SSL/PKI x.509 Certificate browser authentication Problems

HCL Domino Domino Forum
1

We have implemented SSL/x.509 PKI certificates for authentication over the web.

In IE I frequently have the page/session time out and the only way to get back in is close all instances of the browser and log back in.

In Mozilla Firebird I will frequently get the following error but the page continues to load:

www.yourdomain has sent an incorrect or unexpected message. Error Code: -12263

I found this on Mozilla’s site which looks to me like it may be the Domino Server causing the problem. Anyone have any experience with this or know why this might be occuring?

http://www.mozilla.org/projects/security/pki/nss/ref/ssl/sslerr.html

SSL_ERROR_RX_RECORD_TOO_LONG -12263 “SSL received a record that exceeded the maximum permissible length.”

This generally indicates that the remote peer system has a flawed implementation of SSL, and is violating the SSL specification.

TIA,

Wendall Mosemann

2

Subject: SSL/PKI x.509 Certificate browser authentication Problems

We’ve contacted IBM Tech Support on this one. Here’s whats been happening as of late:***********************************************

6/24/2004

To: Tony Trout

From: wmoze

Subject: RE: 46122,344,000

When users refresh the page, the same “login” screen is displayed. They

actually have to close all browser windows and start over. I believe

all the users are in one group, and that group is in the ACL for all the

databases for the site we have PKI enabled. We’ll give step 3 a go and

let you know how it turns out…

-wmoze

P.S.

Are there any plans that you know of to implement CRL checking using 3rd

party (non-Domino CA) certs in R7? We have found that Domino does not

do CRL checking unless it is the CA. The Navy has mandated that we PKI

enable all our username/pwd sites. We know IIS will handle CRL checking

but don’t want to go with that unless we have to. We had thought of

using IIS as the HTTP stack but it still passes off the .nsf URL request

to Domino without doing the CRL checking like we had hoped.

From: Tony Trout

Sent: Wednesday, June 23, 2004 5:11 PM

To: wmoze

Subject: RE: 46122,344,000

Ok, I get it now. We have seen something similar before (ran this by

some people and they said we had seen this before). Troubleshooting this

will be interesting.

What we need to do is:

  1. When this occurs, what happens if the user hits refresh in the

browser? Try using CTRL+F5. See if that allows them in.

  1. When the failure occurs are they trying to access something that they

have access to via a group or by their name directly in the ACL?

  1. Here’s the fun part. The way to track this is using a notes.ini

parameter: webauth_verbose_trace=1 and logging the console. What we

need then is to know who saw the problem and at what time, so we can

find that in the log. That is going to print a lot of information and

won’t be obvious, hence the need to know who and what time to be able to

find it.

06/22/2004 12:22 PM

From: wmoze

To: Tony Trout

Subject: RE: 46122,344,000

Ok, understand where you are comming from. Here’s what we are

encountering:

When a user attempts to acces the site, they are prompted to pick their

cert from the certificate store(IE). They select their certificate and

are then authenticated and can access the site. That part seems to work

just fine. The problem we are seeing is that, after the user has been

authenticated and they start to browse the site, they will randomly be

locked out of the site (they have to close the browser and

re-authenticate to the site). The old login page (from domcfg.nsf) will

display telling them they have insufficient access even though they have

access to all parts of the site. We had assumed (not knowing exactly

how the PKI authentication is handled) that there was some cookie or

something that was set when the user initially authenticated that was

“timing out” or maybe being corrupted/overwritten. After

re-authenticating, the users are able to then browse the site again and

view the page that had initially locked them out.

On a side note … I guess if session authentication is not used with

x.509 certificates than that would also explain why users don’t show up

in the authenticated internet users view in the admin client.

Sent: Tuesday, June 22, 2004 12:20 PM

From: Tony Trout

To: wmoze

Subject: RE: 46122,344,000

Right, that’s what I understood it to be. My confusion is that when you

hit the server over SSL using a client certificate it’s not going to ask

for additional credentials via the session authentication (assuming it

can authenticate you with the client certificate). So, you don’t need to

log in and get the cookie, and therefore should not have a session that

will expire. So I didn’t understand if both were in play here, or if

these were separate issues involved (one being an SSL issue and the

other being session timeouts).

06/22/2004 06:28 AM

To: Tony Trout

From: wmoze

Subject: RE: 46122,344,000

When I refer to client certificate I’m refering to the certificate

installed in the web browser, not a certificate associated with the

Lotus Notes Client. The certificates are issued by the Department of

Defense (DoD) and each user imports the certificate into the browser

certificate store. As far as session authentication, when we were using

Username/Pwd’s for end users, they would authenticate to a website and

they were authenticated as long as the browser was open or until they

reached the timeout (we bumped it up from the default of 30 minutes to 4

hours). None of our users have access to a Lotus Notes Client…

-----Original Message-----

From: Tony Trout

Sent: Monday, June 21, 2004 7:20 PM

To: wmoze

Subject: 46122,344,000

Wendall, I am going to be working this issue after discussing it with

Vinny. I work on the Web Server team and should have a better handle on

the issues at hand. However, I am unsure abotu part of this (as was

Vinny). You are using client certificates to access the website. I’m not

sure then how session authentication is coming into play, since it

should be allowing you access solely based on the client certificate. It

shouldn’t be prompting for further credentials.

