Re: SSL Handshake error

On Tue, 2002-11-19 at 15:27, Alex Kramarov wrote:
> I have actually seen on several occasions that a certificate generated on RH

First I've heard of it, BUT I am not at all surprised.

Has anyone else seen this happen? (IE, do I need to update the docs)

Andrew,
   You'll find the shell commands used to generate that cert in the
cadmin program. If you can't get them to work on 6.2, let me know, I'll
send you a shell script to do it.

> 7.3 didn't work with RH 7.1 clients, In this case the client is 6.2, which
> puts the version difference in the openssl versions even farther - openssl
> is not always completely backwards compatible - i have seen these problems
> more then once. 
> 
> in that case, i generated the certificate on the 7.1 machine, and copied it
> to the server - this fixed the problem for both 7.3 and 7.1  - it's is worth
> to try to generate the certificate on the 6.2
> 
> Alex.
>  
> -------Original Message-------
>  
> From: [email protected]
> Date: éåí ùìéùé 19 ðåáîáø 2002 22:15:40
> To: Current Server Mailing List
> Subject: Re: [Current-server] SSL Handshake error
>  
> 99% of the time, this is due to the client having an incorrect
> RHNS-CA-CERT file.
>  
> Can you confirm that the 6.2 machines RHNS-CA-CERT is the one you
> generated, and not red hat's?
>  
>  
> On Tue, 2002-11-19 at 14:06, Andrew Hamlin wrote:
> > I've setup a current server on a Red Hat 7.3 machine. I can run
> > rhn_register and up2date on that box with the configuration files pointing
> > to both, localhost/XMLRPC and <ipaddress>/XMLRPC.
> > 
> > Now I've setup a second channel for a Red Hat 6.2 machine. Edited the
> config
> > files to point to <ipaddress>/XMLRPC and tried to run rhn_register.
> However,
> > I keep getting an SSL_connect error.
> > 
> > The apache log contains the following error:
> > [19/Nov/2002 13:44:38 14932] [error] OpenSSL: error:14094418:SSL
> > routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
> > 
> > I've tried reading through and updating the apache ssl settings as best I
> > can but to no avail!
> > 
> > The apache configuration changes I've tried:
> > 
> > Listed only the server.crt (as generated by cadmin create_certificate) as
> > the SSLCertificateChainFile
> > # Server Certificate Chain:
> > SSLCertificateChainFile /etc/httpd/conf/ssl.crt/server.crt
> > #SSLCertificateChainFile /etc/httpd/conf/ssl.crt/ca.crt
> > 
> > Rebuilt the ssl.crt hash files using the
> > /etc/httpd/conf/ssl.crt/Makefile.crt and changed apache's
> CACertificatePath
> > appropriately.
> > # Certificate Authority (CA):
> > SSLCACertificatePath /etc/httpd/conf/ssl.crt
> > 
> > Updated the ca-bundle.crt file and changed apache's CACertificateFile
> > #SSLCACertificateFile /etc/httpd/conf/ssl.crt/ca-bundle.crt
> > 
> > Tried to ask apache not to check with a CA at all...
> > # Client Authentication (Type):
> > #SSLVerifyClient require
> > #SSLVerifyDepth 10
> > SSLVerifyClient optional_no_ca
> > 
> > I'm no Apache/SSL expert so reading the comments in httpd.conf and trying
> > each of the settings has been the best I can do. Before going to off to
> > explore the web for posts about apache/ssl configuration I thought I'd ask
> > if anyone on the list has run into an SSL connection problem like this
> > before?
> > 
> > The Red Hat 6.2 machine I'm trying to use has all recently available
> patches
> > from Red Hat. The ones that I think may impact the running of the SSL
> > Connection are:
> > 
> > openssl-0.9.5a-29
> > up2date-2.7.61-6.x.1
> > rhn_register-2.7.9-6.x.1
> > 
> > Any thoughts?
> > 
> > Thanks,
> > Andrew
> > 
> > 
> > 
> -- 
> Hunter Matthews Unix / Network Administrator
> Office: BioScience 145/244 Duke Univ. Biology Department
> Key: F0F88438 / FFB5 34C0 B350 99A4 BB02 9779 A5DB 8B09 F0F8 8438
> Never take candy from strangers. Especially on the internet.
>  
> _______________________________________________
> Current-server mailing list
> [email protected]
> http://lists.dulug.duke.edu/mailman/listinfo/current-server
>  
> . 
> _______________________________________________
> Current-server mailing list
> [email protected]
> http://lists.dulug.duke.edu/mailman/listinfo/current-server
> 
> 
-- 
Hunter Matthews                          Unix / Network Administrator
Office: BioScience 145/244               Duke Univ. Biology Department
Key: F0F88438 / FFB5 34C0 B350 99A4 BB02  9779 A5DB 8B09 F0F8 8438
Never take candy from strangers. Especially on the internet.