<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 11/17/2009 01:09 PM, John Dorovski wrote: <blockquote cite="mid:c2df85950911171309u21a5064amb45455f2f5e327e0@mail.gmail.com" type="cite">It was not a typo. I did use the port number 9545. </blockquote> Ok. one idea would be to run the utility "ssltap" as a proxy and using your browser to connect to the "ssltap" port and pasting the output here so folks can see what's happening during the SSL handshake. <a class="moz-txt-link-freetext" href="http://www.mozilla.org/projects/security/pki/nss/tools/ssltap.html">http://www.mozilla.org/projects/security/pki/nss/tools/ssltap.html</a> On a Fedora 10 system, its packaged with nss-tools rpm. Run ssltap like this... ssltap -sfxl CA_HOSTNAME:CA_PORT in your case, it will be ssltap -sfxl localhost:9545 Then use a browser and connect to ssltap. ssltap listens on port 1924. So on the browser type.. <a class="moz-txt-link-freetext" href="https://localhost.localdomain:1924">https://localhost.localdomain:1924</a> ssltap will capture the results of the ssl handshake. Copy and paste it here so we can tell what's happening during that phase while you get the bad mac alert. Thanks, --Chandra <blockquote cite="mid:c2df85950911171309u21a5064amb45455f2f5e327e0@mail.gmail.com" type="cite"> John <div class="gmail_quote">On Tue, Nov 17, 2009 at 3:51 PM, Adewumi, Julius-p99373 <<a moz-do-not-send="true" href="mailto:Julius.Adewumi@gdc4s.com">Julius.Adewumi@gdc4s.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Unless it's a typo on your part, the two port numbers are different... Could that be the problem? 8445 vs 9545 From: Julius Adewumi @GDC4S.com Ph:480-441-6768 Contract Corp:MTSI <div class="im"> -----Original Message----- From: <a moz-do-not-send="true" href="mailto:pki-users-bounces@redhat.com">pki-users-bounces@redhat.com</a> [mailto:<a moz-do-not-send="true" href="mailto:pki-users-bounces@redhat.com">pki-users-bounces@redhat.com</a>] On Behalf Of Christina Fu Sent: Tuesday, November 17, 2009 12:56 PM To: <a moz-do-not-send="true" href="mailto:pki-users@redhat.com">pki-users@redhat.com</a> </div> <div> <div class="h5">Cc: <a moz-do-not-send="true" href="mailto:johndorovski@googlemail.com">johndorovski@googlemail.com</a> Subject: [Pki-users] (forwarded) Help needed on dogtag I might have messed up when managing pki-users and this did not come through. Hence the forward. Christina Subject: Help needed on dogtag From: John Dorovski <<a moz-do-not-send="true" href="mailto:johndorovski@googlemail.com">johndorovski@googlemail.com</a>> Date: Tue, 17 Nov 2009 10:58:18 -0500 To: <a moz-do-not-send="true" href="mailto:pki-users@redhat.com">pki-users@redhat.com</a> Hi, I just installed a dogtag (1.2.0) instance on my Fedora 10 system. I used a SafeNet ProtectServer Gold HSM as keystore. The dogtag system installation and configuration were fine. No error was reported. All keys and certificates were generated inside the HSM. But when I tried to access the secure admin interface at <a class="moz-txt-link-freetext" href="https://localhost:localdomain:9545">https://localhost:localdomain:9545</a> I got error message: Secure Connection Failed An error occurred during a connection to localhost.localdomain:8445 SSL peer reports incorrect Message Authentication Code. (Error code: ssl_error_bad_mac_alert) I checked the server certificate (viewed it with IE on a Windows box). It seems fine. Does any body know what is wrong and how can I fix it? Thanks, John _______________________________________________ Pki-users mailing list <a moz-do-not-send="true" href="mailto:Pki-users@redhat.com">Pki-users@redhat.com</a> <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/pki-users" target="_blank">https://www.redhat.com/mailman/listinfo/pki-users</a> </div> </div> </blockquote> </div> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Pki-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Pki-users@redhat.com">Pki-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/pki-users">https://www.redhat.com/mailman/listinfo/pki-users</a> </pre> </blockquote> </body> </html>