<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Verdana,Geneva,sans-serif'>
<p>With "openssl verify <certfile>"? Then I'm stumped. If I do that on F17 without my self-signing CA cert appended to the file pointed to by "certificate=", I get an error 20. Append the cert, I get an ok. That should emulate what xymon is doing, I think.</p>
<p><br />You _did_ have openssl-devel installed when you built xymon, right?</p>
<p> </p>
<p>On 2013-01-25 14:24, Jason Chambers wrote:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px; width:100%"><!-- html ignored --><!-- head ignored --><!-- meta ignored --><!-- meta ignored -->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">Yes, I’ve downloaded the webapp2013 server cert in pem format and used openssl to verify that it’s ok. <!-- o ignored --></span></p>
<p class="MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;"><!-- o ignored --> </span></p>
<div>
<p class="MsoNormal" style="margin-bottom: 8.0pt; line-height: 106%;"><strong><span style="font-size: 9.0pt; line-height: 106%; font-family: 'Arial','sans-serif'; color: #262626;">Jason Chambers<br /></span></strong><span style="font-size: 9.0pt; line-height: 106%; font-family: 'Arial','sans-serif'; color: #666666;">Network Administrator | Geosoft<br /></span><span style="font-size: 9.0pt; line-height: 106%; font-family: 'Arial','sans-serif'; color: #666678;"><a href="http://www.geosoft.com/"><span style="color: #666678;">geosoft.com</span></a> | <a href="http://blogs.geosoft.com/"><span style="color: #666678;">blog</span></a> | <a href="http://twitter.com/geosoft"><span style="color: #666678;">twitter</span></a> | <a href="http://www.linkedin.com/company/geosoft-inc."><span style="color: #666678;">linkedIn</span></a> | <a href="http://www.facebook.com/GeosoftInc"><span style="color: #666678;">facebook</span></a> | T +1 416.369.0111 #344 | M +1 416.508.1410<br /><br /></span><span style="font-size: 9.0pt; line-height: 106%; font-family: 'Arial','sans-serif'; color: #666666;">Trending topic on Earth Explorer: </span><span style="font-size: 9.0pt; line-height: 106%; font-family: 'Arial','sans-serif'; color: #666678;"><a href="http://www.earthexplorer.com/2012/Introduction_of_VOXI_Earth_Modelling_technology.asp"><span style="color: #666678;">VOXI Earth Modelling</span></a></span><span style="font-size: 9.0pt; line-height: 106%; font-family: 'Arial','sans-serif'; color: #666666;"><!-- o ignored --></span></p>
</div>
<p class="MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;"><!-- o ignored --> </span></p>
<div>
<div style="border: none; border-top: solid #E1E1E1 1.0pt; padding: 3.0pt 0cm 0cm 0cm;">
<p class="MsoNormal"><strong><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif';">From:</span></strong><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif';"> xymon-bounces@xymon.com [mailto:xymon-bounces@xymon.com] <strong>On Behalf Of </strong>Another Xymon User<br /><strong>Sent:</strong> January-25-13 1:10 PM<br /><strong>To:</strong> xymon@xymon.com<br /><strong>Subject:</strong> Re: [Xymon] SSL Error after upgrading to Fedora 18<!-- o ignored --></span></p>
</div>
</div>
<p class="MsoNormal"><!-- o ignored --> </p>
<p><span style="font-family: 'Verdana','sans-serif';">So things are good with an explicit path to the CA bundle. <!-- o ignored --></span></p>
<p><span style="font-family: 'Verdana','sans-serif';">Are the "[ ca ]" and " [ CA_default ]" sections in /etc/pki/tls/openssl.cnf correct? Is the geosoft.crt file included in the file pointed to by "certificate =" in CA_default? (On my F17 systems that is cacert.pem, which is a slink to /etc/pki/tls/certs/ca-bundle.crt)<!-- o ignored --></span></p>
<p><span style="font-family: 'Verdana','sans-serif';">On 2013-01-25 12:16, Jason Chambers wrote:<!-- o ignored --></span></p>
<blockquote style="border: none; border-left: solid #1010FF 1.5pt; padding: 0cm 0cm 0cm 4.0pt; margin-left: 3.75pt; margin-top: 5.0pt; margin-bottom: 5.0pt;">
