Re: Error with SSL certificates and SSL Filter

Hi Markus,

I tried your example and the result was the same error. I thought that 
there was a problem with the server because even with your script I 
didn't see any screen on the server to accept the certificate.

My problem is that the browser enters in a infinite loop after the page 
request. And no page related to any certificate is shown. I am usgin 
Firfox 3.0.17 and the certificate with apache went fine, the screen 
appeared and I could accept the certificate.

Does It make sense?  Do I forgot something, maybe a parameter of the filter?

Regards and thank you for the help.

Dario.

On 24/05/11 12:35, Markus Müller wrote:
> Hi Dario,
>
> I am also using untrusted certificates. There is no issue on server at 
> all for that, only on client side. You have to accept the certificate 
> in the browser, the server don't do anything about that. I just don't 
> understand why you think it could be anything about untrusted 
> certificates... Everything I mentioned is that in my test the message 
> only occures if I connect with a browser which aborts the connection 
> cause the certificate is not accepted by the client (= the browser).
>
> What exactly is your problem? Maybe your browser don't allow untrusted 
> certificates from a proxy server?
>
> Did you try my example? It makes a https server and not a https proxy. 
> Please try if http server works, maybe you just have a problem in your 
> browser about poxying and untrusted certificates.
>
> Regards,
> Markus Mueller
>>
>> You are right Markus, I am using a unstrusted certificate. Is there 
>> any way to use the SSL filter with untrusted certificates? I know 
>> other libs like LWP can deal with them.
>>
>> If this is a TODO or a bug I can help you fixing this on the POE SSL 
>> Filter code :)
>>
>> Regards,
>>
>> Dario.
>>
>> On 24/05/11 11:35, Andy Jenkinson wrote:
>>> When doing something similar, I seem to remember I got this error 
>>> when attempting to connect via HTTP too. I could be making that up 
>>> though.
>>>
>>> Cheers,
>>> Andy
>>>
>>> On 24 May 2011, at 10:07, Markus Müller wrote:
>>>
>>>> Hello everyone,
>>>>
>>>> I've tried the following program and it works under Debian Squeeze.
>>>>
>>>> The message "POE::Filter::SSL: UNEXPECTED ERROR: ERR1:0 ERR2:1 
>>>> HINT: Check if you have configured a CRT and KEY file, and that 
>>>> both are readable at /usr/share/perl5/POE/Wheel/ReadWrite.pm line 
>>>> 280" occures in my test only if the browser aborts the connection 
>>>> during SSL handshake because the certificate is untrusted. In any 
>>>> other case I can see the data the server is returning.
>>>>
>>>> Dieser Verbindung wird nicht vertraut
>>>>
>>>> Sie haben Firefox angewiesen, eine gesicherte Verbindung zu 
>>>> saytest.priv.de:82 aufzubauen, es kann aber nicht überprüft werden, 
>>>> ob die Verbindung sicher ist. Wenn Sie normalerweise eine 
>>>> gesicherte Verbindung aufbauen, weist sich die Website mit einer 
>>>> vertrauenswürdigen Identifikation aus, um zu garantieren, dass Sie 
>>>> die richtige Website besuchen. Die Identifikation dieser Website 
>>>> dagegen kann nicht bestätigt werden.
>>>>
>>>> Was sollte ich tun?
>>>>
>>>> Falls Sie für gewöhnlich keine Probleme mit dieser Website haben, 
>>>> könnte dieser Fehler bedeuten, dass jemand die Website fälscht. Sie 
>>>> sollten in dem Fall nicht fortfahren.
>>>>
>>>> Much regards,
>>>> Markus Mueller
>>>>
>>>> #!perl
>>>>
>>>> use strict;
>>>> use warnings;
>>>> use Socket;
>>>> use POE qw(
>>>>    Wheel::SocketFactory
>>>>    Wheel::ReadWrite
>>>>    Driver::SysRW
>>>>    Filter::SSL
>>>>    Filter::Stackable
>>>>    Filter::HTTPD
>>>>    Component::Server::TCP
>>>> );
>>>> POE::Component::Server::TCP->new(
>>>>     Alias        =>  "web_server",
>>>>     Port         =>  82,
>>>>     #ClientFilter =>  'POE::Filter::HTTPD', ##WITHOUT HTTPD FILTER 
>>>> THERE ISN'T HTTP HEADERS!!!
>>>>     ClientFilter =>  POE::Filter::Stackable->new(
>>>>         Filters =>  [
>>>>             POE::Filter::SSL->new(crt =>  'sslkeys/server.crt', key 
>>>> =>  'sslkeys/server.key'),
>>>>             POE::Filter::HTTPD->new(),
>>>>         ]
>>>>     ),
>>>>
>>>>     ClientInput  =>  \&handle_http_request,
>>>>     InlineStates =>  {got_response =>  \&handle_http_response,},
>>>> );
>>>>
>>>> sub handle_http_request {
>>>>    my ($kernel, $session, $heap, $buf) = @_[KERNEL, SESSION, HEAP, 
>>>> ARG0];
>>>>    my $content .= "Your URL was: ".$buf->uri."<hr>"
>>>>      if (ref($buf) eq "HTTP::Request");
>>>>    $content .= localtime(time());
>>>>    my $response = HTTP::Response->new(200);
>>>>    $response->push_header('Content-type', 'text/html');
>>>>    $response->content($content);
>>>>    $_[HEAP]{client}->put($response);
>>>>    $_[KERNEL]->yield("shutdown");
>>>> };
>>>>
>>>> POE::Kernel->run;
>>>> exit;
>>>>
>>>>> I am making a proxy and it must support the https protocol. I am
>>>>> trying to enable SSL feature in the server side with this command:
>>>>>
>>>>> POE::Component::Server::TCP->new(
>>>>>     Alias        =>  "web_server",
>>>>>     Port         =>  LISTEN_PORT,
>>>>>     #ClientFilter =>  'POE::Filter::HTTPD', ##WITHOUT HTTPD FILTER
>>>>> THERE ISN'T HTTP HEADERS!!!
>>>>>     ClientFilter =>  POE::Filter::Stackable->new(
>>>>>         Filters =>  [
>>>>>             POE::Filter::SSL->new(crt =>  'sslkeys/server.crt', 
>>>>> key =>
>>>>> 'sslkeys/server.key'),
>>>>>             POE::Filter::HTTPD->new(),
>>>>>         ]
>>>>>     ),
>>>>>
>>>>>     ClientInput  =>  \&handle_http_request,
>>>>>     InlineStates =>  {got_response =>  \&handle_http_response,},
>>>>> );
>>>>>
>>>>> But when a https request hit the server I get the following error:
>>>>>
>>>>> POE::Filter::SSL: UNEXPECTED ERROR: ERR1:-1 ERR2:1 HINT: Check if you
>>>>> have configured a CRT and KEY file, and that both are readable at
>>>>> /usr/share/perl5/POE/Wheel/ReadWrite.pm line 280
>>>>>
>>>>>
>>>>> I don't know what this error means because the files has the
>>>>> permission flags set to 777. Are required some special certs?
>>>>>
>>>>> Thanks in advance.
>>
>>