Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #167470 > unrolled thread

Openssl -showcerts "verify error"

Started byRon Leach <ronleach@tesco.net>
First post2016-05-04 18:30 +0200
Last post2016-05-05 11:20 +0200
Articles 10 — 4 participants

Back to article view | Back to linux.debian.user

Contents

  Openssl -showcerts "verify error" Ron Leach <ronleach@tesco.net> - 2016-05-04 18:30 +0200
    Re: Openssl -showcerts "verify error" "William O'Malley" <omalleyw@fastmail.net> - 2016-05-04 19:50 +0200
      Re: Openssl -showcerts "verify error" Lisi Reisz <lisi.reisz@gmail.com> - 2016-05-04 20:00 +0200
        Re: Openssl -showcerts "verify error" "William O'Malley" <omalleyw@fastmail.net> - 2016-05-04 20:10 +0200
    Re: Openssl -showcerts "verify error" Reco <recoverym4n@gmail.com> - 2016-05-05 00:30 +0200
      Re: Openssl -showcerts "verify error" Ron Leach <ronleach@tesco.net> - 2016-05-05 01:00 +0200
        Re: Openssl -showcerts "verify error" Lisi Reisz <lisi.reisz@gmail.com> - 2016-05-05 01:20 +0200
          Re: Openssl -showcerts "verify error" Ron Leach <ronleach@tesco.net> - 2016-05-05 09:10 +0200
            Re: Openssl -showcerts "verify error" Lisi Reisz <lisi.reisz@gmail.com> - 2016-05-05 10:10 +0200
        Re: Openssl -showcerts "verify error" Reco <recoverym4n@gmail.com> - 2016-05-05 11:20 +0200

#167470 — Openssl -showcerts "verify error"

FromRon Leach <ronleach@tesco.net>
Date2016-05-04 18:30 +0200
SubjectOpenssl -showcerts "verify error"
Message-ID<rv7Qu-7ql-27@gated-at.bofh.it>
List, good afternoon,

I'd appreciate some advice about how to fix an SSL error I'm hitting 
while accessing a government website required for online filing. 
Oddly, this error has just occurred, but we've been using the service 
without difficulty for a few years.

The SSL failure is reported by the application as an
"SSL Certificate Verification Error"; no other information.

Using openssl -showcerts, a "verify error" is reported.  Here's the 
dialogue - I've skipped the bulk of the certificate texts.

ron@debians5:~$ openssl s_client -showcerts -connect 
secure.gateway.gov.uk:443 </dev/null
CONNECTED(00000003)
depth=1 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of 
use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
Server CA - G3
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
  0 s:/C=GB/ST=London/L=London/O=Department for Work and 
Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
    i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use 
at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
Server CA - G3
-----BEGIN CERTIFICATE-----
MIIFTTCCBDWgAwIBAgIQVvXmnZpU7GpmDQbP2RA+DDANBgkqhkiG9w0BAQUFADCB
tTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
[...]
T5A4onjwNgpfTwlfM0BaqhMjii2rrUrWdz++8gPO1SnJNFM5kKwzq8jjj6ezFfZQ
iV/THI2bNvQl6In1tHt8rO8=
-----END CERTIFICATE-----
  1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use 
at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
Server CA - G3
    i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 
VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public 
Primary Certification Authority - G5
-----BEGIN CERTIFICATE-----
MIIF7DCCBNSgAwIBAgIQbsx6pacDIAm4zrz06VLUkTANBgkqhkiG9w0BAQUFADCB
yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
[...]
W+yzf5VK+wPIrSbb5mZ4EkrZn0L74ZjmQoObj49nJOhhGbXdzbULJgWOw27EyHW4
Rs/iGAZeqa6ogZpHFt4MKGwlJ7net4RYxh84HqTEy2Y=
-----END CERTIFICATE-----
---
Server certificate
subject=/C=GB/ST=London/L=London/O=Department for Work and 
Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of 
use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
Server CA - G3
---
No client certificate CA names sent
---
SSL handshake has read 3043 bytes and written 447 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
     Protocol  : TLSv1
     Cipher    : AES256-SHA
     Session-ID: 89[...]F6
     Session-ID-ctx:
     Master-Key: 5A[...]93
     Key-Arg   : None
     Start Time: 1462378147
     Timeout   : 300 (sec)
     Verify return code: 20 (unable to get local issuer certificate)
---
DONE
ron@debians5:~$


I've updated the machine (using synaptic) with the latest 
ca_certificates, but the error remains (this is the current output, 
after certificate updates).

