The remote server did not respond with the handshake secret

[vanju]

I try to get handshake and use postman to make request.
Authorization header and two parameters in body:
target: https://*****:100/asana.php (with port, ssl - letsencrypt)
resource: 1106837714907611 (project id)
And get response:

asana.php looks like:
$headers = apache_request_headers();
if(!empty($headers[‘X-Hook-Secret’])){
$secret_token = $headers[‘$secret_token’];
header("X-Hook-Secret: " . $secret_token);
header(“HTTP/1.1 200 OK”);
}

[vanju]

Post is sent to https://app.asana.com/api/1.0/webhooks

[Phil_Seeman]

Hey @Bastien_Siebman, you’ve done lots of PHP webhooks - any ideas what might be amiss here?

[Bastien_Siebman]

It was a long time ago, you are way better than me at webhooks, regardless what language is used

[Phil_Seeman]

@vanju
I think the odds are the issue is with the SSL certificate and/or configuration at your “target” server.

Take a look at this post:

X-Hook-Secret only 32 chars

Found the problem: mod_h2… Had http2 active on my webserver. Are you able to fix that? Actually I am running on http/1.1 again. Best regards, Kevin

and the two posts here from @johnnygoodnow:

Not getting a response to create webhook request

Hi @Stephane and others, Unfortunately, not a lot comes to mind immediately with this specific scenario. One thing I’d recommend is making sure that your server can handle TLS 1.1+ (1.1 or 1.2 as of now) connections, along with 2048 bit certificates or greater (which was mentioned earlier). I’m looking into our exact verification process to determine which CA bundle it uses and anything else it might do in that process, and will let you all know. Of note is that we have verified on our end tha…

See if any of that information helps.

[vanju]

Hello! Thanks for the answer! I use http 1.1. and Apache/2.4.29 that support certificates longer than 1024 bit.

@johnnygoodnow

Of note is that we have verified on our end that certificates from Let’s Encrypt do work (even though there was some debate on whether this worked over in https://forum.asana.com/t/x-hook-secret-only-32-chars/ ).

So, it might work with letsencrypt? Maybe there are other ideas?