Force refresh all fails with SSL/TLS error.

[Don Dotcom]

Hi Sparky,

I did a force refresh all, and now can't connect to the TVDB.

Partial logfile follows...

Please advise what I can do to assist.

Thanks,

Don.

Yada yada yada...

2021-11-02 21:39:43|INFO| Starting Background Download...

2021-11-02 21:39:44|INFO| Status on screen updated: Validating TheTVDB cache
2021-11-02 21:39:44|INFO| Status on screen updated: Updates list from TVDB
2021-11-02 21:39:44|INFO| Status on screen updated: TheTVDB Login
2021-11-02 21:39:44|INFO| Acquire a TheTVDB token...  
2021-11-02 21:39:44|WARN| Exception caught on attempt 1 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
2021-11-02 21:39:46|WARN| Exception caught on attempt 2 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
2021-11-02 21:39:48|WARN| Exception caught on attempt 3 of 3 to get https://api4.thetvdb.com/v4/login - cancelling: The request was aborted: Could not create SSL/TLS secure channel.
2021-11-02 21:39:48|INFO| Status on screen updated: Could not connect to TVDB
2021-11-02 21:39:48|WARN| Error obtaining token from TVDB WebException SecureChannelFailure obtained. The request was aborted: Could not create SSL/TLS secure channel. with no response

[Don Dotcom]

Whoops...

2021-11-02 21:39:33|FATAL| TV Rename 4.4.4 logging started on Microsoft Windows NT 6.1.7601 Service Pack 1, 64 Bit OS, 64 Bit Process 4.0.30319.42000 Interactive with args:  

Version number is showing 4.4.4

[Sparky53]

Does it happen if you restart TV Rename?

[Don Dotcom]

Yes.  PC has been off overnight.  Just had a clean startup and it's still happening in 4.4.4

I've just tried another recent scan (log below)

I see there's a new version out.  I'll try that in a minute and report back.

10:11:50 WARN Exception caught on attempt 3 of 3 to get https://api4.thetvdb.com/v4/login - cancelling: The request was aborted: Could not create SSL/TLS secure channel.

10:11:50 INFO Status on screen updated: Could not connect to TVDB
10:11:50 WARN Error obtaining token from TVDB WebException SecureChannelFailure obtained. The request was aborted: Could not create SSL/TLS secure channel. with no response

[Don Dotcom]

Version 4.4.5 still happening.

Unable to run any scans after performing a force full refresh 2 days ago.

10:11:14 INFO *******************************

10:11:14 INFO Starting Background Download...
10:11:14 INFO Status on screen updated: Validating TheTVDB cache
10:11:14 INFO Status on screen updated: Updates list from TVDB
10:11:14 INFO Status on screen updated: TheTVDB Login
10:11:14 INFO Acquire a TheTVDB token...
10:11:15 WARN Exception caught on attempt 1 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
10:11:17 WARN Exception caught on attempt 2 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
10:11:19 WARN Exception caught on attempt 3 of 3 to get https://api4.thetvdb.com/v4/login - cancelling: The request was aborted: Could not create SSL/TLS secure channel.
10:11:19 INFO Status on screen updated: Could not connect to TVDB
10:11:19 WARN Error obtaining token from TVDB WebException SecureChannelFailure obtained. The request was aborted: Could not create SSL/TLS secure channel. with no response

=========================================================================================

Just retried the force refresh again, followed by a full scan.

10:11:26 INFO *******************************
10:11:26 INFO Starting Background Download...
10:11:26 INFO Status on screen updated: Validating TheTVDB cache
10:11:26 INFO Status on screen updated: Updates list from TVDB
10:11:26 INFO Status on screen updated: TheTVDB Login
10:11:26 INFO Acquire a TheTVDB token...
10:11:26 WARN Exception caught on attempt 1 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
10:11:28 WARN Exception caught on attempt 2 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
10:11:30 WARN Exception caught on attempt 3 of 3 to get https://api4.thetvdb.com/v4/login - cancelling: The request was aborted: Could not create SSL/TLS secure channel.
10:11:30 INFO Status on screen updated: Could not connect to TVDB
10:11:30 WARN Error obtaining token from TVDB WebException SecureChannelFailure obtained. The request was aborted: Could not create SSL/TLS secure channel. with no response

[Don Dotcom]

Version 4.4.6 still happening.

Unable to run any scans after performing a force full refresh 2 days ago.

