SSL No Cypher Overlap

blake.badders

I am currently trying to get the certificates for forge.mil and have been unable to do so. While reading through the forums and through the FAQ, I tried to get them by using the keygen tool and also using the SSLManager. Using the manager, I was able to get the sahi.example.com certificates, but when I tried to get the forge.mil certificates, it said:

An error occurred during a connection to forge.mil.

Cannot communicate securely with peer: no common encryption algorithm(s).

(Error code: ssl_error_no_cypher_overlap)

If anyone knows how to handle this error or can point me to a topic/FAQ already addressing this (I tried to look for one, but couldn't find any) it would be greatly appreciated.

-Blake

narayan

If you are not already doing it, use the latest version of Java (1.6+) and try. I will have a shot at this tomorrow. Please add any more details that we would need to reproduce it.

Regards,
Narayan

blake.badders

Just discovered that it wasn't working because I was leaving the "www" off at the beginning of forge.mil -.-

I was able to add the certificate through the SSLManager when I searched for the full address instead of using forge.mil. Sorry about the false alarm.

EDIT:
Now that I do have the certificate added, I have tried to make a test to make sure that I can access forge.mil. It does some basic navigation and asserting; nothing fancy. However, when I run the suite (its only one test, but I'm trying to learn how to use suites as we will probably perform multiple tests at a time later on) and it runs in to problems when trying to open up the webpage.

The test is forgetest.sah and the suite is forgetest.suite. Here is what I enter into the command line:
..\tools\toggle_IE_proxy_exe enable
java -cp ..\lib\ant-sahi.jar net.sf.sahi.test.TestRuner "C:\sahi_20090521\sahi\scripts\forgetest.suite" "C:\Program Files\Internet Explorer\IEXPLORE.EXE" htt_ps://www_forge_mil default localhost 9999 1 iexplore.exe
..\tools\toggle_IE_proxy_exe disable

and it says that it cannot access that page.

narayan

I cannot access the site either.
I presume you used the correct URL? Do other URLs work?
Btw, which version of IE are you using?

Regards,
Narayan

narayan

Looking at the site again, I realize that you need to use client certificates to access the site.
I am making an unstable release of Sahi where you can configure Sahi to use client certificates. The build should be out in a couple of hours. I will post an update here once done.

blake.badders

Awesome, thanks.

narayan

I have released a new Sahi build here: https://sourceforge.net/projects/sahi/files/
Pick the 15 July 2009 zips.

If you wish to use client certificates, you will need to modify the last lines in sahi.properties

# Uncomment the following lines to use a client certificate.
# If there is no password, do not uncomment the password line.
# keystore type can be JKS, PKCS12 etc. 
#ssl.client.keystore.type = PKCS12
#ssl.client.cert.path = ../certs/you_certificate.extension
#ssl.client.cert.password = sahipassword

Let me know if it works for you.

Regards,
Narayan

blake.badders

Thanks for the build.

I downloaded the new build and got the properties file set up, but forge.mil still doesn't' open up on IE7. But, when I tried to open it on firefox 3.5 it did work after adding an exception. Now I haven't tried using it in a test suite or anything, but I was able to open up the site.

I didn't have too much time to work on it today since I was in meetings mostly, but tomorrow I should be able to spend most of the day on it and see if I can't pinpoint the problem and make it less ambiguous.

blake.badders

I have tried running it in both Firefox 3.5 and IE7 and I am now getting a PKIX path building failed error. I read through the forums and found that you had fixed this problem months ago, so now I am stuck again.

narayan

Could you paste the exception here?
Could you also show the changes you made to sahi.properties? Also, what is the java version you are using?

blake.badders

Error:

Sahi Error - sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Either the remote server is down or not reachable
or
You need an external proxy to be configured.

You could configure the external proxy by editing <sahi_root>/config/sahi.properties and setting these properties:

ext.http.proxy.enable=true
ext.http.proxy.host=external_proxy_server_hostname_or_ip
ext.http.proxy.port=external_proxy_server_port

If your proxy needs authorization, you should set these properties too.
ext.http.proxy.auth.enable=true
ext.http.proxy.auth.name=proxy_authorization_username
ext.http.proxy.auth.password=proxy_authorization_password

You should do the same with ext.https settings for https sites.