<div>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">Not a problem with that.</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;"> </span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">* Connected to webapp2013.geosoft.com (192.168.0.9) port 443 (#0)</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">* Initializing NSS with certpath: sql:/etc/pki/nssdb</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">* CAfile: ./geosoft.crt</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;"> CApath: none</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">* SSL connection using TLS_RSA_WITH_AES_128_CBC_SHA</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">* Server certificate:</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">* subject: CN=webapp2013.geosoft.com,OU=IT,O=Geosoft Inc.,L=Toronto,ST=Ontario,C=CA</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">* start date: Nov 12 17:31:09 2012 GMT</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">* expire date: Nov 12 17:31:09 2014 GMT</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">* common name: webapp2013.geosoft.com</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;">* issuer: CN=Geosoft Inc.,DC=geosoft,DC=com</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;"> </span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; margin-bottom: 8.0pt; line-height: 105%;"><strong><span style="font-size: 9.0pt; line-height: 105%; font-family: 'Arial','sans-serif'; color: #262626;">Jason Chambers</span></strong><strong><span style="font-size: 9.0pt; line-height: 105%; font-family: 'Arial','sans-serif'; color: #262626;"><br /></span></strong><span style="font-size: 9.0pt; line-height: 105%; font-family: 'Arial','sans-serif'; color: #666666;">Network Administrator | Geosoft<br /></span><span style="font-size: 9.0pt; line-height: 105%; font-family: 'Arial','sans-serif'; color: #666678;"><a href="http://www.geosoft.com/"><span style="color: #666678;">geosoft.com</span></a> | <a href="http://blogs.geosoft.com/"><span style="color: #666678;">blog</span></a> | <a href="http://twitter.com/geosoft"><span style="color: #666678;">twitter</span></a> | <a href="http://www.linkedin.com/company/geosoft-inc."><span style="color: #666678;">linkedIn</span></a> | <a href="http://www.facebook.com/GeosoftInc"><span style="color: #666678;">facebook</span></a> | T +1 416.369.0111 #344 | M +1 416.508.1410<br /><br /></span><span style="font-size: 9.0pt; line-height: 105%; font-family: 'Arial','sans-serif'; color: #666666;">Trending topic on Earth Explorer: </span><span style="font-size: 9.0pt; line-height: 105%; font-family: 'Arial','sans-serif'; color: #666678;"><a href="http://www.earthexplorer.com/2012/Introduction_of_VOXI_Earth_Modelling_technology.asp"><span style="color: #666678;">VOXI Earth Modelling</span></a></span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d; mso-fareast-language: EN-US;"> </span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><strong><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif';">From:</span></strong><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif';"> Ralph Mitchell [<a href="mailto:ralphmitchell@gmail.com">mailto:ralphmitchell@gmail.com</a>] <br /><strong><span style="font-family: 'Calibri','sans-serif';">Sent:</span></strong> January-25-13 11:11 AM<br /><strong><span style="font-family: 'Calibri','sans-serif';">To:</span></strong> Jason Chambers<br /><strong><span style="font-family: 'Calibri','sans-serif';">Cc:</span></strong> Henrik Størner; <a href="mailto:xymon@xymon.com">xymon@xymon.com</a><br /><strong><span style="font-family: 'Calibri','sans-serif';">Subject:</span></strong> Re: [Xymon] SSL Error after upgrading to Fedora 18</span><!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> <!-- o ignored --></p>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">Try handing curl the CA cert for your internal CA:<!-- o ignored --></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> <!-- o ignored --></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> curl -v --cacert path_to_your_CA_cert.pem <a href="https://server.domain.com">https://server.domain.com</a><!-- o ignored --></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> <!-- o ignored --></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">Ralph Mitchell<!-- o ignored --></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt: auto; margin-bottom: 12.0pt;"> <!-- o ignored --></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">On Fri, Jan 25, 2013 at 10:27 AM, Jason Chambers <<a href="mailto:Jason.Chambers@geosoft.com">Jason.Chambers@geosoft.com</a>> wrote:<!-- o ignored --></p>
<blockquote style="border: none; border-left: solid #CCCCCC 1.0pt; padding: 0cm 0cm 0cm 6.0pt; margin-left: 4.8pt; margin-top: 5.0pt; margin-right: 0cm; margin-bottom: 5.0pt;">