17:11:20 INFO *******************************

17:11:20 INFO Starting Background Download...
17:11:20 INFO Status on screen updated: Validating TheTVDB cache
17:11:20 INFO Status on screen updated: Updates list from TVDB
17:11:20 INFO Status on screen updated: TheTVDB Login
17:11:20 INFO Acquire a TheTVDB token...
17:11:20 WARN Exception caught on attempt 1 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
17:11:22 WARN Exception caught on attempt 2 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
17:11:24 WARN Exception caught on attempt 3 of 3 to get https://api4.thetvdb.com/v4/login - cancelling: The request was aborted: Could not create SSL/TLS secure channel.
17:11:24 INFO Status on screen updated: Could not connect to TVDB
17:11:24 WARN Error obtaining token from TVDB WebException SecureChannelFailure obtained. The request was aborted: Could not create SSL/TLS secure channel. with no response

[Tom Snyder]

Looks like we may be in the same boat.  Switch over to TVDB v3 until Sparky fixes it or figures out what is wrong with TVDB's v4.  I was using v3 (which worked) and decided to try v4 (which gave a SSL/TLS error) and went back to v3 (which worked).

[Don Dotcom]

Ahhhh.  Thank you Tom!

Confirming I switched to V3 (Options\Preferences\Data Sources\The TVDB\Version) is a workaround, and I'm back up and running.

Interesting I didn't manually change this.  Could possibly have been updated in the force refresh when everything stopped working?

Thanks for your help.  Hopefully documenting it here may help anyone else until Sparky gets a chance to look into it, and it can be a lower priority as we have a workaround.

Thanks again.

[Sparky53]

Tracked here: https://github.com/TV-Rename/tvrename/issues/825

[Sparky53]

Can you try 4.4.7 please?

[Don Dotcom]

Hi Sparky,

TVDB V3 works correctly under 4.4.7, but I'm still getting the original failure with TVDB V4

2021-11-06 11:31:01|FATAL| TV Rename 4.4.7 logging started on Microsoft Windows NT 6.1.7601 Service Pack 1, 64 Bit OS, 64 Bit Process 4.0.30319.42000 Interactive with args:  

2021-11-06 11:31:01|INFO| Copyright (C) 2021 TV Rename
2021-11-06 11:31:01|INFO| This program comes with ABSOLUTELY NO WARRANTY; This is free software, and you are welcome to redistribute it under certain conditions
2021-11-06 11:31:01|WARN| Updated path for Assembly: C:\Program Files (x86)\TVRename\x64\CefSharp.Core.Runtime.dll
2021-11-06 11:31:01|INFO| Updated path for BrowserSubprocess: C:\Program Files (x86)\TVRename\x64\CefSharp.BrowserSubprocess.exe
2021-11-06 11:31:01|INFO| Updated path for LocalesDirPath: C:\Program Files (x86)\TVRename\x64\locales
2021-11-06 11:31:01|INFO| Updated path for ResourcesDirPath: C:\Program Files (x86)\TVRename\x64
2021-11-06 11:31:01|INFO| Dependencies all found
2021-11-06 11:31:01|INFO| Splash Screen Updated with: Filling Shows
2021-11-06 11:31:02|INFO| Splash Screen Updated with: Updating WTW
2021-11-06 11:31:02|INFO| Splash Screen Updated with: Write Upcoming
2021-11-06 11:31:02|INFO| Splash Screen Updated with: Write Recent
2021-11-06 11:31:02|INFO| Splash Screen Updated with: Setting Notifications
2021-11-06 11:31:02|INFO| Splash Screen Updated with: Creating Monitors
2021-11-06 11:31:02|INFO| Splash Screen Updated with: Starting Monitor
2021-11-06 11:31:02|INFO| Splash Screen Updated with: Running Auto-scan
2021-11-06 11:31:04|INFO| *******************************
2021-11-06 11:31:04|INFO| Starting Recent TV and Movies Scan for all shows and all movies...
2021-11-06 11:31:04|INFO| TV Rename is about to be busy doing Scan Recent since 6/11/2021 11:31:04 AM
2021-11-06 11:31:05|INFO| Doing downloads in the foreground...
2021-11-06 11:31:05|INFO| *******************************
2021-11-06 11:31:05|INFO| Starting Background Download...
2021-11-06 11:31:05|INFO| Status on screen updated: Validating TheTVDB cache
2021-11-06 11:31:05|INFO| Status on screen updated: Updates list from TVDB
2021-11-06 11:31:05|INFO| Status on screen updated: TheTVDB Login
2021-11-06 11:31:05|INFO| Acquire a TheTVDB token...  
2021-11-06 11:31:05|WARN| Exception caught on attempt 1 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
2021-11-06 11:31:07|WARN| Exception caught on attempt 2 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
2021-11-06 11:31:09|WARN| Exception caught on attempt 3 of 3 to get https://api4.thetvdb.com/v4/login - cancelling: The request was aborted: Could not create SSL/TLS secure channel.
2021-11-06 11:31:09|INFO| Status on screen updated: Could not connect to TVDB
2021-11-06 11:31:09|WARN| Error obtaining token from TVDB WebException SecureChannelFailure obtained. The request was aborted: Could not create SSL/TLS secure channel. with no response
2021-11-06 11:31:11|INFO| BG Download is busy - try again in 10 seconds
2021-11-06 11:31:12|WARN| WebException SecureChannelFailure obtained. The request was aborted: Could not create SSL/TLS secure channel. with no response   
2021-11-06 11:31:14|WARN| Scan stopped as updates failed
2021-11-06 11:31:14|INFO| TV Rename free again (busy since 6/11/2021 11:31:04 AM)
2021-11-06 11:31:21|INFO| *******************************
2021-11-06 11:31:21|INFO| Starting Background Download...
2021-11-06 11:31:21|INFO| Status on screen updated: Validating TheTVDB cache
2021-11-06 11:31:21|INFO| Status on screen updated: Updates list from TVDB
2021-11-06 11:31:21|INFO| Status on screen updated: TheTVDB Login
2021-11-06 11:31:21|INFO| Acquire a TheTVDB token...  
2021-11-06 11:31:21|WARN| Exception caught on attempt 1 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.
2021-11-06 11:31:24|WARN| Exception caught on attempt 2 of 3 to get https://api4.thetvdb.com/v4/login - will retry after delay 00:00:02: The request was aborted: Could not create SSL/TLS secure channel.

