Issues with H.1 Direct Project testing

[Srikanth Challa]

Hi Support team, 

Currently we are encountering issues during H.1 Direct testing from d1 to d18. 

Issue Summary:

• Emails Received:

• d1, d2, d9, d14, d17, d18: Emails are being received, but the content displays as "fail" when sent from ETT.

• Positive Test Results:

• d3, d4, d10, d15, d16: Some positive tests are experiencing sending failures, with the following error details:

---

Error Details:

• D3 Send Failure
• Error: d...@domain2.dcdt31.healthit.gov: Certificate is not trusted: does not chain to a trusted anchor; signature check failed.

---

• D4 Send Failure
• Error: d...@domain2.dcdt31.healthit.gov: Multiple untrusted certificates: 1 is not trusted: does not chain to a trusted anchor; signature check failed, 2 is not trusted: expired on Thu Feb 29 02:55:18 PST 2024.

---

• D10 Send Failure
• Error: d...@domain3.dcdt31.healthit.gov: Certificate is not trusted: does not chain to a trusted anchor; signature check failed.

---

• D15 Send Failure
• Error: d...@domain2.dcdt31.healthit.gov: Multiple untrusted certificates: 1 is not trusted: does not chain to a trusted anchor; signature check failed, 2 is not trusted: expired on Thu Feb 29 02:55:27 PST 2024.

---

• D16 Send Failure
• Error: d...@domain5.dcdt31.healthit.gov: Add recipient failed: FAIL. Multiple untrusted certificates: 1 is not trusted: does not chain to a trusted anchor; signature check failed, 2 is not trusted: does not chain to a trusted anchor; signature check failed.

---

We would greatly appreciate your prompt assistance in addressing these issues ahead of the certification testing. If any additional information is required, please do not hesitate to reach out.

Thank you once again for your support. I look forward to your response.

Best Regards, 

CH.PR.Srikanth.

---

---

The information contained in this e-mail may be privileged and/or confidential, and protected from disclosure, and no waiver of any attorney-client, work product, or other privilege is intended. If you are the intended recipient, further disclosures are prohibited without proper authorization. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden and possibly a violation of federal or state law and regulations. The sender and Carrollton Regional Medical Center, and its affiliated entities, hereby expressly reserve all privileges and confidentiality that might otherwise be waived as a result of an erroneous or misdirected e-mail transmission. No employee or agent is authorized to conclude any binding agreement on behalf of Carrollton Regional Medical Center, or any affiliated entity, by e-mail without express written confirmation by the President or other duly authorized representative of Carrollton Regional Medical Center.

[Kim Poletti]

Hi - Thanks for reaching out. This has been logged for review and a member of the team will reach out in the near future.

[James Spillman]

We are currently investigating this scenario to determine whether the certificate used in this test reflects a valid conformance case.

We’ll provide an update once our investigation is complete and any required changes to the test or guidance are finalized.

[Sai Valluripalli]

Hi Srikanth,

Have you installed the latest DCDT trust anchor in your server?

On Thu, May 22, 2025 at 1:36 PM James Spillman <jws06...@gmail.com> wrote:

We are currently investigating this scenario to determine whether the certificate used in this test reflects a valid conformance case.

We’ll provide an update once our investigation is complete and any required changes to the test or guidance are finalized.

--
You received this message because you are subscribed to the Google Groups "Edge Test Tool (ETT)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to edge-test-too...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/edge-test-tool/a16693dd-664e-4929-ae81-12bc52efa9e4n%40googlegroups.com.

[James Spillman]

A new version of DCDT has been deployed that includes a fix for the identifier mismatch. DNS entries have not been updated yet, but LDAP tests should now have matching identifiers between leaf certs and the trust anchor. Can you install the new trust anchor and try the LDAP tests, such as 3 and 4?

[James Spillman]

DNS certificates have been updates, can you try the tests again now?

[jess....@gmail.com]

Hey James,

We are running into this as well still. It looks like the cert's have a CRL value, but the URL is unreachable and that maybe causing us issues still since we reject cert's with unreachable CRL's.

[Miles Williams]

Hello, any update on this issue?

[Sai Valluripalli]

Good morning, Team,

We were able to reproduce the issue and are working on a fix. keep you all posted once the fix is deployed.

Thank you for your patience. 

With best,

Sai

[Braeden Rai]

Thank you, that is good to hear. Do you have any rough timelines for when you'll be able to release the fix?

[Nagesh Bashyam]

We have informed the concerned teams as it requires updates to DNS and Certificates, so we are coordinating to figure out a time to minimize interruptions to testing.

Once I get back the responses from the other teams, we will update tomorrow.

 

--

You received this message because you are subscribed to the Google Groups "Edge Test Tool (ETT)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to edge-test-too...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/edge-test-tool/015f2c45-5dd7-4a2e-9053-e66a6558a922n%40googlegroups.com.

[Braeden Rai]

Sounds good, thank you. I also wanted to note that we believe this is also preventing us from testing the h1 Send Direct Messages cases, we are getting errors that say we are unable to decrypt the messages we receive from those.

[Sai Valluripalli]

Hi Team,

Which H1 Tests are you guys trying and have issues?

Thanks,

Sai

[Braeden Rai]

Hi,

In the Certificate Discovery / Hosting - DCDT sub category of cases,  all of the Discover DCDT's Certificates are failing. All 18 cases fail to send because of a certificate issue, and we have reinstalled the certificates that are currently available on the site.

In the Send Direct Message sub category of cases, all messages we send to our system from the test site fails to be decrypted, and we believe this is also due to an issue with the certificates that are currently available.

[Imperiumsoft]

Hi, We are also facing issues In the Certificate Discovery / Hosting - DCDT subcategory, all 18 Discover DCDT's Certificates cases. 

[Sai Valluripalli]

CRL issues for DCDT is fixed. Please retest.

Thanks

[Miles Williams]

We are still getting errors. We get this for D1, and do not get emails for the other email cases:  

Discovery testcase D1_DNS_AB_Valid (D1 - Valid address-bound certificate discovery in DNS) failed.Details

• Negative: false
• Optional: false
• Description: This test case verifies that your system can query DNS for address-bound CERT records and discover a valid address-bound X.509 certificate for a Direct address.
• From: dir...@hd1064321.org
• To: d...@domain1.dcdt31.healthit.gov
• Processing Message(s):
  • ERROR: Unable to decrypt mail MIME message (id=, from=dir...@hd1064321.org, to=d...@domain1.dcdt31.healthit.gov) enveloped content (type=application/pkcs7-mime;boundary="----=_NextPart_9d0_ed9d_2ac94239.a6770bb8";name="smime.p7m";protocol="application/pkcs7-signature";micalg=sha1;smime-type="enveloped-data").
• Processed Step(s): None
• Expected Certificate:
  • Name: D1_valA
  • Valid: true
  • Binding Type: ADDRESS
  • Location:
    • Type: DNS
    • Mail Address: d...@domain1.dcdt31.healthit.gov
  • Description: Valid address-bound certificate for the Direct address in a DNS CERT record.
• Discovered Certificate: None

[Sai Valluripalli]

Please download the latest DCDT Trust Anchor and try this test again.

Thanks

[Miles Williams]

We have confirmed that we are using the latest trust anchor. 

[Sai Valluripalli]

Do you have time this week to get on a call so, we can review and also verify logs on our end?

--
You received this message because you are subscribed to a topic in the Google Groups "Edge Test Tool (ETT)" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/edge-test-tool/gNpJuv4GVP0/unsubscribe.
To unsubscribe from this group and all its topics, send an email to edge-test-too...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/edge-test-tool/e7dffdf2-ca0a-4f52-810b-8c7e117c59b2n%40googlegroups.com.

[Miles Williams]

Sure, we could do:

Tomorrow, 7/29 at 10-10:30am CST, 11-11:30am CST, or 4-4:30PM CST

Wednesday, 7/30 9-10am CST, 10:30-11am CST, 12:30-1pm CST, or 3-3:30pm CST

I can send times for later in the week if none of those work for y'all.

[Sai Valluripalli]

Let's meet on Wednesday, 7/30 9-10am CST. Thanks

You received this message because you are subscribed to the Google Groups "Edge Test Tool (ETT)" group.

To unsubscribe from this group and stop receiving emails from it, send an email to edge-test-too...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/edge-test-tool/9a67c367-3c64-42a7-88db-3d466c761de9n%40googlegroups.com.

[Sai Valluripalli]

Hi Miles,

Could you please send the meeting invitation to s...@digitalhie.com, or let me know your email address so I can send the Teams meeting invitation?

Thank you,

Sai

You received this message because you are subscribed to the Google Groups "Edge Test Tool (ETT)" group.

To unsubscribe from this group and stop receiving emails from it, send an email to edge-test-too...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/edge-test-tool/9a67c367-3c64-42a7-88db-3d466c761de9n%40googlegroups.com.