Re: SSL Handshake error

99% of the time, this is due to the client having an incorrect
RHNS-CA-CERT file.

Can you confirm that the 6.2 machines RHNS-CA-CERT is the one you
generated, and not red hat's?


On Tue, 2002-11-19 at 14:06, Andrew Hamlin wrote:
> I've setup a current server on a Red Hat 7.3 machine.  I can run
> rhn_register and up2date on that box with the configuration files pointing
> to both, localhost/XMLRPC and <ipaddress>/XMLRPC.
> 
> Now I've setup a second channel for a Red Hat 6.2 machine. Edited the config
> files to point to <ipaddress>/XMLRPC and tried to run rhn_register. However,
> I keep getting an SSL_connect error.
> 
> The apache log contains the following error:
> [19/Nov/2002 13:44:38 14932] [error] OpenSSL: error:14094418:SSL
> routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
> 
> I've tried reading through and updating the apache ssl settings as best I
> can but to no avail!
> 
> The apache configuration changes I've tried:
> 
> Listed only the server.crt (as generated by cadmin create_certificate) as
> the SSLCertificateChainFile
> #   Server Certificate Chain:
> SSLCertificateChainFile /etc/httpd/conf/ssl.crt/server.crt
> #SSLCertificateChainFile /etc/httpd/conf/ssl.crt/ca.crt
> 
> Rebuilt the ssl.crt hash files using the
> /etc/httpd/conf/ssl.crt/Makefile.crt and changed apache's CACertificatePath
> appropriately.
> #   Certificate Authority (CA):
> SSLCACertificatePath /etc/httpd/conf/ssl.crt
> 
> Updated the ca-bundle.crt file and changed apache's CACertificateFile
> #SSLCACertificateFile /etc/httpd/conf/ssl.crt/ca-bundle.crt
> 
> Tried to ask apache not to check with a CA at all...
> #   Client Authentication (Type):
> #SSLVerifyClient require
> #SSLVerifyDepth  10
> SSLVerifyClient optional_no_ca
> 
> I'm no Apache/SSL expert so reading the comments in httpd.conf and trying
> each of the settings has been the best I can do.  Before going to off to
> explore the web for posts about apache/ssl configuration I thought I'd ask
> if anyone on the list has run into an SSL connection problem like this
> before?
> 
> The Red Hat 6.2 machine I'm trying to use has all recently available patches
> from Red Hat. The ones that I think may impact the running of the SSL
> Connection are:
> 
> openssl-0.9.5a-29
> up2date-2.7.61-6.x.1
> rhn_register-2.7.9-6.x.1
> 
> Any thoughts?
> 
> Thanks,
> Andrew
> 
> 
> 
-- 
Hunter Matthews                          Unix / Network Administrator
Office: BioScience 145/244               Duke Univ. Biology Department
Key: F0F88438 / FFB5 34C0 B350 99A4 BB02  9779 A5DB 8B09 F0F8 8438
Never take candy from strangers. Especially on the internet.