Search code examples
validationcertificatetwilio

Twilio SSL Validation - Error 11237

I am relating to Application and invalid certificate errors

When i initiate the call with Twilio REST API, and then pick up the phone, i can hear that error occured and Certificate Invalid - Could not find path to certificate appears in my alert dashboard.

However, certificate is located in the mozila certificate program, i can find certificate at Public All Intermediate Certs List. I dont use self signed certificate.

As soon as i disable SSL Certificate Validation inside Twilio Console Account settings, the problem is gone.

My result from qualys ssl lab are:

Summary:

  1. This server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. Grade capped to C.
  2. This server accepts RC4 cipher, but only with older protocols. Grade capped to B.
  3. The server does not support Forward Secrecy with the reference browsers.
  4. This server's certificate chain is incomplete. Grade capped to B.

Configuration:

  1. SSL 3 INSECURE

Cipher Suites:

  1. TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) WEAK
  2. TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x16) DH 4096 bits FS WEAK
  3. TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012) ECDH secp256r1 (eq. 3072 bits RSA) FS WEAK
  4. TLS_RSA_WITH_RC4_128_SHA (0x5) INSECURE
  5. TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011) ECDH secp256r1 (eq. 3072 bits RSA) FS INSECURE

Protocol details:

  1. Secure Renegotiation Supported
  2. POODLE (SSLv3) Vulnerable INSECURE SSL 3: 0xa
  3. Downgrade attack prevention Yes, TLS_FALLBACK_SCSV supported
  4. RC4 Yes INSECURE
  5. Forward Secrecy With some browsers

Shall i disable SSL or do you have any ideas what can i do?

Solution

  • Twilio developer evangelist here.

    I am hoping that your https://ssllabs.com/ssltest has scared you sufficiently enough. You need to upgrade your server from SSLv3 to TLS as SSLv3 and a lot more of your setup is insecure and will not protect you in the face of an attack.

    Twilio has deprecated support for SSLv3 and supports TLS. This is likely why you are getting an invalid certificate error.

    For the sake of your and your users own security and safety, please upgrade your server.