Re: Invalid certificate error

On Thu, 2001-11-29 at 04:12, Jonathan Byrne wrote:
> As per the instructions in encryption.txt, but I found a couple
> of problems with it, one being that steps 3 and 4 are out
> of order in the instructions for creating the certificate
> (I'm sure you've already noticed that too - stunnel.pem
> has to be created first, then cert.txt is generated from it).

Eeww. *SMACK*

> 
> The other comes from the stunnel manpage:
> 
> The order of contents of the .pem file is also important. It should
> contain the unencrypted private key first, then a signed certificate
> (not certificate request). There should be also empty lines after
> certificate and private key. Plaintext certificate information appended
> on the top of generated certificate should be discarded. So the file
> should look like this:
> 
> -----BEGIN RSA PRIVATE KEY-----
> [encoded key]
> -----END RSA PRIVATE KEY-----
> [empty line]
> -----BEGIN CERTIFICATE-----
> [encoded certificate]
> -----END CERTIFICATE-----
> [empty line]
> 
> According to that, the private key must come first in stunnel.pem,
> followed by the certificate, and  blank lines must separate the key
> and the certificate, as well as follow the certificate.
> 
> When I generated stunnel.pem file conforming to this, the
> error from up2date changed to: Method Not Found.

OH DARN. Ok, I'll adjust the encryption.txt file in the next snapshot
and include all this. Maybe a shell script to auto-generate whats
needed?


> From current
> ------------
> standalone.do_POST()
> client_address ('127.0.0.1', 46166)
> command POST
> path https://yamame.gol.ad.jp/XMLRPC
> headers Host: yamame.gol.ad.jp
> User-Agent: xmlrpclib.py/$Revision: 1.41 $
> Content-Type: text/xml
> X-Client-Version: 1
> Content-Length: 2103
> X-Info: XML-RPC Processor (C) Red Hat, Inc ($Revision: 1.30 $)
> 
> Requesting: up2date.login
> module = up2date
> function = login
> api = ['header', 'listall_size', 'package', 'source_package_by_name', 'solvedep']
> RESPONSE is a Fault
> requesthandler.log_request() "POST https://yamame.gol.ad.jp/XMLRPC HTTP/1.0" 200 -

 
> This looks like progress, since it appears that with the 
> new .pem made in accordance with the man page, it is 
> successfully opening the connection, but then cannot
> go further because that's as far as the code goes with
> 2.7 clients right now?

Yep. I've got login working here (although I can't tell if it worked for
you - you should have gotten a "GET" not supported error if login
worked.)

Did you run rhn_register first to get a systemid?


> If so, then using a 2.5 client should work, right?
> I can install one and try it, if so.

Yes, 2.5. (please use 2.5.4) clients should work fine, in an anonymous,
minimal sort of way.

> I'm pretty interested in this project, so whenever you
> have a new snapshot ready, I'll be happy to try it out and
> see how the 2.7.x stuff goes.

The latest snapshot includes mostly documentation fixes (encryption.txt)
and additions. There's little code to go with it, but I have 8 pages of 
hand-written notes about how I'm going to support v2.7.

> I'm not a programmer, but will be happy to contribute
> proofreading and suggestions to the docs where I can.

Always welcome. I will try to get you a new snapshot late today or
tomorrow AM.



-- 
Hunter Matthews                          Unix / Network Administrator
Office: BioScience 145/244               Duke Univ. Biology Department
Key: F0F88438 / FFB5 34C0 B350 99A4 BB02  9779 A5DB 8B09 F0F8 8438
Never take candy from strangers. Especially on the internet.