Receiver XDR Test 4a and 4b issue

[Akshita Gupta]

Hi Team,

We are testing for b1 certification and during testing we are facing issues with TLS handshake with the endpoints.

The setup was working fine with the old XDS certificates, but after we updated the certificates we are getting below failed responses:

Test 4a/4b
IOException Bad Connection javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Test 8 : Failed

Test 5 and test 3 and Test 9 are working as expected.

I have tested the connection direcvtly using openssl and is working as expected.

 openssl s_client -connect muexternal.athenahealth.com:443 -cert cert.pem -key key.pem -CAfile cert.pem

Connecting to 208.78.141.77

CONNECTED(00000005)

depth=0 C=US, ST=test, L=test, O=test, OU=test, CN=test, emailAddress=test

verify return:1

---

Certificate chain

 0 s:C=US, ST=test, L=test, O=test, OU=test, CN=test, emailAddress=test

   i:C=US, ST=test, L=test, O=test, OU=test, CN=test, emailAddress=test

   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256

   v:NotBefore: Nov 15 21:03:25 2024 GMT; NotAfter: Nov 13 21:03:25 2034 GMT

---

SSL handshake has read 1652 bytes and written 1707 bytes

Verification: OK

---

Could someone help us resolve this issue further.

Thanks
Akshita

[Kim Poletti]

Hi - Thanks for reaching out. This has been logged for review and a member of the team will reach out in the near future.

[Sai Valluripalli]

Can you please retry the failed tests again now.

Thanks

--
You received this message because you are subscribed to the Google Groups "Edge Test Tool (ETT)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to edge-test-too...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/edge-test-tool/a5829d82-ed46-49f9-93f6-306288eb3184n%40googlegroups.com.

[Shakthi Vell]

Hi Sai,

Still we are facing the issue in Test8 for TLS handshake. We are getting Validation failed in log.

Thanks,

Sakthivel

[Shakthi Vell]

Hi Sai,

Any update on this?

Thanks,

Sakthivel

[James Threatte]

Is there an update on this? We need to schedule the test in the next couple weeks.

[Rashmi M S]

Can you please confirm if this issue is fixed

[Shakthi Vell]

No still we are facing this issue

[Shakthi Vell]

Hi Rashmi, 

Still we are facing this error attached screenshot for your reference.

Thanks,

Sakthivel

[Chris Barnes]

FYI - I believe the root issue in this ticket is the same as in this ticket: https://groups.google.com/g/edge-test-tool/c/Qgjvn7GI8Hc?pli=1. As folks are already aware, this is a hard-blocker to imminent testing/certification needs. Appreciate the support!

[Kim Poletti]

Hello,

This is a high priority issue the team is focused on resolving. We will keep you updated when there is a fix.

Thank you,

Kim

[Shakthi Vell]

Any update on this?

[Evan Brock]

Hi Shakthi,

I'm currently working on a solution to this issue. I'll update you when I find a resolution.

[Arslan Iqbal]

Internal reference: SITE-4529

[Shakthi Vell]

Hi Team,

Any update on this issue?

[Evan Brock]

Hi Shakthi,

This issue is our top priority right now and we will release a patch as soon as it's resolved. Thank you for your patience.

[Evan Brock]

Hello,

Can you confirm you're not using a self signed certificate?

Running the following command:
openssl s_client -connect muexternal.athenahealth.com:443 -showcerts
Produces the following:

SSL handshake has read 1652 bytes and written 467 bytes
Verification error: self-signed certificate

[Evan Brock]

Hello,

We are still working on a solution for this. Do you happen to remember where you downloaded the XDR TLS certificates from? Were they from the new UI at https://site.healthit.gov/direct/testbycriteria/H2?

[Shakthi Vell]

Hi Evan,

Yes we downloaded from https://site.healthit.gov/direct/testbycriteria/H2 -> B1 Certification -> Receive using edege protocol XDR-> Download XDR TLS certificates.

We are using this certificate and key.

Thanks,

Sakthivel

[Evan Brock]

Thank you for the info, in that case, can you try using these instead and let me know if that fixes the issue?

https://github.com/onc-healthit/ett/blob/resources/certificates/common/xdr-tls/keyAndCert.zip

[Shakthi Vell]

Hi Evan Brock,

Updated this certificate and tested the tls handshake. Still facing same issue.

Thanks,

Sakthivel

[Evan Brock]

Hi Shakthi

Can you please try getting them from https://site.healthit.gov/certificates/xdr-tls/keyAndCert.zip ?

[Evan Brock]

Hi Shakthi, are you still experiencing the issue?