<font size=2 face="sans-serif">Problem is for some sites with valid certificates
too.</font>
<br><font size=2 face="sans-serif">I had checked to access page with wget
or lynx - and it is working.</font>
<br><font size=2 face="sans-serif">So I do not see reason why Xymon should
get "Server Timeout" for the same target.</font>
<br>
<br><font size=2 face="sans-serif">Here is the debug of wget. Please, advice
how to diagnose/debug Xymon to find the solution.</font>
<br><font size=2 face="sans-serif">I am a bit confused why nobody reporting
the same problem:</font>
<br><font size=2 face="sans-serif">* nobody using new openssl libraries?</font>
<br><font size=2 face="sans-serif">* nobody do https tests for some, may
a bot non-standard SSL certificates or web-sites?</font>
<br>
<br><font size=2 face="sans-serif">Anyway, my opinion - if this is working
for all other tools like lynx, wget, browsers, this could also work in
Xymon.</font>
<br>
<br><font size=2 face="sans-serif">Test case: both URL get Server Timeout
in Xymon, but working with wget:</font>
<br>
<br><font size=2 face="sans-serif">URL1: </font><a href=https://epak.pmlp.gov.lv/><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/</font></a><font size=2 face="sans-serif">
(here is redirect - I had found Xymon may have trouble with redirects
over https)</font>
<br><font size=2 face="sans-serif">URL2: </font><a href=https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx</font></a><font size=2 face="sans-serif">
(no redirects here, certificate valid, but XyMon can not access it)</font>
<br>
<br><font size=2 face="sans-serif">========= URL1: ===========</font>
<br><font size=2 face="sans-serif">[xymon@myhost~]$ wget --debug
</font><a href=https://epak.pmlp.gov.lv/><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/</font></a>
<br><font size=2 face="sans-serif">DEBUG output created by Wget 1.12 on
linux-gnu.</font>
<br>
<br><font size=2 face="sans-serif">--2013-10-23 13:02:52-- </font><a href=https://epak.pmlp.gov.lv/><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/</font></a>
<br><font size=2 face="sans-serif">Resolving epak.pmlp.gov.lv... 195.234.144.230</font>
<br><font size=2 face="sans-serif">Caching epak.pmlp.gov.lv => 195.234.144.230</font>
<br><font size=2 face="sans-serif">Connecting to epak.pmlp.gov.lv|195.234.144.230|:443...
connected.</font>
<br><font size=2 face="sans-serif">Created socket 3.</font>
<br><font size=2 face="sans-serif">Releasing 0x0000000001606440 (new refcount
1).</font>
<br><font size=2 face="sans-serif">Initiating SSL handshake.</font>
<br><font size=2 face="sans-serif">Handshake successful; connected socket
3 to SSL handle 0x0000000001607570</font>
<br><font size=2 face="sans-serif">certificate:</font>
<br><font size=2 face="sans-serif"> subject: /C=LV/ST=Riga/L=Riga/O=Office
of Citizenship and Migration Affairs/OU=Department of Population Register/CN=*.pmlp.gov.lv</font>
<br><font size=2 face="sans-serif"> issuer: /C=US/O=Thawte,
Inc./CN=Thawte SSL CA</font>
<br><font size=2 face="sans-serif">X509 certificate successfully verified
and matches host epak.pmlp.gov.lv</font>
<br>
<br><font size=2 face="sans-serif">---request begin---</font>
<br><font size=2 face="sans-serif">GET / HTTP/1.0</font>
<br><font size=2 face="sans-serif">User-Agent: Wget/1.12 (linux-gnu)</font>
<br><font size=2 face="sans-serif">Accept: */*</font>
<br><font size=2 face="sans-serif">Host: epak.pmlp.gov.lv</font>
<br><font size=2 face="sans-serif">Connection: Keep-Alive</font>
<br>
<br><font size=2 face="sans-serif">---request end---</font>
<br><font size=2 face="sans-serif">HTTP request sent, awaiting response...</font>
<br><font size=2 face="sans-serif">---response begin---</font>
<br><font size=2 face="sans-serif">HTTP/1.1 301 Moved Permanently</font>
<br><font size=2 face="sans-serif">Content-Length: 179</font>
<br><font size=2 face="sans-serif">Content-Type: text/html</font>
<br><font size=2 face="sans-serif">Location: </font><a href=https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx</font></a>
<br><font size=2 face="sans-serif">Server: Microsoft-IIS/6.0</font>
<br><font size=2 face="sans-serif">X-Powered-By: ASP.NET</font>
