Originally posted by: carao2020

Hi All,

Could you please help me on resolving the below issue. When I am trying to send data to HTTP over SSL using WTX 8.4 HTTP Adapter, I am getting below error. Please see below adapter Trace.

Authentication mode is Client Certificate Authentication. I am using below 

-METHOD POST

-CA  <CA Certificates in PEM format>

-CERT <Client Certificate>

-PKEY <Client Certificate with Private Key>

If I try sending test data with curl, I am able to send data successfully.

curl -X POST --data "TEST Data" -v --capath ./ --cacert ./<CA Certficate>.pem --cert ./<Client Certficate>.pem "<URL>"

Options used: trace,verbose,name,method,url,type,ca,cert,pkey,sproto,timeout
URL user:   ''.
URL pass:   '*****'.
URL host:   '<Host Name>'.
URL port:   '443'.
URL path:   '<URL Path>'.
Using https: protocol.
Using HTTP/1.1.
Using ALL,  SSL algorithms.
[WSAStart: Entering]
[WSAStart: bWSStarted = 1, nWSClients = 0]
Sockets Client ID 1 enabled.
[WSAStart: Exiting (rc = 1)]
Server host is '<Host Name>'.
Hostname: '<Host Name>'.
Address #1: <IP Address>.
Using port '443' for the connection.
Connecting to '<Host Name>'.
Checking user port 443.
Service: 'https'.
Port: 443.
Protocol: 'tcp'.
Socket Opened.
Connection attempt is in progress.
Connected.
WSAConnectSSL: SSL_ERROR_SSL: SSL handshake protocol failure.
WSAConnectSSL: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
WSAConnectSSL: 
Failure: SSL connection NOT established with target server, <Host Name>, on port, 443.
Socket Closed.
Connection closed.
[WSATerm: Entering]
[WSATerm: bWSStarted = 1, nWSClients = 1]
Sockets Client ID 1 disabled.
[WSATerm: nWSClients remaining = 0]
[WSATerm: Exiting]
Attempt #1 failed, no more retries allowed.

Kindly review and advise. Thanks in advance.

Originally posted by: PaulBrettIBM

I think you need to raise a Service Request with IBM (PMR) to get this issue looked at.

Thank you.

Paul

Follow me on Twitter

Originally posted by: carao2020

Hi Paul,

Thanks for the response. Apologies. I incorrectly copied the wrong trace in my previous reply. That trace was generated when I used incorrect CA certificate. Please find below correct trace.Kindly review and advise.

I am getting the below error in trace which I couldnt understand. Kindly advise.

WSAConnectSSL: error:0D07908D:asn1 encoding routines:ASN1_VERIFY:unknown message digest algorithm

Options used: trace,verbose,name,method,url,type,ca,cert,pkey,sproto,timeout
URL user:   ''.
URL pass:   '*****'.
URL host:   '<Host Name>'.
URL port:   '443'.
URL path:   '<URL Path>'.
Using https: protocol.
Using HTTP/1.1.
Using ALL,  SSL algorithms.
[WSAStart: Entering]
[WSAStart: bWSStarted = 1, nWSClients = 0]
Sockets Client ID 1 enabled.
[WSAStart: Exiting (rc = 1)]
Server host is '<Host Name>'.
Hostname: '<Host Name>'.
Address #1: <IP Address>.
Using port '443' for the connection.
Connecting to '<Host Name>'.
Checking user port 443.
Service: 'https'.
Port: 443.
Protocol: 'tcp'.
Socket Opened.
Connection attempt is in progress.
Connected.
WSAConnectSSL: SSL_ERROR_SSL: SSL handshake protocol failure.
WSAConnectSSL: error:0D07908D:asn1 encoding routines:ASN1_VERIFY:unknown message digest algorithm
WSAConnectSSL: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
WSAConnectSSL: 
Failure: SSL connection NOT established with target server, <Host Name>, on port, 443.
Socket Closed.
Connection closed.
[WSATerm: Entering]
[WSATerm: bWSStarted = 1, nWSClients = 1]
Sockets Client ID 1 disabled.
[WSATerm: nWSClients remaining = 0]
[WSATerm: Exiting]
Attempt #1 failed, no more retries allowed.

Originally posted by: PaulBrettIBM

I believe the MercSSL library being used is not able to deal with this certificate type.

Please upgrade to a newer WTX version (8.4.1.3 or above) to get the GSKit SSL routines instead.

Thank you.

Paul

Follow me on Twitter

Originally posted by: PaulBrettIBM

Additional notes...   WTX 8.4 support is ending soon:

http://www-01.ibm.com/support/docview.wss?uid=swg21990856&acss=danl_3680_web

Thank you.

Paul

Follow me on Twitter