Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
kb1
Collaborator

getting certificate error when trying to connect to a site

So we are trying to connect to a proofpoint link for employee training-

https://004e0b01.pphosted.com:10000/

and we can connect to it from home when not connected to company vpn, but when we are inside the network it doesnt work, i have tried the following straight from the internet firewall (running GAiA R80.20) and this is what i got-

 

[Expert@VXX-FWXX:0]# curl_cli -v https://004e0b01.pphosted.com:10000/
* Trying 205.220.162.242...
* Connected to 004e0b01.pphosted.com (205.220.162.242) port 10000 (#0)
* ALPN, offering http/1.1
* Cipher selection: HIGH:!RC4:!LOW:!EXP:!aNULL:!SSLv2:!MD5:!aECDH:!EDH
* *** Current date is: Wed Oct 28 14:46:31 2020
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Wed Oct 28 14:46:31 2020
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* err is -1, detail is 1
* errdetail=0x14090086
ERR_lib_error_string: SSL routines
ERR_func_error_string: ssl3_get_server_certificate
ERR_reason_error_string: certificate verify failed
ERR_error_string: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html
 
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
 
As you can see from the above output the connection to the server itself is successful but towards the end there is cert error because of which connection is being dropped, i dont think this is a firewall issue (we have url filtering enabled but not https inpsection, using only categoized https inspection), so im assuming that this is not an issue from our side?
 
Thank You.
0 Kudos
12 Replies
_Val_
Admin
Admin

It looks like you cannot fetch CRL. 

Also, are you using inbonud HTTPS Inspection?

0 Kudos
kb1
Collaborator

as you can see https inspection is turned off, only categorized https inspection is enabled which i dont think should be causing any cert issues unless im wrong-

 

https.png

0 Kudos
_Val_
Admin
Admin

With R80.20, starting from certain HFA, HTTPS categorisation verifies the actual web certificate, CRL and its chain. Please make sure the following:

 

  1. Web site you are accessing has a trusted certificate
  2. Security GW has DNS working properly
  3. CRL can be retrieved

If at least one condition does not match, that's your case:

 

ERR_lib_error_string: SSL routines
ERR_func_error_string: ssl3_get_server_certificate
ERR_reason_error_string: certificate verify failed
ERR_error_string: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate

 

0 Kudos
kb1
Collaborator

How can I make sure that the crl can be retrieved?

0 Kudos
_Val_
Admin
Admin

Did you already rule out two first cases? Can you access this website from a non-firewalled client? How does the certificate look?

CRL distribution point is mentioned in the certificate itself. Take this URL and try accessing it from the GW, with curl_cli

0 Kudos
kb1
Collaborator

So apparently it works with the untrusted option as you can see below, what does that mean?

[Expert@VXX-FXX:0]# curl_cli -k https://004e0b01.pphosted.com:10000/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://004e0b01.pphosted.com:10000/admin">here</a>.</p>
</body></html>

0 Kudos
PhoneBoy
Admin
Admin

Looks like curl isn’t trusting the certificate presented.
Have you tried using the —insecure option as noted in the output?

0 Kudos
kb1
Collaborator

Yes I will try that out and post here

0 Kudos
kb1
Collaborator

So apparently it works with the untrusted option as you can see below, what does that mean?

curl_cli -k https://004e0b01.pphosted.com:10000/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://004e0b01.pphosted.com:10000/admin">here</a>.</p>
</body></html>

0 Kudos
_Val_
Admin
Admin

I think the best is to open a support call. I can see, the certificate is valid, but CRL is not hosted on digicert but on a different site: http://cacerts.thawte.com/ThawteRSACA2018.crt

This might be the source of your issue, or, it might be something else. BTW, check you can fetch http://cacerts.thawte.com/ThawteRSACA2018.crt from your GW.

0 Kudos
kb1
Collaborator

ok thanks for the help.
0 Kudos
kb1
Collaborator

i tried this-

curl_cli -v http://cacerts.thawte.com/ThawteRSACA2018.crt

and got a binary output and im assuming its able to fetch the cert?

0 Kudos