SSL Error: alert internal error

[Christopher Peters]

So I got this to work on my test machine.  I installed JRE 1.7, and it
still proposed the bad certificate error when trying to connect using
openssl s_client -connect ... regardless of protocol specified.

So I started looking at my Tomcat configuration to see if there was
something amiss.  I compared my config to the page:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare

and found that I had set clientAuth = "true" instead of "want".  I looked
up what that does and apparently it requires a valid cert by supplied
before a transaction can be established.  I turned this to want and now it
works just fine.

To my way of thinking, this means the "alert bad certificate" error isn't
saying the cert the server is giving out is bad, but the one it's receiving
is bad (or non-existent).  I don't know if that's correct, but I do know
this new setting is working out and if someone with expertise cares to give
a little more explanation on why I would love to hear it.

Otherwise, I can just move forward now.  I think this is fixed :)

p.s. I am running on Solaris 10.  Thanks to the guy who suggested the Linux
fix, but it wasn't applicable.


On Mon, Jul 29, 2013 at 3:02 PM, Christopher Peters <cjpeters at uci.edu>wrote:

> Well, we are using it for the SSO transaction (which uses Apache), but I
> see your point.  I don't really know how Java's dependencies are set up,
> but if you say it's not relying on OSSL, I will take your word for it.
>  That makes life much simpler anyway.
>
> As for the SSL thing, I have a server mirrored on another system and I can
> set it up with 1.7 and see if I can get an OpenSSL connection to Tomcat on
> 8443.  I will give that a shot and let you know what I find out.
>
> Chris
>
>
> On Mon, Jul 29, 2013 at 2:50 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 7/29/13 5:47 PM, "Christopher Peters" <cjpeters at uci.edu> wrote:
>>
>> >I will work on upgrading Java to 1.7 and possibly OpenSSL and see if that
>> >fixes things.  We do have a rather old version of OpenSSL on the system,
>> >and the related libraries. And, of course, an old version of Java.
>>
>> You're not using OpenSSL, that's not relevant.
>>
>> The bad cert error isn't the expiration, we're talking protocol level
>> issues here. OpenSSL's s_client doesn't care about the dates or the
>> validity, it's just trying to negotiate the connection.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> Chris Peters
> Middleware Services Developer
> Office of Information Technology - NSP
> (949) 824-6845
> cjpeters at uci.edu
>



-- 
Chris Peters
Middleware Services Developer
Office of Information Technology - NSP
(949) 824-6845
cjpeters at uci.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130730/865cdeb0/attachment.html