Webhook URL fails: SubscriptionWebhookErrorCategory.CONNECTION_DENIED

Developer Support APIs & Integrations
,
1

Hey! I’ve created an app and installed it using OAUTH into our primary account. I had tested with a development url and everything worked as expected, then I switched to our production url. However I can see from my developer account that the requests are failing with the following result:

{
“success”: null,
“fail”: {
“error”: {
“status”: “error”,
“category”: “VALIDATION_ERROR”,
“subCategory”: “SubscriptionWebhookErrorCategory.CONNECTION_DENIED”,
“message”: “HubSpot’s connection request was denied by your app. Make sure your service is configured to accept webhook events from HubSpot and that you’ve provided the correct target webhook URL.”
},
“errorCategory”: “CONNECTION_DENIED”
}
}

The interesting thing is that there are no failed requests in our gateway/firewall logs, which records all requests. If I use the same url in a browser it will appear in the logs. So it looks as if the requests from HubSpot aren’t even reaching the edge of our network. I’m hoping someone on your side can see a more precise reason for this failure. Perhaps an issue with the TLS handshake?

Thanks

2

@CRoach5

Might be worth disconnecting and reconnecting the app. I have not seen this error before. I know you said it was successful with your development url.

What about with something like https://webhook.site?

Could also try creating a new app :thinking:

@himanshurauthan , have you experienced this one?

3

Thanks for the reply Dennis!

I actually did reinstall the app in an attempt to fix it, but sadly no change. The dev url I was testing with is a URL we own that points to our development servers in a private data center. Production is in a major cloud provider. So the infrastructures are indeed different. It’s just odd that the webhook doesn’t even register a hit against our firewall. I can certainly try a new app. However when I run a test webhook from my HubSpot dev account directly it fails as well, not sure if that helps.

4

Hi @CRoach5,

This seems very odd, but have you checked with the server team to check if HubSpot requests are blocked or something?

If you want my teammate can connect with you for a quick call and check the issue.

Regards,

5

Hey Himanshu, we actually solved this issue. It turns out that there was indeed an SSL issue but it’s not obvious. HubSpot (and Stripe too) servers require that a certificate include the full chain. So the Intermediate certs need to be bundled with the leaf, because their server will not reach out and download them automatically like a browser will. You can test this through a testing tool like at SSL Labs to see if the full chain is provided.