<br><font size=2 face="sans-serif">Date: Wed, 23 Oct 2013 10:02:45 GMT</font>
<br><font size=2 face="sans-serif">Connection: keep-alive</font>
<br>
<br><font size=2 face="sans-serif">---response end---</font>
<br><font size=2 face="sans-serif">301 Moved Permanently</font>
<br><font size=2 face="sans-serif">Registered socket 3 for persistent reuse.</font>
<br><font size=2 face="sans-serif">Location: </font><a href=https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx</font></a><font size=2 face="sans-serif">
[following]</font>
<br><font size=2 face="sans-serif">Skipping 179 bytes of body: [<head><title>Document
Moved</title></head></font>
<br><font size=2 face="sans-serif"><body><h1>Object Moved</h1>This
document may be found <a HREF="</font><a href=https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx</font></a><font size=2 face="sans-serif">">here</a></body>]
done.</font>
<br><font size=2 face="sans-serif">--2013-10-23 13:02:52-- </font><a href=https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx</font></a>
<br><font size=2 face="sans-serif">Reusing existing connection to epak.pmlp.gov.lv:443.</font>
<br><font size=2 face="sans-serif">Reusing fd 3.</font>
<br>
<br><font size=2 face="sans-serif">---request begin---</font>
<br><font size=2 face="sans-serif">GET /NYX.Nyx001.WebSite/Default.aspx
HTTP/1.0</font>
<br><font size=2 face="sans-serif">User-Agent: Wget/1.12 (linux-gnu)</font>
<br><font size=2 face="sans-serif">Accept: */*</font>
<br><font size=2 face="sans-serif">Host: epak.pmlp.gov.lv</font>
<br><font size=2 face="sans-serif">Connection: Keep-Alive</font>
<br>
<br><font size=2 face="sans-serif">---request end---</font>
<br><font size=2 face="sans-serif">HTTP request sent, awaiting response...</font>
<br><font size=2 face="sans-serif">---response begin---</font>
<br><font size=2 face="sans-serif">HTTP/1.1 200 OK</font>
<br><font size=2 face="sans-serif">Connection: keep-alive</font>
<br><font size=2 face="sans-serif">Date: Wed, 23 Oct 2013 10:02:45 GMT</font>
<br><font size=2 face="sans-serif">Server: Microsoft-IIS/6.0</font>
<br><font size=2 face="sans-serif">X-Powered-By: ASP.NET</font>
<br><font size=2 face="sans-serif">X-AspNet-Version: 2.0.50727</font>
<br><font size=2 face="sans-serif">Set-Cookie: ASP.NET_SessionId=xpwkktquphtyv02va2ms1ejv;
path=/; HttpOnly</font>
<br><font size=2 face="sans-serif">Cache-Control: no-cache</font>
<br><font size=2 face="sans-serif">Pragma: no-cache</font>
<br><font size=2 face="sans-serif">Expires: -1</font>
<br><font size=2 face="sans-serif">Content-Type: text/html; charset=utf-8</font>
<br><font size=2 face="sans-serif">Content-Length: 7365</font>
<br>
<br><font size=2 face="sans-serif">---response end---</font>
<br><font size=2 face="sans-serif">200 OK</font>
<br>
<br><font size=2 face="sans-serif">Stored cookie epak.pmlp.gov.lv -1 (ANY)
/ <session> <insecure> [expiry none] ASP.NET_SessionId xpwkktquphtyv02va2ms1ejv</font>
<br><font size=2 face="sans-serif">Length: 7365 (7.2K) [text/html]</font>
<br><font size=2 face="sans-serif">Saving to: `Default.aspx.2'</font>
<br>
<br><font size=2 face="sans-serif">100%[====================================================================================================================>]
7,365 --.-K/s in 0s</font>
<br><font size=2 face="sans-serif">2013-10-23 13:02:52 (832 MB/s) - `Default.aspx.2'
saved [7365/7365]</font>
<br>
<br><font size=2 face="sans-serif">========= URL2 =========================</font>
<br>
<br><font size=2 face="sans-serif">[xymon@myhost~]$ wget --debug
</font><a href=https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx</font></a>
<br><font size=2 face="sans-serif">DEBUG output created by Wget 1.12 on
linux-gnu.</font>
<br>
<br><font size=2 face="sans-serif">--2013-10-23 13:03:58-- </font><a href=https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx</font></a>
<br><font size=2 face="sans-serif">Resolving epak.pmlp.gov.lv... 195.234.144.230</font>
<br><font size=2 face="sans-serif">Caching epak.pmlp.gov.lv => 195.234.144.230</font>
<br><font size=2 face="sans-serif">Connecting to epak.pmlp.gov.lv|195.234.144.230|:443...
