<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Browsers are a pretty opaque tool for testing certificates because of caching and locally stored certificates. Try openssl:</p>
<p><br>
</p>
<p> openssl s_client -connect hostname:443 -showcerts<br>
</p>
<p><br>
</p>
<p>You should see the whole chain of certificates going back to a root cert. Are you missing an intermediate certificate? You may need to add it to the ssl config in the webserver - in apache you can just concatenate your host cert and the intermediate.<br>
</p>
<p><br>
</p>
<p>s_client shows the status of the connection at the bottom:</p>
<p><br>
</p>
<p> Verify return code: 0 (ok)<br>
</p>
<p><br>
</p>
<p>Not 0 is an error of course.</p>
<p><br>
</p>
<p>As s_client opens a connection, you need to CTRL-C to break out (or issue an http command if you wish)<br>
</p>
<p><br>
</p>
<p>Hope that helps.</p>
<p><br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div>
<div dir="ltr"><br>
But now it simply refuses to get a valid https connection from the Xymon server eventhough you can web-browse to it with no issues and the browser says there is a valid https/cert/connection? Is there any place in Xymon I can see why it is failing?</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Jun 27, 2017 at 3:39 PM, John Thurston <span dir="ltr">
<<a href="mailto:john.thurston@alaska.gov" target="_blank">john.thurston@alaska.gov</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<span class="">On 6/27/2017 11:17 AM, Zoltan Forray wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
We are constantly having issues with sslcert alerts going non-green<br>
eventhough it says the cert is fine. Related to this is there being an<br>
issue getting to the https page from the Xymon server yet I can access<br>
it just fine from my browser.<br>
</blockquote>
<br>
</span>Any failure to establish an SSL connection will result in an error under sslcert. Could it be a failure to negotiate a secure connection due to an unreliable network connection?<br>
<br>
I suggest looking in the error log on your web server. You may find severed or incomplete connection attempts.<span class="HOEnZb"><font color="#888888"><br>
<br>
-- <br>
Do things because you should, not just because you can.<br>
<br>
John Thurston <a href="tel:907-465-8591" value="+19074658591" target="_blank">
907-465-8591</a><br>
<a href="mailto:John.Thurston@alaska.gov" target="_blank">John.Thurston@alaska.gov</a><br>
Department of Administration<br>
State of Alaska<br>
______________________________<wbr>_________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com" target="_blank">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" rel="noreferrer" target="_blank">http://lists.xymon.com/mailman<wbr>/listinfo/xymon</a><br>
</font></span></blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div><b>Zoltan Forray</b></div>
<div>Spectrum Protect (p.k.a. TSM) Software & Hardware Administrator</div>
<div>Xymon Monitor Administrator</div>
<div>VMware Administrator</div>
<div>Virginia Commonwealth University</div>
<div>UCC/Office of Technology Services</div>
<div><a href="http://www.ucc.vcu.edu" target="_blank">www.ucc.vcu.edu</a><br>
</div>
<div><a href="mailto:zforray@vcu.edu" target="_blank">zforray@vcu.edu</a> - 804-828-4807</div>
<div><font size="1">Don't be a phishing victim - VCU and other reputable organizations will never use email to request that you reply with your password, social security number or confidential personal information. For more details visit
<a href="http://infosecurity.vcu.edu/phishing.html" target="_blank">http://infosecurity.vcu.edu/phishing.html</a> </font></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>