Uploader tool + homebrewed SSL cert = ugly | Brian Connolly | 2012-08-08 10:17 |
Status: Closed | ||
Andy, I believe there is a problem with your SSL configuration. At the top of the openssl output, you will notice Certificate chain 0 s:/C=US/postalCode=14627/ST=NY/L=Rochester/O=University of Rochester/OU=Center for Integrated Research Computing/CN=blis.urmc.rochester.edu i:/C=US/O=Internet2/OU=InCommon/CN=InCommon Server CA 1 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root 2 s:/C=US/O=Internet2/OU=InCommon/CN=InCommon Server CA i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root The order of your certificate chain is incorrect. Certificate #2 should be above certificate #1. Most SSL client implementations, such as the ones in browsers, can handle having the certificate chain in the wrong order, but JAVA is much more picky and is erroring out due to this misconfiguration. If you fix this, I believe that the file upload applet will correctly. I recommend creating a new keystore file with the correct order and then configuring your server to use the new keystore. Given that you have a test server, which is experiencing the same error, you can probably test the new keystore on that server. Thank you, Brian PS when running the openssl command in the future, use `openssl s_client -connect blis.urmc.rochester.edu:443` without specifying the CAFile. This will give you a true test of your SSL configuration. |
||