Re: SSL Handshake error

I have actually seen on several occasions that a certificate generated on RH
7.3 didn't work with RH 7.1 clients, In this case the client is 6.2, which
puts the version difference in the openssl versions even farther - openssl
is not always completely backwards compatible - i have seen these problems
more then once. 

in that case, i generated the certificate on the 7.1 machine, and copied it
to the server - this fixed the problem for both 7.3 and 7.1  - it's is worth
to try to generate the certificate on the 6.2

Alex.
 
-------Original Message-------
 
From: [email protected]
Date: éåí ùìéùé 19 ðåáîáø 2002 22:15:40
To: Current Server Mailing List
Subject: Re: [Current-server] SSL Handshake error
 
99% of the time, this is due to the client having an incorrect
RHNS-CA-CERT file.
 
Can you confirm that the 6.2 machines RHNS-CA-CERT is the one you
generated, and not red hat's?
 
 
On Tue, 2002-11-19 at 14:06, Andrew Hamlin wrote:
> I've setup a current server on a Red Hat 7.3 machine. I can run
> rhn_register and up2date on that box with the configuration files pointing
> to both, localhost/XMLRPC and <ipaddress>/XMLRPC.
> 
> Now I've setup a second channel for a Red Hat 6.2 machine. Edited the
config
> files to point to <ipaddress>/XMLRPC and tried to run rhn_register.
However,
> I keep getting an SSL_connect error.
> 
> The apache log contains the following error:
> [19/Nov/2002 13:44:38 14932] [error] OpenSSL: error:14094418:SSL
> routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
> 
> I've tried reading through and updating the apache ssl settings as best I
> can but to no avail!
> 
> The apache configuration changes I've tried:
> 
> Listed only the server.crt (as generated by cadmin create_certificate) as
> the SSLCertificateChainFile
> # Server Certificate Chain:
> SSLCertificateChainFile /etc/httpd/conf/ssl.crt/server.crt
> #SSLCertificateChainFile /etc/httpd/conf/ssl.crt/ca.crt
> 
> Rebuilt the ssl.crt hash files using the
> /etc/httpd/conf/ssl.crt/Makefile.crt and changed apache's
CACertificatePath
> appropriately.
> # Certificate Authority (CA):
> SSLCACertificatePath /etc/httpd/conf/ssl.crt
> 
> Updated the ca-bundle.crt file and changed apache's CACertificateFile
> #SSLCACertificateFile /etc/httpd/conf/ssl.crt/ca-bundle.crt
> 
> Tried to ask apache not to check with a CA at all...
> # Client Authentication (Type):
> #SSLVerifyClient require
> #SSLVerifyDepth 10
> SSLVerifyClient optional_no_ca
> 
> I'm no Apache/SSL expert so reading the comments in httpd.conf and trying
> each of the settings has been the best I can do. Before going to off to
> explore the web for posts about apache/ssl configuration I thought I'd ask
> if anyone on the list has run into an SSL connection problem like this
> before?
> 
> The Red Hat 6.2 machine I'm trying to use has all recently available
patches
> from Red Hat. The ones that I think may impact the running of the SSL
> Connection are:
> 
> openssl-0.9.5a-29
> up2date-2.7.61-6.x.1
> rhn_register-2.7.9-6.x.1
> 
> Any thoughts?
> 
> Thanks,
> Andrew
> 
> 
> 
-- 
Hunter Matthews Unix / Network Administrator
Office: BioScience 145/244 Duke Univ. Biology Department
Key: F0F88438 / FFB5 34C0 B350 99A4 BB02 9779 A5DB 8B09 F0F8 8438
Never take candy from strangers. Especially on the internet.
 
_______________________________________________
Current-server mailing list
[email protected]
http://lists.dulug.duke.edu/mailman/listinfo/current-server
 
.