[Sparky53]

Hmmmm, Thanks for trying. Will have to try something else.

You on Win7? 

If so try

https://support.microsoft.com/en-us/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392

and/or
https://manage.accuwebhosting.com/knowledgebase/3008/How-do-I-enable-TLS-1-2-on-Windows-7.html

https://support.cybersource.com/s/article/How-do-I-enable-TLS-1-2-on-Windows-7

[Tom Snyder]

My log showed the same as Don's with 4.4.7 and trying to use TVDB v4 with Win7 so I tried the 3 things you told us to try.  First one said that Update had already been done.  The other two I entered (they were pretty much the same thing) and then rebooted.  Switches to v4 and ran Full Scan and got the same TLS error again.  One thing I noticed was that if I enter the  https://api4.thetvdb.com/v4/login line in my browser I get back -

{"message":"Method Not Allowed"} I have no idea if that means anything to you.

[Tom Snyder]

I also found this and tried everything there -

https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client#bkmk_winhttp

I also downloaded the EasyFix in the other Microsoft site you previously gave.

After all the changes made to the Registry and etc. I rebooted.

Result -  Still the same error.

Does CEF have to be set up for SSL/TLS?  I read something about SslVersion having to be set.  I know nothing about CSharp and whether you have that in there already but I happened to run across it when I was trying to figure out solutions on the Win7 side of things.

https://cefsharp.github.io/api/79.1.x/html/T_CefSharp_SslVersion.htm#!

[Sparky53]

I don't think CEF and SSL are related issues.

There is a link between windows 7 machines not being able to connect to TVDB v4. 

https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client

https://helpx.adobe.com/x-productkb/multi/eol-tls-support.html

https://support.microsoft.com/en-us/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392#bkmk_easy

[Tom Snyder]

So, just so I understand - when TVRename reaches out to theTVDB at https://api4.thetvdb.com/v4/login is it using CEF as a browser or does it use my default browser which happens to be Chrome?  As far as Win7 goes I've done all the Registry additions, Window Updates, Easy fix, and am using a TLS 1.2 compliant default browser.  I even went into the old IE settings and disabled TLS 1.0 and 1.1 and made sure 1.2 was enabled.  I've gone to https://www.ssllabs.com/ssltest/viewMyClient.html with my Chrome browser and it showed I'm using TLS 1.2 and 1.3.  That's why I thought it was related to CEF which I have no control over it's TLS setting.

[Sparky53]

When it reaches out to  https://api4.thetvdb.com/v4/login it is not using a browser. It is connecting directly.

CEF is used to display the right hand side (images, trailers, show summaries etc). CEF and your browser may be TLS1.2, but for some reason the direct connections are not. 

