Skip to main content

I updated my ssl certificate on my target server.  It has been working great.  I am using this chunk of code to call it: 
   st2 = createSecurityContext(ctx2, "TLSv1.2")
   st2 = createSecureRequest(purl, pmethod, pobjRequest, ctx2)
   st2 = setRequestHeader(pobjRequest, "OPPSAUTH",AUTH)
   st2 = setRequestHeader(pobjRequest, "OPPSSERVER",SERVER)
   st2 = setRequestHeader(pobjRequest, "Content-Type","application/json")
   st2 = submitRequest(pobjRequest, 5000, POST.DATA, pheaders, pdata, httpstatus)

I reissued my cert and updated it and now when I try to call the server, I am getting: 

1896:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:.\\ssl\\s3_clnt.c:1258:

I tried to do some testing by copying the program and simplifying it and when I compile, it give the same error the first time I compile it, but then it will compile, but still does not work.

If I put the old cert back, it works fine again.  I also tried calling a different server and that works fine as well.

Also, I checked in the browser and the cert is valid and I also ran it against www.ssllabs.com/ssltest and it is fine.

Any suggestions?



------------------------------
Troy Dittberner
President
Northstar Data Services Inc
Brooklyn Park VA US
------------------------------

I updated my ssl certificate on my target server.  It has been working great.  I am using this chunk of code to call it: 
   st2 = createSecurityContext(ctx2, "TLSv1.2")
   st2 = createSecureRequest(purl, pmethod, pobjRequest, ctx2)
   st2 = setRequestHeader(pobjRequest, "OPPSAUTH",AUTH)
   st2 = setRequestHeader(pobjRequest, "OPPSSERVER",SERVER)
   st2 = setRequestHeader(pobjRequest, "Content-Type","application/json")
   st2 = submitRequest(pobjRequest, 5000, POST.DATA, pheaders, pdata, httpstatus)

I reissued my cert and updated it and now when I try to call the server, I am getting: 

1896:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:.\\ssl\\s3_clnt.c:1258:

I tried to do some testing by copying the program and simplifying it and when I compile, it give the same error the first time I compile it, but then it will compile, but still does not work.

If I put the old cert back, it works fine again.  I also tried calling a different server and that works fine as well.

Also, I checked in the browser and the cert is valid and I also ran it against www.ssllabs.com/ssltest and it is fine.

Any suggestions?



------------------------------
Troy Dittberner
President
Northstar Data Services Inc
Brooklyn Park VA US
------------------------------

Phillip, I got your message, but can't reply so am replying here.  No, I did not update the U2 Root Certificate Store.  Not sure how on this machine.  I read the doc, but that is not really clear.  I got it to connect to a different url that I can use, so am ok for the moment, but still need to figure out how to resolve this.  It seems, the first time it accesses a site, it builds the security context (maybe even when compiling it seems), but does not replace it when it changes.  I did not install a cert on the uv machine, just used submit request for a secure connection.  Also, I do not understand why this even needs to be an issue.  If I use curl on a server, it connects as a browser would and does nor cause issues like this.  It is just acting like a client.  so, every time I call a certain domain, it saves the cert and if they update that cert, the u2 root cert store needs to be updated?  



------------------------------
Troy Dittberner
President
Northstar Data Services Inc
Brooklyn Park VA US
------------------------------


Phillip, I got your message, but can't reply so am replying here.  No, I did not update the U2 Root Certificate Store.  Not sure how on this machine.  I read the doc, but that is not really clear.  I got it to connect to a different url that I can use, so am ok for the moment, but still need to figure out how to resolve this.  It seems, the first time it accesses a site, it builds the security context (maybe even when compiling it seems), but does not replace it when it changes.  I did not install a cert on the uv machine, just used submit request for a secure connection.  Also, I do not understand why this even needs to be an issue.  If I use curl on a server, it connects as a browser would and does nor cause issues like this.  It is just acting like a client.  so, every time I call a certain domain, it saves the cert and if they update that cert, the u2 root cert store needs to be updated?  



------------------------------
Troy Dittberner
President
Northstar Data Services Inc
Brooklyn Park VA US
------------------------------

Ok, now I am even more confused.  Today, I moved the calls to a different domain.  I updated the certs on the original domain went back and tested it later and now that domain works as well.  Maybe something was getting cached and need time to clear?  Long and short, it now seems to be working.  If someone can shed light on this process for future reference, it would be greatly appreciated.



------------------------------
Troy Dittberner
President
Northstar Data Services Inc
Brooklyn Park VA US
------------------------------

Ok, now I am even more confused.  Today, I moved the calls to a different domain.  I updated the certs on the original domain went back and tested it later and now that domain works as well.  Maybe something was getting cached and need time to clear?  Long and short, it now seems to be working.  If someone can shed light on this process for future reference, it would be greatly appreciated.



------------------------------
Troy Dittberner
President
Northstar Data Services Inc
Brooklyn Park VA US
------------------------------

Troy,

If and when the problem should reoccur, I recommend using openssl at the command line to debug the connection failure. This should get you started: https://www.cyberciti.biz/tips/debugging-ssl-communications-from-unix-shell-prompt.html

Regards

JJ



------------------------------
John Jenkins
Thame, Oxfordshire
------------------------------