bugWeeChat - Bugs: bug #27998, Cannot connect to ssl server with...

 
 

bug #27998: Cannot connect to ssl server with gnutls 2.8.5

Submitter:  Chris Hills <chaz6>
Submitted:  Wed 11 Nov 2009 05:53:39 PM UTC
   
 
Category:  irc plugin Severity:  3 - Normal
Item Group:  security Status:  Fixed
Privacy:  Public Assigned to:  flashcode
Originator Name:  Open/Closed:  Closed
Release:  * 0.3.1 IRC nick:  Chaz6
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 11 Nov 2009 08:03:17 PM UTC, comment #7: 

Just to be clear, I set weechat.network.gnutls_ca_file correctly to start with when I was having trouble connecting. The issue was not with the certificate verification but some unknown gnutls error. In my original post it said "gnutls: peer's certificate is trusted".

Chris Hills <chaz6>
Wed 11 Nov 2009 07:55:56 PM UTC, comment #6: 

It also possible to keep « ssl_verify = on » and add the required certificate in WeeChat:

# cat /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt >> ~/.weechat/ssl/CAs.pem

(package ca-certificates on Debian)

You have to restart WeeChat to get it working.

Emmanuel Bouthenot <kolter>
Group Member
Wed 11 Nov 2009 07:44:09 PM UTC, comment #5: 

Thanks, it seems to have been a temporary problem with the server as I changed irc.server.mozilla.ssl_verify back to "on" and I was able to reconnect.

Chris Hills <chaz6>
Wed 11 Nov 2009 07:12:25 PM UTC, comment #4: 

So I'll set bug status as fixed. If you think there's other problem with new ssl features, just add new comment here.

Sebastien Helleu <flashcode>
Group administrator
Wed 11 Nov 2009 07:09:12 PM UTC, comment #3: 

It works...

irc: connecting to server irc.mozilla.org/6697 (SSL)...
gnutls: connected using 2048-bit Diffie-Hellman shared secret exchange
gnutls: peer's certificate is trusted
gnutls: receiving 1 certificate
 - certificate[1] info:
   - subject `C=US,ST=California,L=Mountain View,O=Mozilla Corporation,OU=IRC Chat,CN=irc.mozilla.org', issuer `C=US,O=Equifax,OU=Equifax Secure Certificate Authority', RSA key
1024 bits, signed using RSA-SHA, activated `2009-08-10 12:34:36 UTC', expires `2011-08-12 10:51:41 UTC', SHA-1 fingerprint  `085e2110ed616ebc4d7338c3ce833b20cf7f64b2'
irc: connected to irc.mozilla.org (63.245.208.159)
sand.mozilla.org (sand.mozilla.org): * Looking up your hostname...
sand.mozilla.org (sand.mozilla.org): * Found your hostname

Just for info, I set weechat.network.gnutls_ca_file to "/usr/share/ssl/certs/ca-bundle.crt".

Chris Hills <chaz6>
Wed 11 Nov 2009 06:55:14 PM UTC, comment #2: 

Hi Chris,
Can you try /set irc.server.xxxx.ssl_verify off ? (where "xxxx" is your server name)
This should let you connect to server, but this is not trusted, so that's not recommended.
We'll publish doc soon: how to import certificate and use it.

Sebastien Helleu <flashcode>
Group administrator
Wed 11 Nov 2009 06:01:02 PM UTC, comment #1: 

Connecting with gnutls-cli works as expected:-

$ gnutls-cli --x509cafile /usr/share/ssl/certs/ca-bundle.crt -p 6697 irc.mozilla.org
Processed 146 CA certificate(s).
Resolving 'irc.mozilla.org'...
Connecting to '63.245.208.159:6697'...
- Successfully sent 0 certificate(s) to server.
- Server has requested a certificate.
- Certificate type: X.509
 - Got a certificate list of 1 certificates.
 - Certificate[0] info:
  - subject `C=US,ST=California,L=Mountain View,O=Mozilla Corporation,OU=IRC Chat,CN=irc.mozilla.org', issuer `C=US,O=Equifax,OU=Equifax Secure Certificate Authority', RSA key 1024 bits, signed using RSA-SHA, activated `2009-08-10 12:34:36 UTC', expires `2011-08-12 10:51:41 UTC', SHA-1 fingerprint `085e2110ed616ebc4d7338c3ce833b20cf7f64b2'
- The hostname in the certificate matches 'irc.mozilla.org'.
- Peer's certificate is trusted
- Version: TLS1.0
- Key Exchange: RSA
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed

- Simple Client Mode:

:sand.mozilla.org NOTICE AUTH :*** Looking up your hostname...
:sand.mozilla.org NOTICE AUTH :*** Found your hostname
^C

Chris Hills <chaz6>
Wed 11 Nov 2009 05:53:39 PM UTC, original submission:  

irc: connecting to server irc.mozilla.org/6697 (SSL)...
gnutls: connected using 2048-bit Diffie-Hellman shared secret exchange
gnutls: peer's certificate is trusted
gnutls: receiving 1 certificate
 - certificate[1] info:
   - subject `C=US,ST=California,L=Mountain View,O=Mozilla Corporation,OU=IRC Chat,CN=irc.mozilla.org',
 issuer `C=US,O=Equifax,OU=Equifax Secure Certificate Authority', RSA key 1024 bits, signed using RSA-SHA, activated `2009-08-10 12:34:36 UTC', expires `2011-08-12 10:51:41 UTC', SHA-1 fingerprint `085e2110ed616ebc4d7338c3ce833b20cf7f64b2'
irc: TLS handshake failed
irc: error: GnuTLS internal error.

git commit is c165eab0f2405f7359329c251056138363869ccc (2009-11-11 10:32 Marco Paolone Update italian translations). Host is Linux 2.6.25.3 i686.

Chris Hills <chaz6>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by kolter (Posted a comment)
  • -email is unavailable- added by flashcode (Posted a comment)
  • -email is unavailable- added by chaz6 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-01-23 flashcode Open/ClosedOpen Closed
        Release3.3-dev 0.3.1
    2009-11-11 flashcode StatusNeed Info Fixed
    2009-11-11 flashcode StatusNone Need Info
        Assigned toNone flashcode

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code