Error when paying BitPay invoice

[ptereh]

I tried to pay a BitPay invoice. The Electrum wallet is supported by BitPay.

When I click on the link in the BitPay invoice it opens my wallet and then Electrum gives the following error message "Supplied CA Not Found in Trusted CA Store." I can then only click "Ok". Then the message disappears and the Pay To field is blank again. The same thing happens when I manually start and open my wallet and paste the given link in the Pay To field.

I'm using the windows desktop version 4.6.0 of Electrum on a W11 pc.

I've contacted BitPay about this issue a few days ago but their reply is basically useless and suggest the didn't even read my email.

Does anyone know what the error message means? And how I can fix it?

Please post your solution/suggestions here. Do not dm me. Thanks!

[Charles-Tim]

I have not used BitPay before, or may I have used it before but I could not remember. If I generate an invoice, I will prefer to manually open Electrum and paste the invoice instead on Electrum and send the coin.

Or you can see the BitPay bitcoin address on the invoice and the amount of coins you want to send, you can copy the bitcoin address on the invoice and paste the address on Electrum, input the amount of coins and send it instead without the invoice.

[ptereh]

Unfortunately BitPay doesn't show the actual address in the invoice. It only gives a link (payment protocol?) which Electrum is supposed to use to autofill the amount and address etc. Apparently there is a CA (no idea what that is) in the information that Electrum receives which it does not accept because it is "Not Found in Trusted CA Store".

According to a BitPay support article it should be able to accept a peer-to-peer payment but I dit not see that option when I was trying to pay.

[DaveF]

Not sure if this still works but:

https://alexk111.github.io/DeBitpay/

Should pull the amount & address from the invoice.
Have not used it in a really really really long time but back in the day it did the job.

Humor:
Real life "really really really long time" = multiple decades
Internet time "really really really long time" =couple of years

-Dave

[BitMaxz]

It seems it's related to CA certificate a connection authentication, according below

- https://electrum.readthedocs.io/en/latest/faq.html#i-might-run-my-own-server-are-client-server-connections-authenticated

I think the issue here is that your current Electrum server.
Have you tried to change your Electrum server first and test it again? That might be the reason why you got that error.

[ptereh]

Not sure if this still works but:

https://alexk111.github.io/DeBitpay/

Should pull the amount & address from the invoice.
Have not used it in a really really really long time but back in the day it did the job.

Humor:
Real life "really really really long time" = multiple decades
Internet time "really really really long time" =couple of years

-Dave

Thanks! I'll keep your suggestion in mind if I don't find a proper solution.

It seems it's related to CA certificate a connection authentication, according below

- https://electrum.readthedocs.io/en/latest/faq.html#i-might-run-my-own-server-are-client-server-connections-authenticated

I think the issue here is that your current Electrum server.
Have you tried to change your Electrum server first and test it again? That might be the reason why you got that error.

I haven't tried that yet. I'll try that first.

[FinneysTrueVision]

When paying a Bitpay invoice they allow you to select which wallet you are using. I usually select Samourai Wallet, even if I don’t actually use it, because it doesn’t support Payment Protocol and Bitpay will just show you a regular invoice with an address and amount. It also helps against wallet fingerprinting if you lie about which wallet you use.

[ptereh]

So I checked which server Electrum uses and it appears to connect automatically to a (random?) server, besides that it also connects to 9 other nodes. It is possible to manually connect to a single server however this is not recommended by electrum (no fork detection). You can also manually select a server and still have it connect to 9 other nodes.

Does Electrum trust servers?

In short, not really. The Electrum client never sends private keys to the servers. In addition, it verifies the information reported by servers, using a technique called Simple Payment Verification

By default, Electrum tries to maintain connections to ~10 servers. The client subscribes to block header notifications to all of these, and also periodically polls each for dynamic fee estimates. For all connected servers except one, that is all they are used for. Getting block headers from multiple sources is useful to detect lagging servers, chain splits, and forks.

One of the servers, arbitrarily, is selected as the “main” server.

https://electrum.readthedocs.io/en/latest/faq.html#does-electrum-trust-servers

Are client-server connections authenticated?

Electrum uses a client-server architecture, where the endpoints speak the Electrum protocol. The Electrum protocol is JSON-RPC based. The two main stacks the client supports are

    JSON-RPC over SSL/TLS over TCP

    JSON-RPC over TCP

Note that neither option uses HTTP.

The client only connects to servers over SSL (so plaintext TCP is not used). Prior to Electrum 3.1, there used to be a checkbox in the GUI to toggle this but it was removed.

As for authentication, the client accepts both CA-signed certificates and self-signed SSL certificates. When it first connects to a server, it pins the fact whether that server is using a CA-signed or a self-signed cert.

https://electrum.readthedocs.io/en/latest/faq.html#i-might-run-my-own-server-are-client-server-connections-authenticated

and:

Simple Payment Verification

Simple Payment Verification (SPV) is a technique described in Satoshi Nakamoto’s paper. SPV allows a lightweight client to verify that a transaction is included in the Bitcoin blockchain, without downloading the entire blockchain. The SPV client only needs download the block headers, which are much smaller than the full blocks. To verify that a transaction is in a block, a SPV client requests a proof of inclusion, in the form of a Merkle branch.

https://electrum.readthedocs.io/en/latest/spv.html#spv

This makes me think it is not a Bitpay issue.
Would you agree?

When paying a Bitpay invoice they allow you to select which wallet you are using. I usually select Samourai Wallet, even if I don’t actually use it, because it doesn’t support Payment Protocol and Bitpay will just show you a regular invoice with an address and amount. It also helps against wallet fingerprinting if you lie about which wallet you use.

Thanks for your suggestion!

[Abdussamad]

This has nothing to do with electrum servers. It's an issue with the SSL certificate that bitpay is sending to electrum. According to electrum you don't trust the certificate authority that issued that cert. I don't know how you would go about fixing it in windows 11.

[khaled0111]

What Abdussamad said is correct and since you are using the latest version of Electrum, then I guess the issue is on BitPay’s servers side.

You can wait toll they fix their SSL certificate or just use a bip170 decoder, like the one DaveF suggested, to extract the payment address and the amount to be sent then fill out the send form on Electrum manually.

I have no idea why BitPay insits on using this payment protocol instead of the regular URIs, though!

[DaveF]

...I have no idea why BitPay insits on using this payment protocol instead of the regular URIs, though!

Short version according to them is that it includes address & amount & fee
They have (or claim to have) had issues when fees were / are up people paying invoices with much lower fees then they should have so the TX sat in the mempool.

So this was created and they set the fees high enough to make sure payment should reasonably be in the next block.

Make of that what you will.

-Dave

[ptereh]

Everyone thanks so much for your reply!

It is clear to me now that the SSL certificate sent by Bitpay is not accepted by Electrum and it's not possible to manually edit this. It is something Bitpay has to fix.

In the mean time one can use a decoder (like https://alexk111.github.io/DeBitpay/ ) to extract the payment details. Alternatively you can tell Bitpay you're using Samourai Wallet (which does not support payment protocol), Bitpay should then show the details to manually make the payment.

[Forsyth Jones]

Everyone thanks so much for your reply!

It is clear to me now that the SSL certificate sent by Bitpay is not accepted by Electrum and it's not possible to manually edit this. It is something Bitpay has to fix.

In the mean time one can use a decoder (like https://alexk111.github.io/DeBitpay/ ) to extract the payment details. Alternatively you can tell Bitpay you're using Samourai Wallet (which does not support payment protocol), Bitpay should then show the details to manually make the payment.

It's the BIP-70 protocol (the one BitPay invoices use). Bitcoin Core removed support for BIP-70, and I think Electrum did too.

In other words, not all wallets support BIP-70; most use BIP-21 (Bitcoin URI).

Is bitpay still insists on BIP-70 today? This only makes things more complicated and negatively impacts the user experience.

I recommend using a different wallet or a BIP-70 decoder to extract payment information, as suggested by DaveF.

Not sure if this still works but:

https://alexk111.github.io/DeBitpay/

This is bizarre. Tell me the name of the store using bitpay so I can test it.

Oohhhh, if I'm not mistaken, bitpay displays wallet options when paying invoices and payment instructions. Can you confirm this? I recall that being the case.

[ghost43]

This has nothing to do with electrum servers. It's an issue with the SSL certificate that bitpay is sending to electrum. According to electrum you don't trust the certificate authority that issued that cert.

Indeed, this seems to be what's going on based on OP's description.

I don't know how you would go about fixing it in windows 11.

Electrum does not use the operating system's CA store anymore. The python certifi package is used, which bundles Mozilla's CA root store. certifi is a required dependency, and Electrum uses it as the CA store everywhere internally.

This has been the case since around version 3.3. Before that, for some network requests the certifi (/requests) store was used, for others, Electrum implicitly used the OS store. Using the OS store used to cause weird issues on some systems.

https://github.com/spesmilo/electrum/blob/8eb3c43603ed1915fa3e0b8d17c9dbeb183270c5/electrum/util.py#L88
https://github.com/spesmilo/electrum/blob/8eb3c43603ed1915fa3e0b8d17c9dbeb183270c5/contrib/deterministic-build/requirements.txt#L15-L16

Every version of Electrum ships with some specific version of certifi, so over time that CA store might get out of date, for an older release.
(At least when running the binaries. However if you e.g. install from a Linux distro, they might update the version of python3-certifi that they package independently of Electrum.)

[Geremia]

Electrum does not use the operating system's CA store anymore. The python certifi package is used, which bundles Mozilla's CA root store. certifi is a required dependency, and Electrum uses it as the CA store everywhere internally.

Well, /usr/lib/python3.12/site-packages/certifi/cacert.pem has the Google Trust Services (GTS) Root R4 cert that BitPay.com uses (but not "Google Trust Services WE1", which I added to cacert.pem), but I still get the "Supplied CA Not Found in Trusted CA Store." issue in Electrum 4.6.2.