So, I wanted to understand how each piece comes into play if you could

clarify.

3

Subject: RE: SSL/PKI x.509 Certificate browser authentication Problems

Hi Wendall MosemannIs the problem resolved?We have similar issue with 8.5.1 FP2.

With domino 7.0.3 there is no issue.After migration,the users are prompted to sign in even though they have valid certficate that can be authenticated.

4

Subject: RE: SSL/PKI x.509 Certificate browser authentication Problems

Check your server dokument to see if the value for

“Maximum POST data (in kilobytes)”

has the same size as

“Maximum size of request content”.

5

Subject: SSL/PKI x.509 Certificate browser authentication Problems

I’ve never seen that particular error, myself. Please set DEBUG_SSL_ALL=2 and SSL_TRACE_KEYFILEREAD=1 in your notes.ini and post the resulting logs here so we can take a look at them and try to determine what is going wrong.

Thanks,

dave

6

Subject: RE: SSL/PKI x.509 Certificate browser authentication Problems

Where will the results be logged? In the log.nsf file or in the http logs? Also does that change require a server restart or can we get by with just restarting HTTP?

Regards,

Wendall

7

Subject: RE: SSL/PKI x.509 Certificate browser authentication Problems

The information will be printed to the server’s console window, and you should be able to just restart http in order to cause the variables to take effect.

8

Subject: RE: SSL/PKI x.509 Certificate browser authentication Problems

Here’s the output for about half a minute worth of console logs from the console.log file:

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Password is ************

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Looking for trusted roots

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Found trusted roots

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Exit status = 0

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Password is ************

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Looking for cert chain

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Got cert chain

05/24/2004 10:44:03.99 AM [080C:0057-0A10] ReadKeyfile> Exit status = 0

05/24/2004 10:44:04.01 AM [080C:0057-0A10] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:04.01 AM [080C:0057-0A10] ReadKeyfile> Password is ************

05/24/2004 10:44:04.01 AM [080C:0057-0A10] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:04.01 AM [080C:0057-0A10] ReadKeyfile> Looking for private key

05/24/2004 10:44:04.01 AM [080C:0057-0A10] ReadKeyfile> Decoding keys

05/24/2004 10:44:04.01 AM [080C:0057-0A10] ReadKeyfile> Keys decoded

05/24/2004 10:44:04.01 AM [080C:0057-0A10] ReadKeyfile> Exit status = 0

05/24/2004 10:44:08.19 AM [080C:0058-096C] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:08.19 AM [080C:0058-096C] ReadKeyfile> Password is ************

05/24/2004 10:44:08.19 AM [080C:0058-096C] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:08.19 AM [080C:0058-096C] ReadKeyfile> Looking for trusted roots

05/24/2004 10:44:08.19 AM [080C:0058-096C] ReadKeyfile> Found trusted roots

05/24/2004 10:44:08.19 AM [080C:0058-096C] ReadKeyfile> Exit status = 0

05/24/2004 10:44:08.19 AM [080C:0058-096C] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:08.19 AM [080C:0058-096C] ReadKeyfile> Password is ************

05/24/2004 10:44:08.19 AM [080C:0058-096C] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:08.19 AM [080C:0058-096C] ReadKeyfile> Looking for cert chain

05/24/2004 10:44:08.21 AM [080C:0058-096C] ReadKeyfile> Got cert chain

05/24/2004 10:44:08.21 AM [080C:0058-096C] ReadKeyfile> Exit status = 0

05/24/2004 10:44:08.21 AM [080C:0058-096C] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:08.21 AM [080C:0058-096C] ReadKeyfile> Password is ************

05/24/2004 10:44:08.21 AM [080C:0058-096C] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:08.21 AM [080C:0058-096C] ReadKeyfile> Looking for private key

05/24/2004 10:44:08.21 AM [080C:0058-096C] ReadKeyfile> Decoding keys

05/24/2004 10:44:08.21 AM [080C:0058-096C] ReadKeyfile> Keys decoded

05/24/2004 10:44:08.21 AM [080C:0058-096C] ReadKeyfile> Exit status = 0

05/24/2004 10:44:13.33 AM [080C:0059-0994] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:13.33 AM [080C:0059-0994] ReadKeyfile> Password is ************

05/24/2004 10:44:13.33 AM [080C:0059-0994] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:13.33 AM [080C:0059-0994] ReadKeyfile> Looking for trusted roots

05/24/2004 10:44:13.33 AM [080C:0059-0994] ReadKeyfile> Found trusted roots

05/24/2004 10:44:13.33 AM [080C:0059-0994] ReadKeyfile> Exit status = 0

05/24/2004 10:44:13.33 AM [080C:0059-0994] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Password is ************

