ESM fold prediction service is broken #627

tomgoddard · 2023-10-25T19:26:17Z

tomgoddard
Oct 25, 2023

The ESM fold prediction web page is broken. I'd like to know if the fold prediction service is no longer maintained. I added ESM fold prediction to the widely used ChimeraX molecular visualization program and am wondering if I need to remove it from our software.

Thanks!

Tom Goddard
ChimeraX developer
University of California, San Francisco

Here are details. The broken fold prediction web page is

https://esmatlas.com/resources?action=fold

Pasting any sequence such as

GENGEIPLEIRATTGAEVDTRAVTAVEMTEGTLGIFRLPEEDYTALENFRYNRVAGENWKPASTVIYVGGTYARLCAYAPYNSVEFKNSSLKTEAGLTMQTYAAEKDMRFAVSGGDEVWKKTPTAN

and pressing the enter key gives the message

"Error: There was an error"

Similarly the ESM folding web service as described here https://esmatlas.com/about#api

https://api.esmatlas.com/foldSequence/v1/pdb/

is broken. For instance

$ curl -X POST --data "GENGEIPLEIRATTGAEVDTRAVTAVEMTEGTLGIFRLPEEDYTALENFRYNRVAGENWKPASTVIYVGGTYARLCAYAPYNSVEFKNSSLKTEAGLTMQTYAAEKDMRFAVSGGDEVWKKTPTAN" https://api.esmatlas.com/foldSequence/v1/pdb/

gives error

{"message": "Internal server error"}

These errors may be due to an SSL certificate error on the Meta server. An ESM prediction can be run from the ChimeraX molecular visualization program (menu Tools / Structure Prediction / ESMFold) and the error message is

requests.exceptions.SSLError: HTTPSConnectionPool(host='api.esmatlas.com', port=443): Max retries exceeded with url: /foldSequence/v1/pdb (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)')))

Checking the certificate for api.esmatlas.com issued by DigiCert using https://www.digicert.com/help/ reports

"The server is not sending the required intermediate certificate.
This server needs to be configured to include DigiCert's intermediate certificate to avoid trust errors in web browsers."

tomsercu · 2023-10-25T22:35:50Z

tomsercu
Oct 25, 2023

Thanks for flagging this. Your analysis around certificate issue could be pointing in the right direction as we got that certificate about a year ago when we were still at Meta.
Let me see if we can manage a quickfix about this from the outside.
In the next couple of months we would expect there to be a solution to have an API endpoint for ESMFold to be supported long-term

0 replies

tomgoddard · 2023-10-25T22:39:33Z

tomgoddard
Oct 25, 2023
Author

Thanks!

0 replies

nikitos9000 · 2023-10-25T23:22:34Z

nikitos9000
Oct 25, 2023

Hi, thanks for spotting this. We'll be renewing the certificate this week.

1 reply

tomsercu Oct 26, 2023

Hi there Nikita 👋 Thanks for looking into this!

tomgoddard · 2023-10-25T23:29:13Z

tomgoddard
Oct 25, 2023
Author

DigiCert who issued the certificate says the current esmatlas.com certificate is valid from Sept 25, 2023 to Sept 22, 2024. So the problem does not appear to be that it is expired. Here is the report from DigiCert's SSL certificate checker.

1 reply

StephaneRedon Oct 28, 2023

Hello,

Thank you for this great API (and awesome research)!

This is just to confirm we're seeing the same issue here (integration in the SAMSON molecular design platform). From our server, when we do

curl -X POST --data "AAAAAAAAAA" https://api.esmatlas.com/foldSequence/v1/pdb/

we get

curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

and

echo | openssl s_client -showcerts -servername api.esmatlas.com -connect api.esmatlas.com:443

appears to report that the chain is broken

CONNECTED(00000003)
depth=0 C = US, ST = California, L = Menlo Park, O = "Meta Platforms, Inc.", CN = *.esmatlas.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = California, L = Menlo Park, O = "Meta Platforms, Inc.", CN = *.esmatlas.com
verify error:num=21:unable to verify the first certificate
verify return:1
[...]

Glad to know there are plans for a long-term supported API!

Thanks again,
Best,

Stephane

StephaneRedon · 2023-11-14T00:49:33Z

StephaneRedon
Nov 14, 2023

Poke 😀

0 replies

tomgoddard · 2023-11-14T01:17:50Z

tomgoddard
Nov 14, 2023
Author

I'd also appreciate an update. We are releasing a new version of our ChimeraX molecular visualization software and need to decide if I remove ESMFold prediction.

0 replies

tomsercu · 2023-11-14T03:57:46Z

tomsercu
Nov 14, 2023

It looks like everyting works again from my side. Do people still see issues? What kind of error message do you get from the API?

