[JIRA] Resolved: (CPPXT-82) libcurl, ExplicitKeyTrustEngine, PKIX could provide additional debug information

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/CPPXT-82?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor resolved CPPXT-82.
-------------------------------

    Resolution: Fixed

http://svn.shibboleth.net/view/cpp-xmltooling?rev=967&view=rev
http://svn.shibboleth.net/view/cpp-xmltooling?rev=968&view=rev

Dump cert on error or debug depending on whether transport check is required or not.

> libcurl, ExplicitKeyTrustEngine, PKIX could provide additional debug information
> --------------------------------------------------------------------------------
>
>                 Key: CPPXT-82
>                 URL: https://issues.shibboleth.net/jira/browse/CPPXT-82
>             Project: XMLTooling - C++
>          Issue Type: Improvement
>          Components: SOAP
>         Environment: RHEL 5 x86_64
>            Reporter: mthornton at idp.protectnetwork.org
>            Assignee: Scott Cantor
>            Priority: Minor
>             Fix For: 1.5
>
>   Original Estimate: 2 hours
>  Remaining Estimate: 2 hours
>
> debug levels for libcurl, TrustEngine.ExplicitKey and, optionally, TrustEngine.PKIX, could provide additional information for troubleshooting certificate issues, including details on incoming web server certificate for SOAP cert validation, etc...  currently, a failure in the default TrustEngine configuration is limited to logging below.  Details of the certificate are only logged by libcurl logging if certificate passes the X.509 verify callback.
> 2011-12-01 10:47:59 DEBUG XMLTooling.SOAPTransport.CURL [9]: sending SOAP message to https://<fqdn>:9443/idp/profile/SAML2/SOAP/ArtifactResolution
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: About to connect() to <fqdn> port 9443
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]:   Trying <ipaddress>...
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: connected
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: Connected to wls1032a.istc.agr.gc.ca (ipaddress) port 9443
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: SSLv3, TLS handshake, Client hello (1):
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: SSLv3, TLS handshake, Server hello (2):
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: SSLv3, TLS handshake, CERT (11):
> 2011-12-01 10:47:59 DEBUG XMLTooling.libcurl [9]: ^K
> 2011-12-01 10:47:59 DEBUG XMLTooling.SOAPTransport.CURL [9]: invoking custom X.509 verify callback
> 2011-12-01 10:47:59 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: attempting to match credentials from peer with end-entity certificate
> 2011-12-01 10:47:59 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: no keys within this peer's key information matched the given end-entity certificate
> 2011-12-01 12:26:42 DEBUG XMLTooling.TrustEngine.PKIX [2]: checking that the certificate name is acceptable
> 2011-12-01 12:26:42 DEBUG XMLTooling.TrustEngine.PKIX [2]: certificate subject: CN=xxxx,OU=yyyy,O=zzzz,C=country
> 2011-12-01 12:26:42 DEBUG XMLTooling.TrustEngine.PKIX [2]: unable to match DN, trying TLS subjectAltName match
> 2011-12-01 12:26:42 DEBUG XMLTooling.TrustEngine.PKIX [2]: unable to match subjectAltName, trying TLS CN match
> 2011-12-01 12:26:42 ERROR XMLTooling.TrustEngine.PKIX [2]: certificate name was not acceptable
> 2011-12-01 12:26:42 ERROR XMLTooling.SOAPTransport.CURL [2]: supplied TrustEngine failed to validate SSL/TLS server certificate
> 2011-12-01 12:26:42 DEBUG XMLTooling.libcurl [2]: SSLv3, TLS alert, Server hello (2):
> 2011-12-01 12:26:42 DEBUG XMLTooling.libcurl [2]: SSL certificate problem, verify that the CA cert is OK. Details:
> error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira