\_FAILED\_LOADING\_TRUSTSTORE’, ‘error\_info\_sub\_code’: 98, ‘error\_info\_contents’: “Session ‘(c0,s1)\_default’: files in trust store ‘/etc/ssl/certs’ over the limit (64 files allowed)!”} Guess this would be a dead end then. I’m a guest at this server and have no influence over the trust store. ---
**Author:** ![amackenzie](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/amackenzie/32/1168_2.png) [@amackenzie](https://community.solace.com/u/amackenzie)\ **Post date:** [August 18, 2023, 10:04am UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/9 "2023-08-18T10:04:00Z")
Can you point to the certificate path directly? It would live at /etc/letsencrypt/live/domain\_name. ---
**Author:** ![MrSmart](https://avatars.discourse-cdn.com/v4/letter/m/e19adc/32.png) [@MrSmart](https://community.solace.com/u/MrSmart)\ **Post date:** [August 18, 2023, 10:05am UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/10 "2023-08-18T10:05:31Z")
the let’s encrypt certificate is on the broker server, this is the publisher server trying to push messages to the broker. ---
**Author:** ![amackenzie](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/amackenzie/32/1168_2.png) [@amackenzie](https://community.solace.com/u/amackenzie)\ **Post date:** [August 18, 2023, 11:17am UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/11 "2023-08-18T11:17:06Z")
Oh right… so do you have some way of getting the public cert so you can put it on a folder with less files? ---
**Author:** ![MrSmart](https://avatars.discourse-cdn.com/v4/letter/m/e19adc/32.png) [@MrSmart](https://community.solace.com/u/MrSmart)\ **Post date:** [August 18, 2023, 11:44am UTC](https://community.solace.com/t/python-tls-connection-reset-by-peer/1741/12 "2023-08-18T11:44:46Z")
well no, not really, aside from doing it manually I guess, but I’m not looking forward to be doing that every 2 months. If only we could raise the limit of 64, that would make the most sense.