On Wed, Aug 13, 2008 2:27 PM, "Dundas, Hope" <[EMAIL PROTECTED]> wrote:
We noticed intermittent "503 Service Unavailable" errors on our server today, and then noticed these in the logs, and I wonder if they're related? [Wed Aug 13 14:10:46 2008] [error] mod_cosign: snet_starttls: error:0D0C50A1:lib(13):func(197):reason(161)
From the OpenSSL source code: lib(13) = ERR_LIB_ASN1 func(197) = ASN1_F_ASN1_ITEM_VERIFY reason(161) = ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHMDid you recently replace or change the certificate used by cosign, or change the CosignCrypto directive in your httpd configuration in any way?
Does the certificate that you are using with cosign verify? Check your CosignCrypto directive to be sure you are verifying the correct certificate:
openssl verify -CApath /path/to/your/CA/directory -purpose ssl_client /path/to/your/certificate/file.cert
Next, are you able to connect to the U-M weblogin servers using the following command?
openssl s_client -connect weblogin.umich.edu:6663 -cert /path/to/your/cosign/certificate/file.cert -key /path/to/your/cosign/certificate/secret-key.key -CApath /path/to/your/CA/directory -starttls smtp
If the above command fails, there will likely be a clue to the problem in its output.
Have you recently upgraded your version of Apache HTTPD, or OpenSSL?
Is anyone aware of any Cosign outages/issues today?
This is a world-wide mailing list. There are no outages of the production weblogin servers at the University of Michigan. Please use [EMAIL PROTECTED], [EMAIL PROTECTED], or another U-M mail address for U-M specific questions in the future.
Mark Montague ITCS Web/Database Production Team The University of Michigan [EMAIL PROTECTED]
------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________ Cosign-discuss mailing list Cosign-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/cosign-discuss