[Tom Snyder]

Now I understand.  Forget CEF and my browser.  It's more like a connection you make with Putty or some other terminal, I guess.

Forgive me for researching all this stuff.  It's just the way I've always been. If I don't know the answer, someone else probably does.  I'm not a modern day programmer.  My computer background goes back to Basic, Fortran, and COBOL. 

 

I see that you use NET 4.6.2.  Could you go to this Microsoft site https://docs.microsoft.com/en-us/dotnet/api/system.net.servicepointmanager.securityprotocol?view=net-5.0 and see if anything there might be helpful?   

[Sparky53]

Yes - that's exactly what we tried here: https://github.com/TV-Rename/tvrename/commit/584e01188b3214e5b8ef7e02cc32777a712187e1

Unfortunatley it didn't help

[Tom Snyder]

Oh, well, considering I know absolutely nothing on the subject and I am so far out of your league that it isn't funny, I'll gladly call it a near miss and leave it at that.

Are you getting any help at all on this from theTVDB folks?  How about other developers?  Are they experiencing the Win7 SSL/TLS problem as well?  

I know you'll come up with something.  You amaze me all the time with what you've accomplished so far.

[Sparky53]

Try this?

https://www.emailarchitect.net/easendmail/sdk/html/object_tls12.htm

I'll have another version of TV Rename too soon

[Tom Snyder]

I tried it but still no good.  Most of it was the same as what I had already entered.  The main new addition was the Server settings in the Registry.  I already had the Client lines.  The Windows Update listed for Windows 7 had already been installed.  

Looking forward to the new upcoming version of TV Rename.  Fingers crossed.

[Tom Snyder]

Ran 4.4.9 and still no good.  I even made sure that I had Net 4.8 Runtime in place.  Also installed Net 6.0 Runtime.  Everything on my end looks like it should work but it doesn't.  

We haven't heard back from Don in awhile.  Are we the only Win7 users that are having this problem?  

[Don Dotcom]

Hi guys,

I can confirm V4 still failing with SSL/TLS, v3 working fine.

Sorry about my absence.  I've been dealing with family issues.

[Tom Snyder]

Sorry to hear about your family issues.  I was just worried that I was all alone with this problem.

I'm out of ideas.  I keep going around in circles reading the various Microsoft and third-party websites about how to get TLS 1.2 to work with Windows 7.  All the settings have been checked and rechecked about three times.  Unfortunately I know nothing about C# and so I can't offer any input for good or bad to Sparky in that regard.  I'm still amazed that that gibberish (in my eyes) that he writes turns into such a wonderful program.  Even now 40 years later if you put some Basic, Fortran, or COBOL code in front of me I can follow it but I have no idea where to start with any of the various C variations.  To me, C programmers are magicians pulling rabbits out of their hats.  Hopefully Sparky can complete this TLS rabbit trick because I really don't want to move my TV Shows away from theTVDB if I don't have to.

[Don Dotcom]

All good Tom.  You were doing such a good job I was happy with your efforts, but no, you're not a lone voice in the dark either. ;-)

Not sure I can offer much of use at this time either.

We may just be stuck with the Micro$oft treadmill and have to "upgrade" to IMO a worse quality OS. 

I'm guessing my up-to-date web browsers on Win7 are implementing TLS 1.2, so there MUST be libraries available, but I'm not a dot net developer, so I don't know if they're readily available, or if it's even worthwhile for a small number of users.

I'll try and get some time to delve a little deeper and see if I can get it working myself.

Don.

[Tom Snyder]

Switching from Win7 is simply not an option for me.  The core of my whole video setup is based around Win7 and Windows Media Center.  Although some industrious people have come up with ways of running WMC with Win10 they mostly are stuck using an early version of 10 because with each new update they have a harder time getting it to work.  I use WMC solely as a PVR as it still is the most stable one out there even after all these years.  I use Emby as my media manager.  It works well together with TV Rename.

Speaking of Emby, I read that their TVDB plug-in for their beta of their next version is working real well with API v4.  I haven't seen any problems with Win7 with regards to it in their forum.

[Tom Snyder]

Boy, was I wrong about Emby.  They are trying to figure out how to get Win7 to work with TVDB API v4 also and getting nowhere.  Read these messages from their developer forum that I just found.  I'll give you a hint at the surprise ending to the conversation - We are sunk!  TMDB, here I come, whether I like it or not.

