"Internal Pandora error" due to invalid Pandora certificate

[ljcatlin]

Just reporting that I receive the message "An error has occurred with Pandora | Try Again | Internal Pandora error". Trying to use Hermes with OSX Mojave Beta.

[dsemb]

Same issue.

[Kenshin0120]

Same issue...

[riverLethe9]

Yes, I am getting that issue as well. It was working for a few hours, but then it gave me "An error has occurred with Pandora... Internal Pandora error" after I tried to skip a song. Quitting and restarting does not fix it.

[lambdatec]

Same issue.

[jjisawesome]

same, when i compile in xcode and then run, the error it gives is

2018-07-17 11:25:36.318573-0700 Hermes[35847:550770] Pandora.m:823 -[Pandora sendRequest:] https://tuner.pandora.com/services/json/?method=auth.partnerLogin&partner_id=&auth_token=&user_id=
2018-07-17 11:25:36.432753-0700 Hermes[35847:550770] CFNetwork SSLHandshake failed (-9807)
2018-07-17 11:25:36.432790-0700 Hermes[35847:550770] TCP Conn 0x600003717240 SSLHandshake failed (-9807)
2018-07-17 11:25:36.433253-0700 Hermes[35847:550770] HermesAppDelegate.m:713 -[HermesAppDelegate handlePandoraError:] error received {
    error = "The operation couldn\U2019t be completed. (OSStatus error -9807.)";
    request = "<PandoraRequest 0x600002141e50 auth.partnerLogin>";
}

[stave]

@jjisawesome An easy hack is to disable SSL.. Change Pandora.m:817 to [request tls] ? "" : "",.

It's certainly not the RIGHT answer, but hey, it makes my music play again.

Edit: Line 817, not 818.

[dsemb]

How do you do that? Terminal?

[jjisawesome]

@stave your fix worked, but i think you meant line 817 not 818

[jjisawesome]

@dsemb he means to change the file in the xcode project

[jjisawesome]

fyi, most of dark mode is supported with just that fix (icons and drawer need updating tho)

[nriley]

BTW folks — as it says on the front page, this project is unmaintained. I am the only former developer even looking at things from time to time, and I am only getting busier in my work, so I don't see much changing any time soon.

If anyone wants to work on the streaming issues or some dark mode-compatible icons or both, just start fixing stuff and file pull requests. If others don't pitch in, Hermes will continue to die a slow death.

(From the screenshot above It also looks like the drawer, which is a deprecated UI element in any case, essentially has no dark mode appearance so it'll look out of place no matter what. It might make sense to switch the station list/history to popovers, unless whoever does the work has a better idea.)

[jjisawesome]

Starting in September, I will be able to devote some time to things like icon design and learning the basics of app development. I am still pretty new when it comes to coding, but I don't think it will be too hard for me to learn how to wrangle the ui elements.

[dsemb]

I have not worked in Xcode before. The closest is some Terminal, Filemaker, and Access work. I am playing with Xcode now. Any resources you can suggest so that I can update and possibly help to maintain (in the future) Hermes. It is probably my favorite application I have installed and I will try to find time to maintain it.

[oey192]

FYI I am having the same problem as described in this thread (Internal Pandora Error) on High Sierra 10.13.6. I'm guessing whatever causes this bug in Mojave was also included in the ".6" release of High Sierra

[stave]

Better workaround: Manually trust the tuner.pandora.com certificate. Follow the directions on Apple's KB article for trusting certificates, which I've kind of summarized here:

Point Safari to https://tuner.pandora.com. In the warning that pops up, pick "view the certificate," click on *.pandora.com. Drag the large certificate icon to the desktop. Double click it. Add it to the "login" certificate. Double click it in Keychain Access. Expand the Trust section. Change Secure Sockets Layer (SSL) from "no value specified" to "Always Trust". Launch Hermes. Enjoy music.

Pandora's undocumented API that Hermes uses is at tuner.pandora.com, and it has an old certificate from GeoTrust, which is owned by Symantec. Apple, Google, and others aren't trusting these old certs anymore, because Symantec messed up pretty bad in its role as a root certificate authority. Until Pandora gets a better cert, your only options are to 1) stop using SSL or 2) trust their old cert for this specific purpose.

Once Pandora fixes the issue on their end (specifically, updates their tuner.pandora.com certificate), Hermes will start working again for everyone without any workaround.

[bdausses]

@stave, this works perfectly. Thanks for writing that up.

[dlindquist]

Same here - thanks @stave !

[dsemb]

Heck Yes!

Take care,

Dustin

Dustin Semb, PhD 509.710.4186 dsemb@icloud.com

PS Please consider the environment before printing this e-mail

On Aug 6, 2018, at 12:28 PM, David Lindquist notifications@github.com wrote:

Same here - thanks @stave https://github.com/stave !

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/HermesApp/Hermes/issues/337#issuecomment-410825618, or mute the thread https://github.com/notifications/unsubscribe-auth/Am6UK2UqZw2pXSm6CYibDfXE34LnJwF7ks5uOJjugaJpZM4UrtyO.

[fperez]

Quick note: in my case Safari didn't pop up any warnings, instead giving me only a Forbidden - you don't have permission to access / on this server page.

If that happens to you, click on the padlock icon on the URL bar, and the dialog with a "Show Certificate" button will appear. You can then follow @stave's instructions above.

[canturkisci]

Thank you @stave works for me as well. Have been trying to figure this for couple of weeks.

[darlinjgray]

Thank you @stave! Worked like a charm. :)

[tomvoss]

Is it possible that Pandora updated their certificate recently? I had Hermes stuck with the Try Again button for weeks (months?). Today I decided to press the button again and to my surprise Hermes is working again.

MacOS 10.13.6

[nriley]

@tomvoss Yes! tuner.pandora.com (non-Pandora One users) seems to be fixed as of today. internal-tuner.pandora.com (Pandora One) is not, but I may be able to figure out a way around it without rewriting networking. Will look into it more this weekend.

[nriley]

It does so automatically - it checks if you have a Pandora One account and switches over. But last I checked the certificate isn't updated so you may still be getting errors.

On Mon, Sep 10, 2018 at 01:25:11PM -0700, Chad Gatesman wrote:

Slightly off topic, but as a Pandora One user, how do I configure Hermes to use internal-tuner.pandora.com instead of tuner.pandora.com?

[Djspaceg]

fyi, most of dark mode is supported with just that fix (icons and drawer need updating tho)

Hi guys, I actually made the current set of icons, so I'd be happy to make a light version too, for the dark skin mode. In fact, the work is even sitting on my github repo: https://github.com/Djspaceg/hermes-images

[jpkossin]

Thank you @stave, @fperez, and @nriley. I needed all three of your comments to make this work for me. As a Pandora One subscriber, I had to follow @stave's steps but with the certificate for https://internal-tuner.pandora.com. It did not work for me by trusting the https://tuner.pandora.com certificate. Perseverance paid off on this one...

[Djspaceg]

I had the same initial issue as @jpkossin, but I had not persevered, giving up. I did try @jpkossin's steps and those did work for me. So I'm all good now! Thanks for commenting!

[antoncohen]

https://internal-tuner.pandora.com/ now has a certificate from DigiCert, so it is working. I think this issue can be closed.

[nriley]

Confirmed. I’ll remove the workaround when I get a chance.

[SimonSaysSmile]

Could someone walk me through on how to get dark-mode for Hermes? Thank you to everyone who contributed to this issue thread! I'm so grateful that I can use Hermes again :).