2 replies

StephaneRedon Nov 14, 2023

Thanks for your reply. I still have the exact same errors as in my message above, copied again here :

From our server, when we do

curl -X POST --data "AAAAAAAAAA" https://api.esmatlas.com/foldSequence/v1/pdb/

we get

curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

and

echo | openssl s_client -showcerts -servername api.esmatlas.com -connect api.esmatlas.com:443

appears to report that the chain is broken

CONNECTED(00000003)
depth=0 C = US, ST = California, L = Menlo Park, O = "Meta Platforms, Inc.", CN = *.esmatlas.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = California, L = Menlo Park, O = "Meta Platforms, Inc.", CN = *.esmatlas.com
verify error:num=21:unable to verify the first certificate
verify return:1
[...]

Thanks,
Best,

Stephane

tomsercu Nov 16, 2023

@nikitos9000 Any chance you can see what's going on from your side?

tomgoddard · 2023-11-14T19:23:06Z

tomgoddard
Nov 14, 2023
Author

I also get the SSL certificate verification failure on an Ubuntu 22.04 LTS system, but not on a macOS 13.5.2 system. Here is the error from Ubuntu 22.04:

$ curl -X POST --data "GENGEIPLEIRATTGAEVDTRAVTAVEMTEGTLGIFRLPEEDYTALENFRYNRVAGENWKPASTVIYVGGTYARLCAYAPYNSVEFKNSSLKTEAGLTMQTYAAEKDMRFAVSGGDEVWKKTPTAN" https://api.esmatlas.com/foldSequence/v1/pdb/
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

I'm not too knowledgable about SSL certificates but each computer has a list of root certificates usually provided by the operating system. And that is very likely the source of the problem, that Ubuntu does not have a needed certificate. Also ChimeraX calling ESMFold on Mac also fails because it uses the SSL root certificates provided by the Python certifi module which does not allow api.esmatlas.com to be verified. So the problem is wide-spread and has to be fixed by Meta properly setting up the SSL certificate for api.esmatlas.com.

DigitCert's SSL checker (https://www.digicert.com/help/) continues to say api.esmatlas.com is not sending the required intermediate certificate, pasted below. And DigiCert is the issuer of the esmatlas.com certificate so that is very likely the problem. It should be easy for Meta IT person to fix this routine SSL certificate setup issue.

0 replies

tomgoddard · 2023-11-14T19:25:47Z

tomgoddard
Nov 14, 2023
Author

Here's another screen snapshot showing the DigiCert SSL certificate problem for api.esmatlas.com. My snapshot in the previous image obscured some of the web page.

3 replies

nikitos9000 Nov 16, 2023

Yes sorry we have some troubles with the certificate, but you still can access the API if you ignore it with e.g. curl ... --insecure. We'll be fixing this at some point of time

StephaneRedon Nov 16, 2023

Thank you for your reply. The curl example was just to easily show what's going on. Our server actually accesses the API using java, and I'm expecting many others have similar issues.

Thanks again,
best,

Stephane

tomgoddard Nov 16, 2023
Author

The ChimeraX app access the server via Python requests and enforces the certificate check. The DigiCert error says clearly what the problem is and provides links to how to fix it.

The server is not sending the required intermediate certificate.

This server needs to be configured to include DigiCert's intermediate certificate to avoid trust errors in web browsers.

If you manage this server, you can download the file from this link or from your customer account area.

Follow the directions on our certificate installation guide to install the missing intermediate.

If you have any problems correcting this issue, please contact our helpful support team and we would be happy to assist.

falatfernando · 2023-11-17T16:49:48Z

falatfernando
Nov 17, 2023

Any solutions yet?

0 replies

picousse · 2024-01-22T10:14:22Z

picousse
Jan 22, 2024

Using PopOS (ubuntu) this does not seem te be resolved yet?

0 replies

buerbaumer · 2024-02-06T18:35:22Z

buerbaumer
Feb 6, 2024

Hi all,
Many thanks to the META team for sharing this great https://api.esmatlas.com/foldSequence endpoint! What a tool! Wow!

For those using
a.) the requests library in python and
b.) cannot wait for the SSL fix on META side endpoint and
c.) got a waiver from your IT-security :-),
change
response = requests.post('https://api.esmatlas.com/foldSequence/v1/pdb/', headers=headers, data=sequence)
to
response = requests.post('https://api.esmatlas.com/foldSequence/v1/pdb/', headers=headers, data=sequence, verify=False)
for the time being.

Regards,
Harald

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ESM fold prediction service is broken #627

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 12 comments 7 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

ESM fold prediction service is broken #627

Replies: 12 comments · 7 replies

tomgoddard Oct 25, 2023 Author

tomgoddard Oct 25, 2023 Author

tomgoddard Nov 14, 2023 Author

tomgoddard Nov 14, 2023 Author

tomgoddard Nov 14, 2023 Author

tomgoddard Nov 16, 2023 Author

Replies: 12 comments 7 replies

tomgoddard
Oct 25, 2023
Author

tomgoddard
Oct 25, 2023
Author

tomgoddard
Nov 14, 2023
Author

tomgoddard
Nov 14, 2023
Author

tomgoddard
Nov 14, 2023
Author

tomgoddard Nov 16, 2023
Author