On August 17, 2012 10:10 , Shawn Rahl <[email protected]> wrote: > [root@molar ~]# cat /dev/null | openssl s_client -connect > weblogin.umich.edu:6663 <http://weblogin.umich.edu:6663> -CApath > /etc/httpd/cosign-ca-dir -cert > /etc/httpd/certs/current/mitools-dev.dent.umich.edu.crt -key > /etc/httpd/certs/current/mitools-dev.dent.umich.edu.key -starttls smtp > -showcerts > CONNECTED(00000003) > didn't found starttls in server response, try anyway... > depth=1 /C=US/ST=Michigan/L=Ann Arbor/O=University of > Michigan/OU=ITCS/CN=UM Web CA/[email protected] > <mailto:[email protected]> > verify error:num=19:self signed certificate in certificate chain > verify return:0 > ---
> Note, we do not have self-signed certificates being used at all, so I > am not sure where the return code 19 and message is coming from. What is the output of "ls -la /etc/httpd/cosign-ca-dir" ? Be sure you have the following in that directory (note that this will be different for people from other institutions): lrwxrwxrwx. 1 root root 11 Jul 10 11:22 5cc1e784.0 -> umwebCA.pem -rw-r--r--. 1 root root 1334 Mar 19 10:56 umwebCA.pem Also make sure you have the correct CA root certificate: [root@minos certs]# sha512sum umwebCA.pem e8de2020db961a1d20ef17752945ebdfdc089ceeb9d9370d6cbbac29f3c65711994e5e54a03338d3d6b03b711faa197c229b9eb9832be982fa0cd3eb65a79a04 umwebCA.pem [root@minos certs]# The output you should see from the "openssl s_client -showcerts" command is: [root@minos certs]# openssl s_client -connect weblogin.umich.edu:6663 -cert /etc/pki/tls/certs/minos.lsa.umich.edu.crt -key /etc/pki/tls/private/minos.lsa.umich.edu.key -CApath /etc/pki/tls/certs -starttls smtp -showcerts CONNECTED(00000003) didn't found starttls in server response, try anyway... depth=1 C = US, ST = Michigan, L = Ann Arbor, O = University of Michigan, OU = ITCS, CN = UM Web CA, emailAddress = [email protected] verify return:1 depth=0 C = US, ST = Michigan, L = Ann Arbor, O = University of Michigan, OU = ITCS, CN = weblogin.umich.edu, emailAddress = [email protected] verify return:1 --- Certificate chain 0 s:/C=US/ST=Michigan/L=Ann Arbor/O=University of Michigan/OU=ITCS/CN=weblogin.umich.edu/[email protected] i:/C=US/ST=Michigan/L=Ann Arbor/O=University of Michigan/OU=ITCS/CN=UM Web CA/[email protected] [...remainder of output omitted...] -- Mark Montague [email protected] ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Cosign-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/cosign-discuss
