RE: SSL Problem with 1.4.2: SOLVED

OK, I got it !

Big clock difference between client and server !!!!!

And moreover, I already had this problem with early current versions ;-) I
hope that this time, I will learn...

BR, - Patrick -
-----Original Message-----
From: Patrick Zwahlen [mailto:[email protected]] 
Sent: mercredi, 23. octobre 2002 16:27
To: '[email protected]'
Subject: [Current-server] SSL Problem with 1.4.2


Hello current people !

I am a pretty long time current user, and I have decided to make the big
jump from 1.0.5 to 1.4.2 ;-)

My current server is running on a 7.3 and I had absolutely no trouble
setting it up. It used to be serving a single channel (7.3/i386), and I have
now added a second channel (8.0/i386).

By copying the RHN-CA-CERT to my clients, I am able to update myself (7.3,
as I said), and every distant 7.3 clients (all running
up2date-2.7.86-7.x.3). Great, was really easy !

However, I am having problems when trying to update 8.0 clients (which I am
doing for the first time, as I haven't tried 1.0.6). I think I have done the
right changes to my up2date config file:
- Changed both URLs
- Set useGPG to "0"
- Played with useNoSSLForPackages

What happens is that I cannot register thoses clients with the server. The
client is saying:

===================================
There was an SSL error: [('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE',
'certificate verify failed')] ===================================

On the server side, both current.log and access_log are empty, and I have
the following in apache's error_log:

===================================
[Wed Oct 23 14:20:59 2002] [error] mod_ssl: SSL handshake failed (server
www.secure.int:443, client 10.172.33.105) (OpenSSL library error follows)
[Wed Oct 23 14:20:59 2002] [error] OpenSSL:
error:14094412:lib(20):func(148):reason(1042)
===================================

And yes, my RHN-CA-CERT is the right one ;-) Any idea what this could be, or
anyone having the same problem ?

Thank you very much for your help, and once again on this list: GREAT JOB
GUYS !


______________________________________________
DISCLAIMER

 This email and any files transmitted with it, including replies and
forwarded copies (which may contain alterations) subsequently transmitted
from the Company, are confidential and solely for the use of the intended
recipient. It may contain material protected by attorney-client privilege.
The contents do not represent the opinion of Dimension Data Switzerland
except to the extent that it relates to their official business. If you are
not the intended recipient or the person responsible for delivering to the
intended recipient, be advised that you have received this email in error
and that any use is strictly prohibited. If you are not the intended
recipient, please advise the sender by return e-mail, then delete this
message and any attachments. Dimension Data Switzerland  :
http://www.ch.didata.com

_______________________________________________
Current-server mailing list
[email protected]
http://lists.dulug.duke.edu/mailman/listinfo/current-server