<div dir="ltr">Hi all<div><br></div><div>Thanks for that.</div><div>httpsh works beautifully.</div><div><br></div><div>Regards</div><div>Vernon</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 9 December 2014 at 08:12, Tim McCloskey <span dir="ltr"><<a href="mailto:tm@freedom.com" target="_blank">tm@freedom.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Vernon,<br>
<br>
That is a bug in an early version of openssl, <a href="http://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=2240" target="_blank">http://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=2240</a>.<br>
Guessing that you can't patch it, so like Scott mentioned you could try to force a version, one that you have. The following is from the docs in 4.2.0, I did not check if these are still available in 4.3.17.<br>
<br>
"<br>
Forcing an HTTP or SSL version<br>
Some SSL sites will only allow you to connect, if you use specific "dialects" of HTTP or SSL. Normally this is auto-negotiated, but experience shows that this fails on some systems.<br>
<br>
bbtest-net can be told to use specific dialects, by adding one or more "dialect names" to the URL scheme, i.e. the "http" or "https" in the URL:<br>
<br>
* "2", e.g. https2://<a href="http://www.sample.com/" target="_blank">www.sample.com/</a> : use only SSLv2<br>
* "3", e.g. https3://<a href="http://www.sample.com/" target="_blank">www.sample.com/</a> : use only SSLv3<br>
* "m", e.g. httpsm://<a href="http://www.sample.com/" target="_blank">www.sample.com/</a> : use only 128-bit ciphers<br>
* "h", e.g. httpsh://<a href="http://www.sample.com/" target="_blank">www.sample.com/</a> : use only >128-bit ciphers<br>
* "10", e.g. http10://<a href="http://www.sample.com/" target="_blank">www.sample.com/</a> : use HTTP 1.0<br>
* "11", e.g. http11://<a href="http://www.sample.com/" target="_blank">www.sample.com/</a> : use HTTP 1.1<br>
<br>
These can be combined where it makes sense, e.g to force SSLv2 and HTTP 1.0 you would use "https210".<br>
"<br>
<br>
You could try http10://urltocert and not auto-negotiate the handshake.<br>
<br>
<br>
Regards,<br>
<br>
Tim<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
________________________________________<br>
From: Xymon [<a href="mailto:xymon-bounces@xymon.com">xymon-bounces@xymon.com</a>] on behalf of Vernon Everett [<a href="mailto:everett.vernon@gmail.com">everett.vernon@gmail.com</a>]<br>
Sent: Monday, December 8, 2014 3:42 PM<br>
To: Scott Pfister<br>
Cc: Xymon mailinglist<br>
Subject: Re: [Xymon] SSL Errors<br>
<span class=""><br>
Hi Scott<br>
<br>
All I get is a new error message. :-(<br>
<br>
https3<br>
</span>Unspecified SSL error in SSL_connect to 47873/tcp on host 1.2.3.4<<a href="http://1.2.3.4" target="_blank">http://1.2.3.4</a>>: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number<br>
<br>
httpt<br>
Unspecified SSL error in SSL_connect to 47873/tcp on host 1.2.3.4<<a href="http://1.2.3.4" target="_blank">http://1.2.3.4</a>>: error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list<br>
<span class=""><br>
And the https status remains red.<br>
<br>
Regards<br>
Vernon<br>
<br>
<br>
<br>
</span><span class="">On 8 December 2014 at 20:50, Scott Pfister <<a href="mailto:icepickjazz@gmail.com">icepickjazz@gmail.com</a><mailto:<a href="mailto:icepickjazz@gmail.com">icepickjazz@gmail.com</a>>> wrote:<br>
Good morning,<br>
<br>
What version of SSL is on the client with the cert? ? Was SSLv3 disabled due to poodle exploit? Can you try forcing it to connect using only TLS or SSLv3? In host.cfg set https3://... or httpst://...<br>
<br>
thanks<br>
<br>
<br>
<br>
</span><span class="">On Mon, Dec 8, 2014 at 4:33 AM, Vernon Everett <<a href="mailto:everett.vernon@gmail.com">everett.vernon@gmail.com</a><mailto:<a href="mailto:everett.vernon@gmail.com">everett.vernon@gmail.com</a>>> wrote:<br>
Hi all<br>
<br>
Trying to get an https test working to monitor certificate expiry.<br>
Test shows up red, with very descriptive "SSL Error".<br>
<br>
The xymonnet error appears a little more useful, but I can't find a resolution to the problem.<br>
Unspecified SSL error in SSL_connect to 47873/tcp on host <a href="http://1.2.3.4" target="_blank">1.2.3.4</a>: error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list<br>
<br>
Additional info.<br>
xymonnet version 4.3.17<br>
SSL library : OpenSSL 1.0.1j 15 Oct 2014<br>
LDAP library: OpenLDAP 20423<br>
<br>
Any advice appreciated.<br>
<br>
Regards<br>
Vernon<br>
<br>
--<br>
"Accept the challenges so that you can feel the exhilaration of victory"<br>
- General George Patton<br>
<br>
_______________________________________________<br>
Xymon mailing list<br>
</span><a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><mailto:<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a>><br>
<div class="HOEnZb"><div class="h5"><a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
<br>
<br>
<br>
<br>
<br>
--<br>
"Accept the challenges so that you can feel the exhilaration of victory"<br>
- General George Patton<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><span>"Accept the challenges so that you can feel the exhilaration of victory"</span><div><span>- General George Patton</span></div></div>
</div>