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Looking for cert chain

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Got cert chain

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Exit status = 0

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Password is ************

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Looking for private key

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Decoding keys

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Keys decoded

05/24/2004 10:44:13.35 AM [080C:0059-0994] ReadKeyfile> Exit status = 0

05/24/2004 10:44:16.37 AM [080C:005A-0980] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Password is ************

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Looking for trusted roots

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Found trusted roots

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Exit status = 0

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Password is ************

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Looking for cert chain

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Got cert chain

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Exit status = 0

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Password is ************

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Looking for private key

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Decoding keys

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Keys decoded

05/24/2004 10:44:16.38 AM [080C:005A-0980] ReadKeyfile> Exit status = 0

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Password is ************

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Looking for trusted roots

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Found trusted roots

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Exit status = 0

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Password is ************

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Looking for cert chain

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Got cert chain

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Exit status = 0

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Password is ************

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Looking for private key

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Decoding keys

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Keys decoded

05/24/2004 10:44:21.23 AM [080C:005B-0974] ReadKeyfile> Exit status = 0

05/24/2004 10:44:23.68 AM [080C:005C-0978] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:23.68 AM [080C:005C-0978] ReadKeyfile> Password is ************

05/24/2004 10:44:23.68 AM [080C:005C-0978] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:23.68 AM [080C:005C-0978] ReadKeyfile> Looking for trusted roots

05/24/2004 10:44:23.68 AM [080C:005C-0978] ReadKeyfile> Found trusted roots

05/24/2004 10:44:23.68 AM [080C:005C-0978] ReadKeyfile> Exit status = 0

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Password is ************

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Looking for cert chain

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Got cert chain

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Exit status = 0

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Password is ************

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Looking for private key

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Decoding keys

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Keys decoded

05/24/2004 10:44:23.69 AM [080C:005C-0978] ReadKeyfile> Exit status = 0

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Password is ************

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Looking for trusted roots

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Found trusted roots

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Exit status = 0

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Password is ************

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Looking for cert chain

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Got cert chain

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Exit status = 0

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Recovering password from stash file

05/24/2004 10:44:23.87 AM [080C:005D-0970] ReadKeyfile> Password is ************

05/24/2004 10:44:23.88 AM [080C:005D-0970] ReadKeyfile> Reading keyfile e:\Lotus\Domino\Data\insidenslc.kyr

05/24/2004 10:44:23.88 AM [080C:005D-0970] ReadKeyfile> Looking for private key

05/24/2004 10:44:23.88 AM [080C:005D-0970] ReadKeyfile> Decoding keys

05/24/2004 10:44:23.88 AM [080C:005D-0970] ReadKeyfile> Keys decoded

05/24/2004 10:44:23.88 AM [080C:005D-0970] ReadKeyfile> Exit status = 0> stop consolelog

9

Subject: RE: SSL/PKI x.509 Certificate browser authentication Problems

That looks like the keyring file is being read correctly.

The console log at the point when the offending network packet is being sent would be the most useful segment of the log. Ideally, the log would contain the entire SSL handshake, from the point when the browser opened the connection, to the point where the browser threw the error. Disabling SSL_TRACE_KEYFILEREAD will cut down on the volume a bit. If this proves to be too long, setting DEBUG_SSL_ALL=1 will cut down on the volume some more, but will also decrease the utility of the data.

dave

10

Subject: RE: SSL/PKI x.509 Certificate browser authentication Problems

When I only have on DEBUG_SSL_ALL = 2 nothing shows up on the console besides the normal events that get logged to the log.nsf. I can send you the full 4 MB console.log file that the prior snipet was taken from if that would help…

Here’s everything we have in the NOTES.INI tab:

LOG_AGENTMANAGER=1

LOG_MAILROUTING=40

LOG_SESSIONS=1

LOG_TASKS=1

SERVER_SHOW_PERFORMANCE=1

LOG_REPLICATION=2

HTTPAllowDecodedUrlPercent=1

SSL_TRACE_KEYFILEREAD=0

DEBUG_SSL_ALL=2

I have downloaded FireFox and am getting the same error. However it allows me to re-select my certificate and “logon” again (there is a setting in the security tab that allows you to be prompted or auto select the right cert - I have it set to prompt me).

Both IE and Mozilla just seem to “forget” that you are logged in. Could it be that the session cookie is being overwritten somehow? I’m just grasping at straws here…

11

Subject: RE: SSL/PKI x.509 Certificate browser authentication Problems

Does this have anything to do with this problem?

http://www-10.lotus.com/ldd/nd6forum.nsf/DateAllThreadedweb/3dee3be7bfeb92bd85256e9f003b570f?OpenDocument

I’m wondering if the session cookie in the browser is not set correctly. It almost seems like the session cookie is being expired as the user is getting the “login” page again…

12

Subject: RE: SSL/PKI x.509 Certificate browser authentication Problems

I doubt it. This problem seems to be connected to the SSL handshake, whereas the other appears to be related to http server login.