connected.</font>
<br><font size=2 face="sans-serif">Created socket 3.</font>
<br><font size=2 face="sans-serif">Releasing 0x00000000013ae4d0 (new refcount
1).</font>
<br><font size=2 face="sans-serif">Initiating SSL handshake.</font>
<br><font size=2 face="sans-serif">Handshake successful; connected socket
3 to SSL handle 0x00000000013af620</font>
<br><font size=2 face="sans-serif">certificate:</font>
<br><font size=2 face="sans-serif"> subject: /C=LV/ST=Riga/L=Riga/O=Office
of Citizenship and Migration Affairs/OU=Department of Population Register/CN=*.pmlp.gov.lv</font>
<br><font size=2 face="sans-serif"> issuer: /C=US/O=Thawte,
Inc./CN=Thawte SSL CA</font>
<br><font size=2 face="sans-serif">X509 certificate successfully verified
and matches host epak.pmlp.gov.lv</font>
<br>
<br><font size=2 face="sans-serif">---request begin---</font>
<br><font size=2 face="sans-serif">GET /NYX.Nyx002.WebSite/Default.aspx
HTTP/1.0</font>
<br><font size=2 face="sans-serif">User-Agent: Wget/1.12 (linux-gnu)</font>
<br><font size=2 face="sans-serif">Accept: */*</font>
<br><font size=2 face="sans-serif">Host: epak.pmlp.gov.lv</font>
<br><font size=2 face="sans-serif">Connection: Keep-Alive</font>
<br>
<br><font size=2 face="sans-serif">---request end---</font>
<br><font size=2 face="sans-serif">HTTP request sent, awaiting response...</font>
<br><font size=2 face="sans-serif">---response begin---</font>
<br><font size=2 face="sans-serif">HTTP/1.1 200 OK</font>
<br><font size=2 face="sans-serif">Connection: keep-alive</font>
<br><font size=2 face="sans-serif">Date: Wed, 23 Oct 2013 10:03:51 GMT</font>
<br><font size=2 face="sans-serif">Server: Microsoft-IIS/6.0</font>
<br><font size=2 face="sans-serif">X-Powered-By: ASP.NET</font>
<br><font size=2 face="sans-serif">X-AspNet-Version: 2.0.50727</font>
<br><font size=2 face="sans-serif">Set-Cookie: ASP.NET_SessionId=pecngh45oqe2sk45vhthua55;
path=/; HttpOnly</font>
<br><font size=2 face="sans-serif">Cache-Control: no-cache</font>
<br><font size=2 face="sans-serif">Pragma: no-cache</font>
<br><font size=2 face="sans-serif">Expires: -1</font>
<br><font size=2 face="sans-serif">Content-Type: text/html; charset=utf-8</font>
<br><font size=2 face="sans-serif">Content-Length: 8619</font>
<br>
<br><font size=2 face="sans-serif">---response end---</font>
<br><font size=2 face="sans-serif">200 OK</font>
<br>
<br><font size=2 face="sans-serif">Stored cookie epak.pmlp.gov.lv -1 (ANY)
/ <session> <insecure> [expiry none] ASP.NET_SessionId pecngh45oqe2sk45vhthua55</font>
<br><font size=2 face="sans-serif">Registered socket 3 for persistent reuse.</font>
<br><font size=2 face="sans-serif">Length: 8619 (8.4K) [text/html]</font>
<br><font size=2 face="sans-serif">Saving to: `Default.aspx.3'</font>
<br>
<br><font size=2 face="sans-serif">100%[====================================================================================================================>]
8,619 --.-K/s in 0s</font>
<br>
<br><font size=2 face="sans-serif">2013-10-23 13:03:58 (1007 MB/s) - `Default.aspx.3'
saved [8619/8619]</font>
<br><font size=2 face="sans-serif">-------------------</font>
<br><font size=2 face="sans-serif">this is output from: User-Agent: Wget/1.12
(linux-gnu)</font>
<br><font size=2 face="sans-serif">output from host with older ssl and
wget is the same (except User-Agent: Wget/1.11.4 Red Hat modified)</font>
<br>