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">I think there might be a bug in OpenSSL in this build of Fedora 18 (which I have updated.) I ran the command you gave me and I'm getting this:<br /><br /> CONNECTED(00000003)<br /> write:errno=104<br /> ---<br /> no peer certificate available<br /> ---<br /> No client certificate CA names sent<br /> ---<br /> SSL handshake has read 0 bytes and written 172 bytes<br /> ---<br /> New, (NONE), Cipher is (NONE)<br /> Secure Renegotiation IS NOT supported<br /> Compression: NONE<br /> Expansion: NONE<br /> ---<br /><br /> Which is suggesting that there isn't an SSL certificate there. Yet when I curl the location:<br /><br /> curl: (60) Peer's Certificate issuer is not recognized.<br /> More details here: <a href="http://curl.haxx.se/docs/sslcerts.html">http://curl.haxx.se/docs/sslcerts.html</a><br /><br /> curl performs SSL certificate verification by default, using a "bundle"<br /> of Certificate Authority (CA) public keys (CA certs). If the default<br /> bundle file isn't adequate, you can specify an alternate file<br /> using the --cacert option.<br /> If this HTTPS server uses a certificate signed by a CA represented in<br /> the bundle, the certificate verification probably failed due to a<br /> problem with the certificate (it might be expired, or the name might<br /> not match the domain name in the URL).<br /> If you'd like to turn off curl's verification of the certificate, use<br /> the -k (or --insecure) option.<br /><br /><br /> Would this be everyone elses conclusion as well?<!-- o ignored --></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt: auto; margin-bottom: 12.0pt;"><br /><br /> Jason Chambers<br /> Network Administrator | Geosoft<br /><a href="http://geosoft.com">geosoft.com</a> | blog | twitter | linkedIn | facebook | T <a href="tel:%2B1%20416.369.0111%20%23344">+1 416.369.0111 #344</a> | M <a href="tel:%2B1%20416.508.1410"> +1 416.508.1410</a><br /><br /> Trending topic on Earth Explorer: VOXI Earth Modelling<!-- o ignored --></p>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;">-----Original Message-----<br /> From: <a href="mailto:xymon-bounces@xymon.com">xymon-bounces@xymon.com</a> [mailto:<a href="mailto:xymon-bounces@xymon.com">xymon-bounces@xymon.com</a>] On Behalf Of Henrik Størner<br /> Sent: January-25-13 1:38 AM<br /> To: <a href="mailto:xymon@xymon.com">xymon@xymon.com</a><br /> Subject: Re: [Xymon] SSL Error after upgrading to Fedora 18<br /><br /> On 24-01-2013 21:43, Jason Chambers wrote:<br /> > I just upgraded to Fedora 18, and now servers that have SSL signed by<br /> > our internal CA is failing. The http test simply shows "SSL error"<br /> > meanwhile our public (GoDaddy) certs aren't causing issues. Is there a<br /> > log file I can peer into to find out why I'm getting these error<br /> > messages all of a sudden?<br /><br /> No logfile, but try running "openssl s_client -connect IPADDRESS:PORT".<br /> This performs a connect and SSL handshake, which is basically the same as what Xymon does.<br /><br /> I suppose the standard openssl.cnf is used by OpenSSL when Xymon uses the SSL libraries. Perhaps some defaults changed in relation to how openssl performs automatic certificate validation ? Would surprise me, though.<br /><br /><br /> Regards,<br /> Henrik<br /><br /> _______________________________________________<br /> Xymon mailing list<br /><a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br /><a href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a><br /> _______________________________________________<br /> Xymon mailing list<br /><a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br /><a href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a><!-- o ignored --></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"> <!-- o ignored --></p>
</div>
</div>
<p class="MsoNormal"><span style="font-family: 'Verdana','sans-serif';"><!-- o ignored --> </span></p>
<pre>_______________________________________________<!-- o ignored --></pre>
<pre>Xymon mailing list<!-- o ignored --></pre>
<pre><a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><!-- o ignored --></pre>
<pre><a href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a><!-- o ignored --></pre>
</blockquote>
<div>
<p class="MsoNormal"><span style="font-family: 'Verdana','sans-serif';"> <!-- o ignored --></span></p>
</div>
</div>
<!-- html ignored --><br />
<pre>_______________________________________________
Xymon mailing list
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a>
<a href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a>
</pre>
</blockquote>
<div> </div>
</body></html>