bugWeeChat - Bugs: bug #27998, Cannot connect to ssl server with...

 
 

bug #27998: Cannot connect to ssl server with gnutls 2.8.5

Submitted by:  Chris Hills <chaz6>
Submitted on:  Wed 11 Nov 2009 05:53:39 PM UTC  
 
Category: irc pluginSeverity: 3 - Normal
Item Group: securityStatus: Fixed
Privacy: PublicAssigned to: Sebastien Helleu <flashcode>
Originator Name: Open/Closed: Closed
Release: 0.3.1IRC nick: Chaz6

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Wed 11 Nov 2009 08:03:17 PM UTC, comment #7:

Just to be clear, I set weechat.network.gnutls_ca_file correctly to start with when I was having trouble connecting. The issue was not with the certificate verification but some unknown gnutls error. In my original post it said "gnutls: peer's certificate is trusted".

Chris Hills <chaz6>
Wed 11 Nov 2009 07:55:56 PM UTC, comment #6:

It also possible to keep « ssl_verify = on » and add the required certificate in WeeChat:

# cat /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt >> ~/.weechat/ssl/CAs.pem

(package ca-certificates on Debian)

You have to restart WeeChat to get it working.

Emmanuel Bouthenot <kolter>
Project Member
Wed 11 Nov 2009 07:44:09 PM UTC, comment #5:

Thanks, it seems to have been a temporary problem with the server as I changed irc.server.mozilla.ssl_verify back to "on" and I was able to reconnect.

Chris Hills <chaz6>
Wed 11 Nov 2009 07:12:25 PM UTC, comment #4:

So I'll set bug status as fixed. If you think there's other problem with new ssl features, just add new comment here.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Wed 11 Nov 2009 07:09:12 PM UTC, comment #3:

It works...

irc: connecting to server irc.mozilla.org/6697 (SSL)...
gnutls: connected using 2048-bit Diffie-Hellman shared secret exchange
gnutls: peer's certificate is trusted
gnutls: receiving 1 certificate
- certificate[1] info:
- subject `C=US,ST=California,L=Mountain View,O=Mozilla Corporation,OU=IRC Chat,CN=irc.mozilla.org', issuer `C=US,O=Equifax,OU=Equifax Secure Certificate Authority', RSA key
1024 bits, signed using RSA-SHA, activated `2009-08-10 12:34:36 UTC', expires `2011-08-12 10:51:41 UTC', SHA-1 fingerprint `085e2110ed616ebc4d7338c3ce833b20cf7f64b2'
irc: connected to irc.mozilla.org (63.245.208.159)
sand.mozilla.org (sand.mozilla.org): *** Looking up your hostname...
sand.mozilla.org (sand.mozilla.org): *** Found your hostname

Just for info, I set weechat.network.gnutls_ca_file to "/usr/share/ssl/certs/ca-bundle.crt".

Chris Hills <chaz6>
Wed 11 Nov 2009 06:55:14 PM UTC, comment #2:

Hi Chris,
Can you try /set irc.server.xxxx.ssl_verify off ? (where "xxxx" is your server name)
This should let you connect to server, but this is not trusted, so that's not recommended.
We'll publish doc soon: how to import certificate and use it.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Wed 11 Nov 2009 06:01:02 PM UTC, comment #1:

Connecting with gnutls-cli works as expected:-

$ gnutls-cli --x509cafile /usr/share/ssl/certs/ca-bundle.crt -p 6697 irc.mozilla.org
Processed 146 CA certificate(s).
Resolving 'irc.mozilla.org'...
Connecting to '63.245.208.159:6697'...
- Successfully sent 0 certificate(s) to server.
- Server has requested a certificate.
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
- subject `C=US,ST=California,L=Mountain View,O=Mozilla Corporation,OU=IRC Chat,CN=irc.mozilla.org', issuer `C=US,O=Equifax,OU=Equifax Secure Certificate Authority', RSA key 1024 bits, signed using RSA-SHA, activated `2009-08-10 12:34:36 UTC', expires `2011-08-12 10:51:41 UTC', SHA-1 fingerprint `085e2110ed616ebc4d7338c3ce833b20cf7f64b2'
- The hostname in the certificate matches 'irc.mozilla.org'.
- Peer's certificate is trusted
- Version: TLS1.0
- Key Exchange: RSA
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed

- Simple Client Mode:

:sand.mozilla.org NOTICE AUTH :*** Looking up your hostname...
:sand.mozilla.org NOTICE AUTH :*** Found your hostname
^C

Chris Hills <chaz6>
Wed 11 Nov 2009 05:53:39 PM UTC, original submission:

irc: connecting to server irc.mozilla.org/6697 (SSL)...
gnutls: connected using 2048-bit Diffie-Hellman shared secret exchange
gnutls: peer's certificate is trusted
gnutls: receiving 1 certificate
- certificate[1] info:
- subject `C=US,ST=California,L=Mountain View,O=Mozilla Corporation,OU=IRC Chat,CN=irc.mozilla.org',
issuer `C=US,O=Equifax,OU=Equifax Secure Certificate Authority', RSA key 1024 bits, signed using RSA-SHA, activated `2009-08-10 12:34:36 UTC', expires `2011-08-12 10:51:41 UTC', SHA-1 fingerprint `085e2110ed616ebc4d7338c3ce833b20cf7f64b2'
irc: TLS handshake failed
irc: error: GnuTLS internal error.

git commit is c165eab0f2405f7359329c251056138363869ccc (2009-11-11 10:32 Marco Paolone Update italian translations). Host is Linux 2.6.25.3 i686.

Chris Hills <chaz6>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by kolter (Posted a comment)
  • -unavailable- added by flashcode (Posted a comment)
  • -unavailable- added by chaz6 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 23 Jan 2010 09:55:33 AM UTCflashcodeOpen/ClosedOpen=>Closed
      Release2.1-dev=>0.3.1
    Wed 11 Nov 2009 07:12:24 PM UTCflashcodeStatusNeed Info=>Fixed
    Wed 11 Nov 2009 06:55:14 PM UTCflashcodeStatusNone=>Need Info
      Assigned toNone=>flashcode

    Back to the top


    Powered by Savane 3.1-cleanup1