<br>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Andrey Chervonets/Cominder/LV</font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">henrik@hswn.dk, </font>
<br><font size=1 color=#5f5f5f face="sans-serif">Cc:
</font><font size=1 face="sans-serif">xymon@xymon.com</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">31.07.2013 18:15</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: XyMon 4.3.12
- what about HTTPS problems repoirted for 4.3.11 ?</font>
<br>
<hr noshade>
<br>
<br><font size=2 face="sans-serif">Yes, there may be some specific or expired
certificate, </font>
<br><font size=2 face="sans-serif">but workaround not working anyway,</font>
<br>
<br><font size=2 face="sans-serif">Tested, using http3 does not help for
CentOS and OpenSUSE 12.3</font>
<br>
<br><font size=2 face="sans-serif">tested with URL: </font><a href=https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx><font size=2 face="sans-serif">https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx</font></a>
<br><font size=2 face="sans-serif">and some others.</font>
<br>
<div>
<br><font size=2 face="sans-serif">Best regards,</font>
<br>
<br><font size=2 face="sans-serif">Andrey Chervonets<br>
----------------------<br>
SIA CoMinder<br>
</font><a href=http://www.cominder.eu/><font size=2 face="sans-serif">http://www.cominder.eu/</font></a><font size=2 face="sans-serif"><br>
</font>
<br>
<br>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">henrik@hswn.dk</font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">Andrey Chervonets <a.chervonets@cominder.eu>,
</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Cc:
</font><font size=1 face="sans-serif"><xymon@xymon.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">25.07.2013 13:07</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: XyMon 4.3.12
- what about HTTPS problems repoirted for 4.3.11 ?</font>
<br>
<hr noshade>
<br>
<br>
<br><tt><font size=2>Hi,<br>
<br>
all indications are that this is an OpenSSL library problem (present in
<br>
OpenSSL 1.x, but not in the older 0.9.x versions).<br>
<br>
Debian has this bug report:<br>
</font></tt><a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702635"><tt><font size=2>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702635</font></tt></a><tt><font size=2><br>
<br>
SuSE has this:<br>
</font></tt><a href="http://lists.opensuse.org/opensuse-bugs/2013-05/msg01048.html"><tt><font size=2>http://lists.opensuse.org/opensuse-bugs/2013-05/msg01048.html</font></tt></a><tt><font size=2><br>
<br>
It appears that the problem only shows up when testing sites with <br>
specific SSL implementations; e.g. I've seen it when connecting to some
<br>
IIS versions.<br>
<br>
Apparently, a work-around is to force the use of SSLv3 instead of <br>
TLSv1; you can do that by changing the URL in hosts.cfg so it has <br>
"https3" instead of just "https".<br>
<br>
Regards,<br>
Henrik<br>
<br>
<br>
Den 25.07.2013 07:54, Andrey Chervonets skrev:<br>
> Good day!<br>
><br>
> I still not received any reply for my previous messages about https<br>
> tests problems in 4.3.11 or due openssl-1.0.nnnn.<br>
> Does 4.3.12 have fixes for that?<br>
><br>
> Or what should be the steps to find root cause and fix?<br>
> Just tell me in which direction should I go, I am not going to tale<br>
> much of Your time.<br>
><br>
> P.S. Really, I am surprised nobody else reported similar problems.
I<br>
> fill I have done something wrong. :(<br>
><br>
<br>
<br>
</font></tt>
<br></div>