Uploader tool + homebrewed SSL cert = ugly

LabKey Support Forum (Inactive)
Uploader tool + homebrewed SSL cert = ugly Brian Connolly  2012-08-08 10:17
Status: Closed
 
Andy,
I believe there is a problem with your SSL configuration. At the top of the openssl output, you will notice

Certificate chain
 0 s:/C=US/postalCode=14627/ST=NY/L=Rochester/O=University of Rochester/OU=Center for Integrated Research Computing/CN=blis.urmc.rochester.edu
   i:/C=US/O=Internet2/OU=InCommon/CN=InCommon Server CA
 1 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
 2 s:/C=US/O=Internet2/OU=InCommon/CN=InCommon Server CA
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root


The order of your certificate chain is incorrect. Certificate #2 should be above certificate #1. Most SSL client implementations, such as the ones in browsers, can handle having the certificate chain in the wrong order, but JAVA is much more picky and is erroring out due to this misconfiguration.

If you fix this, I believe that the file upload applet will correctly. I recommend creating a new keystore file with the correct order and then configuring your server to use the new keystore. Given that you have a test server, which is experiencing the same error, you can probably test the new keystore on that server.

Thank you,

Brian

PS when running the openssl command in the future, use `openssl s_client -connect blis.urmc.rochester.edu:443` without specifying the CAFile. This will give you a true test of your SSL configuration.