The system was working fine last month, but seems to fail today.  I'm 
not familiar with the 'behind the scenes' workings of openssl and the 
certificate chains, and would appreciate any insight into what might 
be going wrong.

regards, Ron

[toc] | [next] | [standalone]

#167474

From"William O'Malley" <omalleyw@fastmail.net>
Date2016-05-04 19:50 +0200
Message-ID<rv95T-8tM-1@gated-at.bofh.it>
In reply to#167470
On Wed, May 4, 2016, at 12:25 PM, Ron Leach wrote:
> List, good afternoon,
> 
> I'd appreciate some advice about how to fix an SSL error I'm hitting 
> while accessing a government website required for online filing. 
> Oddly, this error has just occurred, but we've been using the service 
> without difficulty for a few years.
> 
> The SSL failure is reported by the application as an
> "SSL Certificate Verification Error"; no other information.
> 
> Using openssl -showcerts, a "verify error" is reported.  Here's the 
> dialogue - I've skipped the bulk of the certificate texts.
> 
> ron@debians5:~$ openssl s_client -showcerts -connect 
> secure.gateway.gov.uk:443 </dev/null
> CONNECTED(00000003)
> depth=1 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of 
> use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
> Server CA - G3
> verify error:num=20:unable to get local issuer certificate
> verify return:0
> ---
> Certificate chain
>   0 s:/C=GB/ST=London/L=London/O=Department for Work and 
> Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
>     i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use 
> at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
> Server CA - G3
> -----BEGIN CERTIFICATE-----
> MIIFTTCCBDWgAwIBAgIQVvXmnZpU7GpmDQbP2RA+DDANBgkqhkiG9w0BAQUFADCB
> tTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
> [...]
> T5A4onjwNgpfTwlfM0BaqhMjii2rrUrWdz++8gPO1SnJNFM5kKwzq8jjj6ezFfZQ
> iV/THI2bNvQl6In1tHt8rO8=
> -----END CERTIFICATE-----
>   1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use 
> at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
> Server CA - G3
>     i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 
> VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public 
> Primary Certification Authority - G5
> -----BEGIN CERTIFICATE-----
> MIIF7DCCBNSgAwIBAgIQbsx6pacDIAm4zrz06VLUkTANBgkqhkiG9w0BAQUFADCB
> yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
> [...]
> W+yzf5VK+wPIrSbb5mZ4EkrZn0L74ZjmQoObj49nJOhhGbXdzbULJgWOw27EyHW4
> Rs/iGAZeqa6ogZpHFt4MKGwlJ7net4RYxh84HqTEy2Y=
> -----END CERTIFICATE-----
> ---
> Server certificate
> subject=/C=GB/ST=London/L=London/O=Department for Work and 
> Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
> issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of 
> use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
> Server CA - G3
> ---
> No client certificate CA names sent
> ---
> SSL handshake has read 3043 bytes and written 447 bytes
> ---
> New, TLSv1/SSLv3, Cipher is AES256-SHA
> Server public key is 2048 bit
> Secure Renegotiation IS supported
> Compression: NONE
> Expansion: NONE
> SSL-Session:
>      Protocol  : TLSv1
>      Cipher    : AES256-SHA
>      Session-ID: 89[...]F6
>      Session-ID-ctx:
>      Master-Key: 5A[...]93
>      Key-Arg   : None
>      Start Time: 1462378147
>      Timeout   : 300 (sec)
>      Verify return code: 20 (unable to get local issuer certificate)
> ---
> DONE
> ron@debians5:~$
> 
> 
> I've updated the machine (using synaptic) with the latest 
> ca_certificates, but the error remains (this is the current output, 
> after certificate updates).
> 
> The system was working fine last month, but seems to fail today.  I'm 
> not familiar with the 'behind the scenes' workings of openssl and the 
> certificate chains, and would appreciate any insight into what might 
> be going wrong.
> 
> regards, Ron
> 

Hi,

Have you tried a different browser? I get the following error in Chrome
when attempting to log in:

==
Sorry, you cannot register with, or log in to the Government Gateway
using this certificate provider and web browser combination. These
certificates are not currently supported on the Macintosh operating
system and Netscape 6.x version browsers on all platforms.

Other certificate providers may be added to the Government Gateway
later. Please check this site regularly to find out which certificates
can be used for online services.
==

The site works fine in IE 11. Looks like it is coded in MS ASP.NET,
which makes sense. No access to a Debian box right now, unfortunately.

--
Will

[toc] | [prev] | [next] | [standalone]

#167475

FromLisi Reisz <lisi.reisz@gmail.com>
Date2016-05-04 20:00 +0200
Message-ID<rv9fz-85-11@gated-at.bofh.it>
In reply to#167474
On Wednesday 04 May 2016 18:40:01 William O'Malley wrote:
> On Wed, May 4, 2016, at 12:25 PM, Ron Leach wrote:
> > List, good afternoon,
> >
> > I'd appreciate some advice about how to fix an SSL error I'm hitting
> > while accessing a government website required for online filing.
> > Oddly, this error has just occurred, but we've been using the service
> > without difficulty for a few years.
> >
> > The SSL failure is reported by the application as an
> > "SSL Certificate Verification Error"; no other information.
> >
> > Using openssl -showcerts, a "verify error" is reported.  Here's the
> > dialogue - I've skipped the bulk of the certificate texts.
> >
> > ron@debians5:~$ openssl s_client -showcerts -connect
> > secure.gateway.gov.uk:443 </dev/null
> > CONNECTED(00000003)
> > depth=1 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of
> > use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure
> > Server CA - G3
> > verify error:num=20:unable to get local issuer certificate
> > verify return:0
> > ---
> > Certificate chain
> >   0 s:/C=GB/ST=London/L=London/O=Department for Work and
> > Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
> >     i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use
> > at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure
> > Server CA - G3
> > -----BEGIN CERTIFICATE-----
> > MIIFTTCCBDWgAwIBAgIQVvXmnZpU7GpmDQbP2RA+DDANBgkqhkiG9w0BAQUFADCB
> > tTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
> > [...]
> > T5A4onjwNgpfTwlfM0BaqhMjii2rrUrWdz++8gPO1SnJNFM5kKwzq8jjj6ezFfZQ
> > iV/THI2bNvQl6In1tHt8rO8=
> > -----END CERTIFICATE-----
> >   1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use
> > at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure
> > Server CA - G3
> >     i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006
> > VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public
> > Primary Certification Authority - G5
> > -----BEGIN CERTIFICATE-----
> > MIIF7DCCBNSgAwIBAgIQbsx6pacDIAm4zrz06VLUkTANBgkqhkiG9w0BAQUFADCB
> > yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
> > [...]
> > W+yzf5VK+wPIrSbb5mZ4EkrZn0L74ZjmQoObj49nJOhhGbXdzbULJgWOw27EyHW4
> > Rs/iGAZeqa6ogZpHFt4MKGwlJ7net4RYxh84HqTEy2Y=
> > -----END CERTIFICATE-----
> > ---
> > Server certificate
> > subject=/C=GB/ST=London/L=London/O=Department for Work and
> > Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
> > issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of
> > use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure
> > Server CA - G3
> > ---
> > No client certificate CA names sent
> > ---
> > SSL handshake has read 3043 bytes and written 447 bytes
> > ---
> > New, TLSv1/SSLv3, Cipher is AES256-SHA
> > Server public key is 2048 bit
> > Secure Renegotiation IS supported
> > Compression: NONE
> > Expansion: NONE
> > SSL-Session:
> >      Protocol  : TLSv1
> >      Cipher    : AES256-SHA
> >      Session-ID: 89[...]F6
> >      Session-ID-ctx:
> >      Master-Key: 5A[...]93
> >      Key-Arg   : None
> >      Start Time: 1462378147
> >      Timeout   : 300 (sec)
> >      Verify return code: 20 (unable to get local issuer certificate)
> > ---
> > DONE
> > ron@debians5:~$
> >
> >
> > I've updated the machine (using synaptic) with the latest
> > ca_certificates, but the error remains (this is the current output,
> > after certificate updates).
> >
> > The system was working fine last month, but seems to fail today.  I'm
> > not familiar with the 'behind the scenes' workings of openssl and the
> > certificate chains, and would appreciate any insight into what might
> > be going wrong.
> >
> > regards, Ron
>
> Hi,
>
> Have you tried a different browser? I get the following error in Chrome
> when attempting to log in:
>
> ==
> Sorry, you cannot register with, or log in to the Government Gateway
> using this certificate provider and web browser combination. These
> certificates are not currently supported on the Macintosh operating
> system and Netscape 6.x version browsers on all platforms.
>
> Other certificate providers may be added to the Government Gateway
> later. Please check this site regularly to find out which certificates
> can be used for online services.
> ==
>
> The site works fine in IE 11. Looks like it is coded in MS ASP.NET,
> which makes sense. No access to a Debian box right now, unfortunately.

I just logged in without a problem using Chromium "Version 37.0.2062.120 Built 
on Debian 7.6, running on Debian 7.10 (281580) (64-bit)"

Lisi

[toc] | [prev] | [next] | [standalone]

#167476

From"William O'Malley" <omalleyw@fastmail.net>
Date2016-05-04 20:10 +0200
Message-ID<rv9pf-z8-3@gated-at.bofh.it>
In reply to#167475
On Wed, May 4, 2016, at 01:54 PM, Lisi Reisz wrote:
> On Wednesday 04 May 2016 18:40:01 William O'Malley wrote:
> > On Wed, May 4, 2016, at 12:25 PM, Ron Leach wrote:
> > > List, good afternoon,
> > >
> > > I'd appreciate some advice about how to fix an SSL error I'm hitting
> > > while accessing a government website required for online filing.
> > > Oddly, this error has just occurred, but we've been using the service
> > > without difficulty for a few years.
> > >
> > > The SSL failure is reported by the application as an
> > > "SSL Certificate Verification Error"; no other information.
> > >
> > > Using openssl -showcerts, a "verify error" is reported.  Here's the
> > > dialogue - I've skipped the bulk of the certificate texts.
> > >
> > > ron@debians5:~$ openssl s_client -showcerts -connect
> > > secure.gateway.gov.uk:443 </dev/null
> > > CONNECTED(00000003)
> > > depth=1 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of
> > > use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure
> > > Server CA - G3
> > > verify error:num=20:unable to get local issuer certificate
> > > verify return:0
> > > ---
> > > Certificate chain
> > >   0 s:/C=GB/ST=London/L=London/O=Department for Work and
> > > Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
> > >     i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use
> > > at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure
> > > Server CA - G3
> > > -----BEGIN CERTIFICATE-----
> > > MIIFTTCCBDWgAwIBAgIQVvXmnZpU7GpmDQbP2RA+DDANBgkqhkiG9w0BAQUFADCB
> > > tTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
> > > [...]
> > > T5A4onjwNgpfTwlfM0BaqhMjii2rrUrWdz++8gPO1SnJNFM5kKwzq8jjj6ezFfZQ
> > > iV/THI2bNvQl6In1tHt8rO8=
> > > -----END CERTIFICATE-----
> > >   1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use
> > > at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure
> > > Server CA - G3
> > >     i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006
> > > VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public
> > > Primary Certification Authority - G5
> > > -----BEGIN CERTIFICATE-----
> > > MIIF7DCCBNSgAwIBAgIQbsx6pacDIAm4zrz06VLUkTANBgkqhkiG9w0BAQUFADCB
> > > yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
> > > [...]
> > > W+yzf5VK+wPIrSbb5mZ4EkrZn0L74ZjmQoObj49nJOhhGbXdzbULJgWOw27EyHW4
> > > Rs/iGAZeqa6ogZpHFt4MKGwlJ7net4RYxh84HqTEy2Y=
> > > -----END CERTIFICATE-----
> > > ---
> > > Server certificate
> > > subject=/C=GB/ST=London/L=London/O=Department for Work and
> > > Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
> > > issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of
> > > use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure
> > > Server CA - G3
> > > ---
> > > No client certificate CA names sent
> > > ---
> > > SSL handshake has read 3043 bytes and written 447 bytes
> > > ---
> > > New, TLSv1/SSLv3, Cipher is AES256-SHA
> > > Server public key is 2048 bit
> > > Secure Renegotiation IS supported
> > > Compression: NONE
> > > Expansion: NONE
> > > SSL-Session:
> > >      Protocol  : TLSv1
> > >      Cipher    : AES256-SHA
> > >      Session-ID: 89[...]F6
> > >      Session-ID-ctx:
> > >      Master-Key: 5A[...]93
> > >      Key-Arg   : None
> > >      Start Time: 1462378147
> > >      Timeout   : 300 (sec)
> > >      Verify return code: 20 (unable to get local issuer certificate)
> > > ---
> > > DONE
> > > ron@debians5:~$
> > >
> > >
> > > I've updated the machine (using synaptic) with the latest
> > > ca_certificates, but the error remains (this is the current output,
> > > after certificate updates).
> > >
> > > The system was working fine last month, but seems to fail today.  I'm
> > > not familiar with the 'behind the scenes' workings of openssl and the
> > > certificate chains, and would appreciate any insight into what might
> > > be going wrong.
> > >
> > > regards, Ron
> >
> > Hi,
> >
> > Have you tried a different browser? I get the following error in Chrome
> > when attempting to log in:
> >
> > ==
> > Sorry, you cannot register with, or log in to the Government Gateway
> > using this certificate provider and web browser combination. These
> > certificates are not currently supported on the Macintosh operating
> > system and Netscape 6.x version browsers on all platforms.
> >
> > Other certificate providers may be added to the Government Gateway
> > later. Please check this site regularly to find out which certificates
> > can be used for online services.
> > ==
> >
> > The site works fine in IE 11. Looks like it is coded in MS ASP.NET,
> > which makes sense. No access to a Debian box right now, unfortunately.
> 
> I just logged in without a problem using Chromium "Version 37.0.2062.120
> Built 
> on Debian 7.6, running on Debian 7.10 (281580) (64-bit)"
> 
> Lisi
> 

Version 50.0.2661.94 of Google Chrome here.

--
Will

[toc] | [prev] | [next] | [standalone]

#167482

FromReco <recoverym4n@gmail.com>
Date2016-05-05 00:30 +0200
Message-ID<rvdsS-41o-7@gated-at.bofh.it>
In reply to#167470
	Hi.

On Wed, 04 May 2016 17:25:40 +0100
Ron Leach <ronleach@tesco.net> wrote:

> List, good afternoon,
> 
> I'd appreciate some advice about how to fix an SSL error I'm hitting 
> while accessing a government website required for online filing. 
> Oddly, this error has just occurred, but we've been using the service 
> without difficulty for a few years.
> 
> The SSL failure is reported by the application as an
> "SSL Certificate Verification Error"; no other information.

Considering that https://secure.gateway.gov.uk tells me about
*selecting* a valid certificate - it could mean that your *client*
became expired recently.


> Using openssl -showcerts, a "verify error" is reported.  Here's the 
> dialogue - I've skipped the bulk of the certificate texts.
> 
> ron@debians5:~$ openssl s_client -showcerts -connect 
> secure.gateway.gov.uk:443 </dev/null

You'll always get errno 20 that way as openssl does not use any
Certified Authority information unless told to do so.

Try this:

openssl s_client -showcerts -connect secure.gateway.gov.uk:443 \
-CApath /etc/ssl/certs </dev/null

Reco

[toc] | [prev] | [next] | [standalone]

#167483

FromRon Leach <ronleach@tesco.net>
Date2016-05-05 01:00 +0200
Message-ID<rvdVU-4gE-35@gated-at.bofh.it>
In reply to#167482
On 04/05/2016 23:22, Reco wrote:

> Considering that https://secure.gateway.gov.uk tells me about
> *selecting* a valid certificate - it could mean that your *client*
> became expired recently.

I wondered.  The application is a Python package distributed by UK TAX 
authority and intended for electronic filing.
Are you thinking it might have its own 'certificate' which it has to 
present?

But ... following some other earlier posts by folk using a web browser 
to reach the url (and seeming to have success), I tried the same 
thing.  With a very up to date FF, I received:

"Government Gateway Error - Access Denied (12202)

Please ensure that you have selected a valid certificate and that you 
are using the correct address. "

I guess this is what you had, as well.  I have done this several 
times, now, with Firefox (once with Iceweasel) on Debian 7, D6 LTS, 
Fedora 23, MS Vista, MS Win7, all different machines, on a few 
different IP addresses, and all produce the same response.  Do the Tax 
people mean that my Firefox(es) have a certificate (I didn't know 
that)?  And that it is somehow 'invalid'?

I've tried their (linux) application on two different Debian machines, 
and their Windows version, on Vista.  Exact same results:

"An SSL error occurred while contacting the Gateway server.
This might be for a number of reasons, including if your system time 
is set incorrectly.
SSL error code: CERTIFICATE_VERIFY_FAILED"

(The time is good on the machines.)
.

 > Try this:
>
> openssl s_client -showcerts -connect secure.gateway.gov.uk:443 \
> -CApath /etc/ssl/certs</dev/null
>

Reco, here's the output.  It looks ok, to me, unless I'm missing 
something.  Can I assume that the TLS handshake looks as though it 
ought to be ok - in that we are not or would not reject or impair the 
negotiation?  I'd like to feel that our copies of CAs, etc, are ok:

ron@debians5:~$ openssl s_client -showcerts -connect 
secure.gateway.gov.uk:443 -CApath /etc/ssl/certs </dev/null
CONNECTED(00000003)
depth=2 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 
VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public 
Primary Certification Authority - G5
verify return:1
depth=1 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of 
use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
Server CA - G3
verify return:1
depth=0 /C=GB/ST=London/L=London/O=Department for Work and 
Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
verify return:1
---
Certificate chain
  0 s:/C=GB/ST=London/L=London/O=Department for Work and 
Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
    i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use 
at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
Server CA - G3
-----BEGIN CERTIFICATE-----
MIIFTTCCBDWgAwIBAgIQVvXmnZpU7GpmDQbP2RA+DDANBgkqhkiG9w0BAQUFADCB
{...]
T5A4onjwNgpfTwlfM0BaqhMjii2rrUrWdz++8gPO1SnJNFM5kKwzq8jjj6ezFfZQ
iV/THI2bNvQl6In1tHt8rO8=
-----END CERTIFICATE-----
  1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use 
at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
Server CA - G3
    i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 
VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public 
Primary Certification Authority - G5
-----BEGIN CERTIFICATE-----
MIIF7DCCBNSgAwIBAgIQbsx6pacDIAm4zrz06VLUkTANBgkqhkiG9w0BAQUFADCB
yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
[...]
W+yzf5VK+wPIrSbb5mZ4EkrZn0L74ZjmQoObj49nJOhhGbXdzbULJgWOw27EyHW4
Rs/iGAZeqa6ogZpHFt4MKGwlJ7net4RYxh84HqTEy2Y=
-----END CERTIFICATE-----
---
Server certificate
subject=/C=GB/ST=London/L=London/O=Department for Work and 
Pensions/OU=Transformational Government/CN=secure.gateway.gov.uk
issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of 
use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure 
Server CA - G3
---
No client certificate CA names sent
---
SSL handshake has read 3043 bytes and written 447 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
     Protocol  : TLSv1
     Cipher    : AES256-SHA
     Session-ID: 56[...]B6
     Session-ID-ctx:
     Master-Key: 89[...]43
     Key-Arg   : None
     Start Time: 1462400804
     Timeout   : 300 (sec)
     Verify return code: 0 (ok)
---
DONE
ron@debians5:~$

Does this, in the dialogue, matter:
---
No client certificate CA names sent
---


Reco, thanks for having taken the time to think about it, grateful.

regards, Ron.

[toc] | [prev] | [next] | [standalone]

#167484

FromLisi Reisz <lisi.reisz@gmail.com>
Date2016-05-05 01:20 +0200
Message-ID<rveff-4QT-11@gated-at.bofh.it>
In reply to#167483
On Wednesday 04 May 2016 23:58:56 Ron Leach wrote:
> But ... following some other earlier posts by folk using a web browser
> to reach the url (and seeming to have success)

Curiouser and curiouser - I didn't just reach it successfully, I logged in 
successfully. Certificates weren't mentioned. :-/

Lisi

[toc] | [prev] | [next] | [standalone]

#167488

FromRon Leach <ronleach@tesco.net>
Date2016-05-05 09:10 +0200
Message-ID<rvlA6-3pp-1@gated-at.bofh.it>
In reply to#167484
On 05/05/2016 00:13, Lisi Reisz wrote:
> On Wednesday 04 May 2016 23:58:56 Ron Leach wrote:
>> But ... following some other earlier posts by folk using a web browser
>> to reach the url (and seeming to have success)
>
> Curiouser and curiouser - I didn't just reach it successfully, I logged in
> successfully. Certificates weren't mentioned. :-/
>

Very odd, I agree.  May I check 2 things with you?


Their rejection message does suggest folk might not be using the 
'right address' - which could mean a different url was employed, 
landing on a different server.  Did you use:
https://secure.gateway.gov.uk:443
or
htps://www.secure.gateway.go.uk:443 ?


When you normally login, do you login using a username, and a 
password?  That is the commonest method, I believe (and which we use) 
but when the Secure Gateway was first created there was a facility for 
people to obtain a 'certificate'.  We didn't do that, and the HMRC 
filing software doesn't work with user certificates anyway.  But I 
wondered which of the two possible schemes you used when you 
successfully logged in; username, or certificate?

Thanks for your test, which shows that their system is working - at 
least in some regions, or some modes.

regards, Ron

[toc] | [prev] | [next] | [standalone]

#167491

FromLisi Reisz <lisi.reisz@gmail.com>
Date2016-05-05 10:10 +0200
Message-ID<rvmwb-4mY-29@gated-at.bofh.it>
In reply to#167488
On Thursday 05 May 2016 08:08:51 Ron Leach wrote:
> On 05/05/2016 00:13, Lisi Reisz wrote:
> > On Wednesday 04 May 2016 23:58:56 Ron Leach wrote:
> >> But ... following some other earlier posts by folk using a web browser
> >> to reach the url (and seeming to have success)
> >
> > Curiouser and curiouser - I didn't just reach it successfully, I logged
> > in successfully. Certificates weren't mentioned. :-/
>
> Very odd, I agree.  May I check 2 things with you?
>
>
> Their rejection message does suggest folk might not be using the
> 'right address' - which could mean a different url was employed,
> landing on a different server.  Did you use:
> https://secure.gateway.gov.uk:443
> or
> htps://www.secure.gateway.go.uk:443 ?
>
>
> When you normally login, do you login using a username, and a
> password?  That is the commonest method, I believe (and which we use)
> but when the Secure Gateway was first created there was a facility for
> people to obtain a 'certificate'.  We didn't do that, and the HMRC
> filing software doesn't work with user certificates anyway.  But I
> wondered which of the two possible schemes you used when you
> successfully logged in; username, or certificate?
>
> Thanks for your test, which shows that their system is working - at
> least in some regions, or some modes.
>
> regards, Ron

Just logged in again at
http://www.gateway.gov.uk/

Then click on "Enter the Government Gateway" and get to:
https://authenticate.gateway.gov.uk/sidp/SignIn.ashx?gwv=1.0&gwrealm=http%3a%2f%2fwww.gateway.gov.uk%2fmyaccount%2f2007%2f07&gwreply=http%3a%2f%2fwww.gateway.gov.uk%2fDefault.aspx

enter ID and password and press enter, and get to:
https://myaccount.gateway.gov.uk/Pages/Enrolments/List.aspx

And get Welcome xxxxx xxxxx (my husband), what my husband is enrolled for, and 
a separate list of hyperlinks of enrolments available, the 17th of which is 
<Self Assessment (SA)>

My favourite is:
<Sheep and Goats Ear Tag Allocation System for Animal ID Manufacturers>
!!!

HTH,
Lisi

[toc] | [prev] | [next] | [standalone]

#167493

FromReco <recoverym4n@gmail.com>
Date2016-05-05 11:20 +0200
Message-ID<rvnBT-5DB-5@gated-at.bofh.it>
In reply to#167483
	Hi.

On Wed, May 04, 2016 at 11:58:56PM +0100, Ron Leach wrote:
> On 04/05/2016 23:22, Reco wrote:
> 
> >Considering that https://secure.gateway.gov.uk tells me about
> >*selecting* a valid certificate - it could mean that your *client*
> >became expired recently.
> 
> I wondered.  The application is a Python package distributed by UK TAX
> authority and intended for electronic filing.
> Are you thinking it might have its own 'certificate' which it has to
> present?

It's possible. Embedding a client certificate into application (or
distributing it alongside) is a bad practice, but they use Windows
instead of a real server anyway.


> But ... following some other earlier posts by folk using a web browser to
> reach the url (and seeming to have success), I tried the same thing.  With a
> very up to date FF, I received:
> 
> "Government Gateway Error - Access Denied (12202)
> 
> Please ensure that you have selected a valid certificate and that you are
> using the correct address. "
> 
> I guess this is what you had, as well.

Exactly.


> I have done this several times, now,
> with Firefox (once with Iceweasel) on Debian 7, D6 LTS, Fedora 23, MS Vista,
> MS Win7, all different machines, on a few different IP addresses, and all
> produce the same response.  Do the Tax people mean that my Firefox(es) have
> a certificate (I didn't know that)?

I take it that they don't provide a client certificate for tax purposes
in UK, and rely on username/password combo instead?


> And that it is somehow 'invalid'?

Every X.509 certificate has those "Not Before" and "Not After" fields.
An expired certificate is the one that has "Not After" set in the past.
To put it bluntly, X.509 is one of those things that certainly isn't
getting better with age.


> > Try this:
> >
> >openssl s_client -showcerts -connect secure.gateway.gov.uk:443 \
> >-CApath /etc/ssl/certs</dev/null
> >
> 
> Reco, here's the output.  It looks ok, to me, unless I'm missing something.
> Can I assume that the TLS handshake looks as though it ought to be ok - in
> that we are not or would not reject or impair the negotiation? 

Yes, definitely. This result shows that secure.gateway.gov.uk uses the
correct certificate chain, and your openssl trusts the root of it, which
is (the issuer of depth 1 certificate):

>    i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign,
> Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary
> Certification Authority - G5


> Reco, thanks for having taken the time to think about it, grateful.

You're welcome.

Reco

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web