<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">Not a problem with that.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">* Connected to webapp2013.geosoft.com (192.168.0.9) port 443 (#0)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">* Initializing NSS with certpath: sql:/etc/pki/nssdb<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">* CAfile: ./geosoft.crt<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"> CApath: none<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">* SSL connection using TLS_RSA_WITH_AES_128_CBC_SHA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">* Server certificate:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">* subject: CN=webapp2013.geosoft.com,OU=IT,O=Geosoft Inc.,L=Toronto,ST=Ontario,C=CA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">* start date: Nov 12 17:31:09 2012 GMT<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">* expire date: Nov 12 17:31:09 2014 GMT<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">* common name: webapp2013.geosoft.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">* issuer: CN=Geosoft Inc.,DC=geosoft,DC=com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:8.0pt;line-height:106%"><b><span style="font-size:9.0pt;line-height:106%;font-family:"Arial","sans-serif";color:#262626">Jason Chambers<br>
</span></b><span style="font-size:9.0pt;line-height:106%;font-family:"Arial","sans-serif";color:#666666">Network Administrator | Geosoft<br>
</span><span style="font-size:9.0pt;line-height:106%;font-family:"Arial","sans-serif";color:#666678"><a href="http://www.geosoft.com/" target="_blank"><span style="color:#666678">geosoft.com</span></a> |
<a href="http://blogs.geosoft.com/" target="_blank"><span style="color:#666678">blog</span></a> |
<a href="http://twitter.com/geosoft" target="_blank"><span style="color:#666678">twitter</span></a> |
<a href="http://www.linkedin.com/company/geosoft-inc." target="_blank"><span style="color:#666678">linkedIn</span></a> |
<a href="http://www.facebook.com/GeosoftInc" target="_blank"><span style="color:#666678">facebook</span></a> | T +1 416.369.0111 #344 | M +1 416.508.1410<br>
<br>
</span><span style="font-size:9.0pt;line-height:106%;font-family:"Arial","sans-serif";color:#666666">Trending topic on Earth Explorer:
</span><span style="font-size:9.0pt;line-height:106%;font-family:"Arial","sans-serif";color:#666678"><a href="http://www.earthexplorer.com/2012/Introduction_of_VOXI_Earth_Modelling_technology.asp" target="_blank"><span style="color:#666678">VOXI Earth Modelling</span></a></span><span style="font-size:9.0pt;line-height:106%;font-family:"Arial","sans-serif";color:#666666"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif""> Ralph Mitchell [mailto:ralphmitchell@gmail.com]
<br>
<b>Sent:</b> January-25-13 11:11 AM<br>
<b>To:</b> Jason Chambers<br>
<b>Cc:</b> Henrik Størner; xymon@xymon.com<br>
<b>Subject:</b> Re: [Xymon] SSL Error after upgrading to Fedora 18<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Try handing curl the CA cert for your internal CA:<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> curl -v --cacert path_to_your_CA_cert.pem <a href="https://server.domain.com">
https://server.domain.com</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Ralph Mitchell<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Fri, Jan 25, 2013 at 10:27 AM, Jason Chambers <<a href="mailto:Jason.Chambers@geosoft.com" target="_blank">Jason.Chambers@geosoft.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal">I think there might be a bug in OpenSSL in this build of Fedora 18 (which I have updated.) I ran the command you gave me and I'm getting this:<br>
<br>
CONNECTED(00000003)<br>
write:errno=104<br>
---<br>
no peer certificate available<br>
---<br>
No client certificate CA names sent<br>
---<br>
SSL handshake has read 0 bytes and written 172 bytes<br>
---<br>
New, (NONE), Cipher is (NONE)<br>
Secure Renegotiation IS NOT supported<br>
Compression: NONE<br>
Expansion: NONE<br>
---<br>
<br>
Which is suggesting that there isn't an SSL certificate there. Yet when I curl the location:<br>
<br>
curl: (60) Peer's Certificate issuer is not recognized.<br>
More details here: <a href="http://curl.haxx.se/docs/sslcerts.html" target="_blank">
http://curl.haxx.se/docs/sslcerts.html</a><br>
<br>
curl performs SSL certificate verification by default, using a "bundle"<br>
of Certificate Authority (CA) public keys (CA certs). If the default<br>
bundle file isn't adequate, you can specify an alternate file<br>
using the --cacert option.<br>
If this HTTPS server uses a certificate signed by a CA represented in<br>
the bundle, the certificate verification probably failed due to a<br>
problem with the certificate (it might be expired, or the name might<br>
not match the domain name in the URL).<br>
If you'd like to turn off curl's verification of the certificate, use<br>
the -k (or --insecure) option.<br>
<br>
<br>
Would this be everyone elses conclusion as well?<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
Jason Chambers<br>
Network Administrator | Geosoft<br>
<a href="http://geosoft.com" target="_blank">geosoft.com</a> | blog | twitter | linkedIn | facebook | T
<a href="tel:%2B1%20416.369.0111%20%23344">+1 416.369.0111 #344</a> | M <a href="tel:%2B1%20416.508.1410">
+1 416.508.1410</a><br>
<br>
Trending topic on Earth Explorer: VOXI Earth Modelling<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">-----Original Message-----<br>
From: <a href="mailto:xymon-bounces@xymon.com">xymon-bounces@xymon.com</a> [mailto:<a href="mailto:xymon-bounces@xymon.com">xymon-bounces@xymon.com</a>] On Behalf Of Henrik Størner<br>
Sent: January-25-13 1:38 AM<br>
To: <a href="mailto:xymon@xymon.com">xymon@xymon.com</a><br>
Subject: Re: [Xymon] SSL Error after upgrading to Fedora 18<br>
<br>
On 24-01-2013 21:43, Jason Chambers wrote:<br>
> I just upgraded to Fedora 18, and now servers that have SSL signed by<br>
> our internal CA is failing. The http test simply shows "SSL error"<br>
> meanwhile our public (GoDaddy) certs aren't causing issues. Is there a<br>
> log file I can peer into to find out why I'm getting these error<br>
> messages all of a sudden?<br>
<br>
No logfile, but try running "openssl s_client -connect IPADDRESS:PORT".<br>
This performs a connect and SSL handshake, which is basically the same as what Xymon does.<br>
<br>
I suppose the standard openssl.cnf is used by OpenSSL when Xymon uses the SSL libraries. Perhaps some defaults changed in relation to how openssl performs automatic certificate validation ? Would surprise me, though.<br>
<br>
<br>
Regards,<br>
Henrik<br>
<br>
_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>