                                       Emby Win7 TLS 1.2 discussion

[TV Rename]

Lets see how we go asking again: https://github.com/thetvdb/v4-api/issues/149

[Tom Snyder]

Fingers are crossed.  But I was thinking, this is all about using Win7's built-in/last added browser IE 11.  If you were to use an external browser (Chrome, Firefox, etc. or even CEF) they come with their own cipher suites.  I was thinking how when doing a search with Jackett it loads up my default browser (Chrome) and not IE 11.  I don't do RSS or JSON searches but they probably work the same way.  So, there is already a precedence there.
Ideally it would be great to have TVDB provide ciphers that would work with Win7 but I think it can be worked around.  Fingers crossed either way.  I was pretty bummed before with the Emby news but I'm a bit more optimistic now.  

[Sparky53]

As I understand it ciphers are at a more fundamental level. (I could be wrong though)

Anyway looks like https://www.ssllabs.com/ssltest/analyze.html?d=api4.thetvdb.com&s=13.35.125.115&latest

says that some additional ciphers are supported

 

Specifically  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256  which windows 7 suppports

https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-7

[Tom Snyder]

Well, here's hoping that you are wrong if TVDB decides not to add the additional ciphers.  I don't understand why they wouldn't add them in.  It is to their benefit.  A lot of people are still using Windows 7 & 8 (especially WMC users) and it does nothing to subtract away from TVDB's security.  The more people using their service, the more money they make now.

I haven't checked yet but did you reply back to TVDB?  Last I saw they added the change as an Enhancement and assigned someone to the work but they wanted to know why you wanted the additional ciphers. 

Wait!  I just re-read your message here.  Are you saying that the ssllabs analysis shows they already made the change?  I'm ending this message so I can go check.  So excited!

[Tom Snyder]

Oh my Gawd!  It works!!!!  Sparky, you are amazing!  You have more pull than the folks at Emby.  All they got was a flat out "No".

I'll be sending you a drink very shortly and I suggest that all Win 7&8 users of TV Rename (and Emby, for that matter) send over a drink as well.

[Sparky53]

Glad it worked out guys.  We would not have got anywhere without you discovering the thread on the Emby channel - thanks

[Don Dotcom]

Hi All,

I'm just catching up on some old emails and it looks like you've had a success and gotten V4 to work!

Congratulations. I've just tried it in 4.4.9 and it still failing for me.

Hmmm.  I see 4.5.1 is out, but 4.4.9 has check for updates enabled, and manually checking for an update through the help menu is also showing no new version available.  It may be broken?

I've just tried API V4 on 4.5.1, and it's still failing with the usual SSL/TLS error.  I'm guessing I need to install updated cyphers in win7.  Can anyone point me to them please?

I'm somewhat at a loss to understand why TMDB are going so crazy over encryption anyway.  It's not nuclear launch codes, it's publicly available TV show data.

Am I missing something?  And thanks for all of the team's work!  Take the rest of the day off.  Tell them I said it was ok.  :-)

Don

[Tom Snyder]

I don't have time right now to go into detail but here is the condensed version as best as I understand it myself.

It's TVDB that is the trouble spot and not TMDB.  They supposedly are doing this because their server provider Amazon is requiring higher security protection.  There is still a threat that they may back out of the change that Sparky got them to make according to a recent post on TVDB's Developers forum.

Just go to the websites above that Sparky gave and follow the steps there and they will allow your Win7 to handle TLS v1.2. 

[Don Dotcom]

Ahhhh.  The problem of getting other people to do your infrastructure!  You're at their mercy.

Thanks for all the help Tom/Sparky.  I'll dig back and start fiddling. 

[Don Dotcom]

Ok.  I've had time to sit down and fix TLS 1.2 on my Win7 machine.

Documenting the fix here for the poor sods that come later.

Confirmed that KB3042058 & KB3020369 were installed.  (They were)

Checked group police security settings (Red herring.  They don't seem to actually be used on my system, so you may be able to skip this, but it's all detailed in the above KB articles.)

In the end, all I needed to do was add the missing registry keys for "TLS 1.2" under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Which is beautifully documented here

https://manage.accuwebhosting.com/knowledgebase/3008/how-do-i-enable-tls-1-2-on-windows-7.html

Rebooted, started TVR and retried the scan under API V4, and it worked.

It also immediately notified that there was a new version available, so I appear to have missed that notification.  I'm currently running 4.5.1 on Win7, and have just been notified of 4.5.3

Thanks to Tom & Sparky for proving that it could be achieved, and all their hard work.