SSL connection problem

[Nathanael Van Vorst <va...@ieee.org>]

Hello,

I have been using mina 2.0.0-X for about a year and it has been working
great. Thanks for putting together such a great library!

One of the things I do with mina is make SSL connections. Recently one of
our certificates expired and we got a new certificate. Our private key did
not change. Most of the my SSL connections used the new certificate without
any problem. However, a few of the connections no longer work with the new
certificate (lets call the servers who I can't connect to X). Using the new
cert I am able to establish a SSL connection to X using PHP and openssl, but
not mina.

I have spent a good deal of energy trying to debug the issue. It appears
that the connection setup and SSL handshake go fine, then suddenly the
server closes the connection before the SSL is established. I can't find a
reason for it. I have created a small project that duplicates this issue. I
am attaching the code and example output with system property
javax.net.debug set to "all". "test_tar_gz" is a gzipped tar so just rename
it to "test.tar.gz" (sorry I have to change the ext or my email will get
filtered) . "bad.txt" is the run where I don't get connected. "good.txt" is
the run where I do. For good.txt I am using one of our old certs that has
not yet expired (but will soon!). I tested this with 2.0.0-M1 though
2.0.0-M4 with the same problem showing up. The output was generated with
2.0.0-M4.

I would very much appreciate it if some "experts" could take a look at the
the attached output and source code and help me fix this issue.

Thanks,

--Nate
-- 
vanvorst@ieee.org

Re: SSL connection problem

[Emmanuel Lecharny <el...@gmail.com>]

Nathanael Van Vorst wrote:
> I have yet to resolve this issue. Any suggestions on how I might proceed
> with debugging and fixing this issue would be greatly appreciated!
>   

Hi,

just a few suggestion :
1) create a JIRA, it's easier for everybody to follow it (and you can 
'watch' it. Moreover, your mail can be lost, the JIRA will remain !
2) Can you provide the test.java code your are using, with a minimal 
server ? Ultimately, a certificate would help (you can generate a new 
one for that purpose). The first mail you sent didn't contain those, 
either because you forgot to attach them, or - more likely - they have 
been removed from your mail by our spam filter (one more reason to 
create a JIRA : you can attach files to it !)


AFAICT, I didn't experiment any problem with MINA 2.0.0-M4 and SSL 
lately, but that does not mean it's not buggy :).

Thanks !

> Thanks.
>
> --Nate
>
> On Mon, Jan 19, 2009 at 3:01 PM, Nathanael Van Vorst <va...@ieee.org>wrote:
>
>   
>> Hello,
>>
>> I have been using mina 2.0.0-X for about a year and it has been working
>> great. Thanks for putting together such a great library!
>>
>> One of the things I do with mina is make SSL connections. Recently one of
>> our certificates expired and we got a new certificate. Our private key did
>> not change. Most of the my SSL connections used the new certificate without
>> any problem. However, a few of the connections no longer work with the new
>> certificate (lets call the servers who I can't connect to X). Using the new
>> cert I am able to establish a SSL connection to X using PHP and openssl, but
>> not mina.
>>
>> I have spent a good deal of energy trying to debug the issue. It appears
>> that the connection setup and SSL handshake go fine, then suddenly the
>> server closes the connection before the SSL is established. I can't find a
>> reason for it. I have created a small project that duplicates this issue. I
>> am attaching the code and example output with system property
>> javax.net.debug set to "all". "test_tar_gz" is a gzipped tar so just rename
>> it to "test.tar.gz" (sorry I have to change the ext or my email will get
>> filtered) . "bad.txt" is the run where I don't get connected. "good.txt" is
>> the run where I do. For good.txt I am using one of our old certs that has
>> not yet expired (but will soon!). I tested this with 2.0.0-M1 though
>> 2.0.0-M4 with the same problem showing up. The output was generated with
>> 2.0.0-M4.
>>
>> I would very much appreciate it if some "experts" could take a look at the
>> the attached output and source code and help me fix this issue.
>>
>> Thanks,
>>
>> --Nate
>> --
>> vanvorst@ieee.org
>>
>>     
>
>
>
>   


-- 
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org

Re: SSL connection problem

[Nathanael Van Vorst <va...@ieee.org>]

I have yet to resolve this issue. Any suggestions on how I might proceed
with debugging and fixing this issue would be greatly appreciated!

Thanks.

--Nate

On Mon, Jan 19, 2009 at 3:01 PM, Nathanael Van Vorst <va...@ieee.org>wrote:

> Hello,
>
> I have been using mina 2.0.0-X for about a year and it has been working
> great. Thanks for putting together such a great library!
>
> One of the things I do with mina is make SSL connections. Recently one of
> our certificates expired and we got a new certificate. Our private key did
> not change. Most of the my SSL connections used the new certificate without
> any problem. However, a few of the connections no longer work with the new
> certificate (lets call the servers who I can't connect to X). Using the new
> cert I am able to establish a SSL connection to X using PHP and openssl, but
> not mina.
>
> I have spent a good deal of energy trying to debug the issue. It appears
> that the connection setup and SSL handshake go fine, then suddenly the
> server closes the connection before the SSL is established. I can't find a
> reason for it. I have created a small project that duplicates this issue. I
> am attaching the code and example output with system property
> javax.net.debug set to "all". "test_tar_gz" is a gzipped tar so just rename
> it to "test.tar.gz" (sorry I have to change the ext or my email will get
> filtered) . "bad.txt" is the run where I don't get connected. "good.txt" is
> the run where I do. For good.txt I am using one of our old certs that has
> not yet expired (but will soon!). I tested this with 2.0.0-M1 though
> 2.0.0-M4 with the same problem showing up. The output was generated with
> 2.0.0-M4.
>
> I would very much appreciate it if some "experts" could take a look at the
> the attached output and source code and help me fix this issue.
>
> Thanks,
>
> --Nate
> --
> vanvorst@ieee.org
>



-- 
Nathanael Van Vorst
vanvorst@ieee.org