Apple Push Notifications SSL Error

Question

The APNS worked fine for various month until few weeks. Every time we send Push Notifications the connection aborts with the following error:

PHP Warning: fwrite(): SSL operation failed with code 1. OpenSSL Error messages: error:1409F07F:SSL routines:SSL3_WRITE_PENDING:bad write retry

If I reconnect and resend or only resend the message to the Apple server I get the same error. Sometimes I can send to all devices without any problem. But sometimes it aborts at the 900th device, or at the 2000th device. It's not the I-have-not-collected-the-devices-from-Feedback-service-and-set-all-the-devices-to-inactive-Error. I'm connecting to the Feedback Service at regular intervals. It's another kind of error I don't know. Something has changed with the SSL connection. Can it be that Apple changed something with the SSL connection? Apple said it doesn't. And they doesn't support PHP.

We use PHP 5.3.3-7+squeeze3 with Suhosin-Patch (cli) (built: Jun 28 2011 08:24:40). This is the newest stable PHP version for Debian Linux Squeeze. This PHP version uses OpenSSL 0.9.8o (01 Jun 2010) on our server.

Please help.

Answer 1

Had a similar problem in python, I guess the underlying ssl libraries are the same so the solution might be similar.

SSL3_WRITE_PENDING seems to be caused when a socket write fails then you try to write again. In this case for whatever reason SSL_write requires you to retry the write with the exact same bytes as the original write or else it omits the SSL_WRITE_PENDING error.

The pattern of errors I was seeing was Connection Timeout, then lots of SSL_WRITE_PENDING errors. This was because first one of my writes failed (say with maybe a timeout error or connection closed error because I send a dodgy push request), then after that error I was continually trying to re-use the broken socket (and it was giving back the less-than-informative SSL_WRITE_PENDING error)

Are you sure that you're using a new socket connection when you 'reconnect and resend'? Because I wouldn't have thought you should get SSL_WRITE_PENDING on a fresh socket connection to the APNS server.

Another thing that could help is using the enhanced notification format, because then if you accidentally send a broken push to the Apple server, it will send you an error code back before closing the connection on you. If you're not already using enhanced then it would be good to do so because then you can make sure you're not making simple errors like wrong token or payload too long things.