- hide stacktrace
+ show stacktrace
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at java.net.HttpURLConnection.getResponseCode(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
at net.sf.sahi.RemoteRequestProcessor.processHttp(RemoteRequestProcessor.java:99)
at net.sf.sahi.RemoteRequestProcessor.processHttp(RemoteRequestProcessor.java:73)
at net.sf.sahi.ProxyProcessor.processAsProxy(ProxyProcessor.java:129)
at net.sf.sahi.ProxyProcessor.run(ProxyProcessor.java:86)
at net.sf.sahi.ProxyProcessor.processConnect(ProxyProcessor.java:219)
at net.sf.sahi.ProxyProcessor.processAsProxy(ProxyProcessor.java:121)
at net.sf.sahi.ProxyProcessor.run(ProxyProcessor.java:86)
at java.lang.Thread.run(Unknown Source)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at sun.security.validator.Validator.validate(Unknown Source)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(Unknown Source)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
... 21 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
... 27 more


Properties: (I've tried with enable=true and false for both)

# Use external proxy server for http
ext.http.proxy.enable=false
ext.http.proxy.host=localhost
ext.http.proxy.port=8008
ext.http.proxy.auth.enable=false
ext.http.proxy.auth.name=kamlesh
ext.http.proxy.auth.password=sahipassword

# Use external proxy server for https
ext.https.proxy.enable=false
ext.https.proxy.host=localhost
ext.https.proxy.port=8008
ext.https.proxy.auth.enable=false
ext.https.proxy.auth.name=kamlesh
ext.https.proxy.auth.password=sahipassword

...

# Uncomment the following lines to use a client certificate.
# If there is no password, do not uncomment the password line.
# keystore type can be JKS, PKCS12 etc. 
ssl.client.keystore.type = JKS
ssl.client.cert.path = C:/sahi_20090715/sahi/certs/www_forge_mil
# ssl.client.cert.password = sahipassword

Running java version 1.6.0_14

narayan

Is www_forge_mil the certificate generated by Sahi? If yes, then that is not what you use there. I am guessing that to access forge.mil you had to install a client certificate on your browser for authentication. You need to use that certificate.

Regards,
Narayan

blake.badders

Sorry about not posting in a while, I was going through a few people to get access to the certificates that I needed to use. I have them and can now browse the https fine, but when I try to run my test, it doesn't work. Firefox opens up the starting address without performing any of the test while internet explorer won't even open up the starting address.

Here are my files:

forgetest.sah:

function forgeTest(){
    _click(_link("What is the Forge.mil Program?"));
    _click(_cell(_table(0), 2, 0));
    _click(_link("How can I get access to Forge.mil?"));
    _click(_cell(_table(0), 5, 0));
    _click(_cell(_table(0), 5, 0));
    _assertExists(_link("Who do I contact to get more information?[1]"));
    
    _click(_cell(_table(0), 5, 0));
    _click(_cell(_table(0), 4, 0));
    _click(_link("Information Assurance Support Environment"));
    _click(top.document.getElementsByTagName('div')[7]);
    _assertExists(_image("DoD PKI"));
}
forgeTest();

forgesuite.suite:

forgetest.sah https://www.forge.mil

ie_forgetest.bat:

..\tools\toggle_IE_proxy.exe enable 
java -cp ..\lib\ant-sahi.jar net.sf.sahi.test.TestRunner "C:\sahi_20090715\sahi\scripts\forgetest.suite" "C:\Program Files\Internet Explorer\IEXPLORE.EXE" https://www.forge.mil/ "C:\Documents and Settings\bbadder\Desktop" localhost 9999 1 iexplore.exe 
..\tools\toggle_IE_proxy.exe disable

ff_forgetest.bat:

java -cp ..\lib\ant-sahi.jar net.sf.sahi.test.TestRunner "C:\sahi_20090715\sahi\scripts\forgetest.suite" "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.forge.mil "C:\Documents and Settings\bbadder\Desktop" localhost 9999 1 firefox.exe "-profile C:\sahi_20090715\sahi\browser\ff\profiles\sahi$threadNo -no-remote"

narayan

Do these tests individually work if you run them via the Controller? Even after opening a fresh browser?

blake.badders

Just finished trying it out and the tests run fine in the controller for both firefox and internet explorer.

narayan

When you run on IE, what does the browser show and what do you see on the Sahi console (where you run sahi.bat from) ? Any exceptions?
And what are the results with firefox. For simplicity, leave the log directory as default for the time being.
I think the error output on the Sahi console should pinpoint the problem.

EDIT: I mean when running via the suite file.

blake.badders

Internet Explorer:

Browser:
says it cannot display this page, no reasons given

Console (running sahi in top cmd, ran .bat in bottom cmd):




Firefox:

Browser:
opens up forge.mil, doesn't perform any of the tests

Console (running sahi in top cmd, ran .bat in bottom cmd):

narayan

Says, Image Not Found. Could you email them to me at narayan@sahi.co.in please?