[JIRA] Updated: (CPPXT-82) libcurl, ExplicitKeyTrustEngine, PKIX could provide additional debug information

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/CPPXT-82?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated CPPXT-82:
------------------------------

     Affects Version/s:     (was: 1.4.2)
         Fix Version/s: 1.5
            Issue Type: Improvement  (was: Bug)
    Remaining Estimate: 2 hours
     Original Estimate: 2 hours

> libcurl, ExplicitKeyTrustEngine, PKIX could provide additional debug information
> --------------------------------------------------------------------------------
>
>                 Key: CPPXT-82
>                 URL: https://issues.shibboleth.net/jira/browse/CPPXT-82
>             Project: XMLTooling - C++
>          Issue Type: Improvement
>          Components: SOAP
>         Environment: RHEL 5 x86_64
>            Reporter: mthornton at idp.protectnetwork.org
>            Assignee: Scott Cantor
>            Priority: Minor
>             Fix For: 1.5
>
>   Original Estimate: 2 hours
>  Remaining Estimate: 2 hours
>
> debug levels for libcurl, TrustEngine.ExplicitKey and, optionally, TrustEngine.PKIX, could provide additional information for troubleshooting certificate issues, including details on incoming web server certificate for SOAP cert validation, etc...  currently, a failure in the default TrustEngine configuration is limited to logging below.  Details of the certificate are only logged by libcurl logging if certificate passes the X.509 verify callback.
> 2011-12-01 10:47:59 DEBUG XMLTooling.SOAPTransport.CURL [9]: sending SOAP message to https://<fqdn>:9443/idp/profile/SAML2/SOAP/ArtifactResolution
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: About to connect() to <fqdn> port 9443
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]:   Trying <ipaddress>...
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: connected
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: Connected to wls1032a.istc.agr.gc.ca (ipaddress) port 9443
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: SSLv3, TLS handshake, Client hello (1):
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: SSLv3, TLS handshake, Server hello (2):
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: SSLv3, TLS handshake, CERT (11):
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: ^K
> 2011-12-01 10:47:59 DEBUG XMLTooling.SOAPTransport.CURL [9]: invoking custom X.509 verify callback
> 2011-12-01 10:47:59 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: attempting to match credentials from peer with end-entity certificate
> 2011-12-01 10:47:59 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: no keys within this peer's key information matched the given end-entity certificate
> 2011-12-01 12:26:42 DEBUG XMLTooling.TrustEngine.PKIX [2]: checking that the certificate name is acceptable
> 2011-12-01 12:26:42 DEBUG XMLTooling.TrustEngine.PKIX [2]: certificate subject: CN=xxxx,OU=yyyy,O=zzzz,C=country
> 2011-12-01 12:26:42 DEBUG XMLTooling.TrustEngine.PKIX [2]: unable to match DN, trying TLS subjectAltName match
> 2011-12-01 12:26:42 DEBUG XMLTooling.TrustEngine.PKIX [2]: unable to match subjectAltName, trying TLS CN match
> 2011-12-01 12:26:42 ERROR XMLTooling.TrustEngine.PKIX [2]: certificate name was not acceptable
> 2011-12-01 12:26:42 ERROR XMLTooling.SOAPTransport.CURL [2]: supplied TrustEngine failed to validate SSL/TLS server certificate
> 2011-12-01 12:26:42 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS alert, Server hello (2):
> 2011-12-01 12:26:42 DEBUG XMLTooling.libcurl [2]: SSL certificate problem, verify that the CA cert is OK. Details:
> error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira