Receiver XDR Test 4a, 4b and 8 TLS handshake issue
Shakthi Vell
Kim Poletti
Evan Brock
Shakthi Vell
Shakthi Vell
Shakthi Vell
Kim Poletti
Shakthi Vell
Port : 443
As it is going for long time and we are nearing the certificate renewal time. Shall we have a call between 8 am est to 11 am est by tomorrow or the day after tomorrow to test it on call?
Thanks,
Sakthivel
Evan Brock
I will try to schedule a time to meet tomorrow and put an invite here
Evan Brock
openssl s_client -connect 208.78.141.77:443 -showcerts
From our server
SSL handshake has read 1652 bytes and written 431 bytes
Verification error: self-signed certificate
A self signed certificate will not be able to complete TLS handshake, please confirm you're not using a self signed certificate
Shakthi Vell
Evan Brock
Shakthi Vell
Shakthi Vell
Shakthi Vell
Evan Brock
________________________________________________________________________________
Shakthi Vell
Anusha K
Shakthi Vell
Shakthi Vell
Evan Brock
Also, it's very unlikely the recent patch is the reason 20a and 20b are failing for you, as they function fundamentally differently from the tests that were patched
Evan Brock
Shakthi Vell
Evan Brock
When running tests 3, 4a, 4b, or 5, I either get a broken pipe error or a 503 internal server error in our logs when using your endpoint. Previously, the PKIX issue was preventing the TLS handshake from succeeding, so it never even tried to hit your application. Now that the TLS handshake succeeds, we are able to see that the tests are unable to hit your application.
Can you please try the following in your server and let me know what it returns?
curl --cert client.pem --key client.key https://your.endpoint.com -v
Make sure the change the client.pem to your cert and client.key to your key and change the endpoint to the endpoint you use for your tests.
Also if you can, check your server logs around 12:34 PM EST today , I ran a couple tests and would like to see what it's saying on your end
Shakthi Vell
OpenSSL Response
[prod PTEST1]:~/test> openssl s_client -connect muexternal.athenahealth.com:443 -cert cert.pem -key key.pem -CAfile cert.pem
CONNECTED(00000003)
depth=0 C = US, ST = test, L = test, O = test, OU = test, CN = test, emailAddress = test
verify return:1
---
Certificate chain
0 s:C = US, ST = test, L = test, O = test, OU = test, CN = test, emailAddress = test
i:C = US, ST = test, L = test, O = test, OU = test, CN = test, emailAddress = test
[prod PTEST1] :~/test> curl --cert cert.pem --key key.pem https://muexternal.athenahealth.com/xds/ws/v1/DIRECT::XDR --cacert cert.pem -v
* Uses proxy env variable no_proxy == 'athenahealth.com,.consul,localhost,127.0.0.1,127.0.1.1'
* Trying 208.78.141.77...
* TCP_NODELAY set
* Connected to muexternal.athenahealth.com (208.78.141.77) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: self signed certificate
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
* Rebuilt URL to: cert.pem/
* Uses proxy env variable no_proxy == 'athenahealth.com,.consul,localhost,127.0.0.1,127.0.1.1'
* Uses proxy env variable http_proxy == 'http://outproxy-dev-bed.athenahealth.com:3128'
* Trying 10.206.162.12...
* TCP_NODELAY set
* Connected to outproxy-dev-bed.athenahealth.com (10.206.162.12) port 3128 (#1)
> GET http://cert.pem/ HTTP/1.1
> Host: cert.pem
> User-Agent: curl/7.61.1
> Accept: */*
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 503 Service Unavailable
< Server: squid/4.15
< Mime-Version: 1.0
Thanks,
Sakthivel
---
Shakthi Vell
Evan Brock
Hi Sakthivel,
Sorry, I have been out of office, but I think I have found the issue now
Your endpoint seems to be fine, I can see the certificate provided is the same as users who are reporting this working now. The problem is that your traffic is being sent through your proxy, as I can see in your curl command (Uses proxy env variable http_proxy == 'http://outproxy-dev-bed.athenahealth.com:3128' ) . When you run openssl s_client, it connects straight to muexternal.athenahealth.com and succeeds because you pass the self-signed cert. When you run curl, the proxy intercepts the TLS connection and presents its own certificate, which isn’t in the cert.pem file you supplied, so curl (and the toolkit) reject the handshake.
There's two way I can think of to resolve this:
-
Bypass the proxy for this host by adding the host/IP to your no_proxy (or NO_PROXY) environment variable, or set -Dhttp.nonProxyHosts="muexternal.athenahealth.com|208.78.141.77" in the JVM that runs XDS Tools.
-
Import the self-signed certificate into the proxy’s trust store
Once the proxy is out of the way (or trusts the certificate), curl will connect without the SSL error and XDS Tools will be able to complete the XDR tests. You should be able to know if it's fixed by curl on your endpoint, if it succeeds, the XDR tests should work too.
Let me know if you need any further help
Thanks,
Evan
Shakthi Vell
rsakthivel@ATH-THQLW4J0 keyAndCert % curl --cert cert.pem --key key.pem https://muexternal.athenahealth.com/xds/ws/v1/DIRECT::XDR --cacert cert.pem -v
* Host muexternal.athenahealth.com:443 was resolved.
* IPv6: (none)
* IPv4: 208.78.141.77
* Trying 208.78.141.77:443...
* Connected to muexternal.athenahealth.com (208.78.141.77) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: self signed certificate
* Closing connection
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
curl: (60) SSL certificate problem: self signed certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
* Could not resolve host: cert.pem
* Closing connection
curl: (6) Could not resolve host: cert.pem
Thanks,
Sakthivel
Shakthi Vell
Evan Brock
Shakthi Vell
Shakthi Vell
Evan Brock
I'm now looking in to your failing test 4a and 4b
Arslan Iqbal
Shakthi Vell
Evan Brock
Thank you
