[Spacewalk-list] Spacewalk 2.1 | SSL Certificate Invalid when using HTTPS for host registration

Tue Jul 18 05:01:42 UTC 2017

Am 18. Juli 2017 02:34:25 MESZ schrieb Francis Lee Mondia <endace.francis.mondia at gmail.com>:
>Hi Robert,
>
>Thanks for the tips. Was able to login to the postgresql db with the
>credentials stored on the rhn.conf file. Tried to delete the referenced
>ky
>but I think the error is legit, as postgresql is enforcing a key
>constraint
>on the two tables so as not to have inconsistent keys. I dug into the
>table
>and I see that are are other keys inserted which I think were the ones
>I
>made and installed when I installed the newly-built rpms. I now think I
>don't need to do this step (delete the key) and look for another
>solution.
>
>
>I got another lead though which might get me to the bottom of this
>issue.
>I've followed the article on red hat titled "SSL certificate validation
>failure when attempting to register against RHN". One of the
>troubleshooting steps is to check the SSL certificate chain. Turns out
>I
>have a self-signed certificate in my chain which was causing
>verification
>issues.
>
>Anyone experiencing the same and have tips on how to resolve it?
>
>Kind regards,
>Francis
>
>On Tue, Jul 18, 2017 at 4:36 AM, Robert Paschedag
><robert.paschedag at web.de>
>wrote:
>
>> Am 17. Juli 2017 16:16:50 MESZ schrieb "Paschedag, Robert" <
>> paschedag.netlution at swr.de>:
>> >The credentials for the postgres db should be stored within
>> >/etc/rhn/rhn.conf on the satellite server.
>> >
>> >By default, this is
>> >
>> >User: rhnuser
>> >PW: rhnpw
>> >DB: rhnschema
>> >
>> >So..switching to user postgres
>> >
>> >Su – postgres
>> >
>> >And
>> >
>> >psql -U <user> -d <DB>
>> >
>> >and entering password should give you access.
>> >
>> >There is also a command to “set” the password
>> >
>> >
>> >
>> >
>> >Mit freundlichen Grüßen
>> >
>> >Robert Paschedag
>> >Netlution GmbH
>> >Landteilstr. 33
>> >68163 Mannheim
>> >
>> >im Auftrag des
>> >SWR
>> >Südwestrundfunk
>> >HA IT, Medientechnik und Programmverbreitung
>> >Neckarstraße 230
>> >70190 Stuttgart
>> >
>> >Telefon +49 (0)711 /929-12654 oder
>> >Telefon +49 (0)711 /929-13714
>> >paschedag.netlution at swr.de
>> >
>> >swr.de
>> >
>> >Von: spacewalk-list-bounces at redhat.com
>> >[mailto:spacewalk-list-bounces at redhat.com] Im Auftrag von Vipul
>Sharma
>> >(GDC)
>> >Gesendet: Montag, 17. Juli 2017 14:12
>> >An: Francis Lee Mondia <endace.francis.mondia at gmail.com>
>> >Cc: spacewalk-list at redhat.com
>> >Betreff: Re: [Spacewalk-list] Spacewalk 2.1 | SSL Certificate
>Invalid
>> >when using HTTPS for host registration
>> >
>> >Hey,
>> >Do you remember the password you used when creating the DB - Please
>try
>> >this password given below -
>> >
>> >Database - spaceschema
>> >
>> >Username - spaceuser
>> >
>> >Password - spacepw
>> >
>> >
>> >#psql DBNAME USERNAME
>> >
>> >On Mon, Jul 17, 2017 at 4:45 PM, Francis Lee Mondia
>>
>><endace.francis.mondia at gmail.com<mailto:endace.francis.mondia at gmail.com>>
>> >wrote:
>> >Hi Vipul,
>> >
>> >Yes, the service is running as evidenced by the output. The problem
>as
>> >shown in the error message was that postgres actually can't update
>or
>> >delete the table stated due to a foreign key constraint validation
>on a
>> >table.
>> >
>> >There's a post on the list about it and the recommendation was to
>> >remove it. Any ideas how to remove it from the DB? I'd actually like
>to
>> >log-in to postgres and delete this key being referenced (assuming I
>> >know the password for postgres).
>> >
>> >Kind regards,
>> >Francis
>> >
>> >On Mon, Jul 17, 2017 at 10:23 PM, Vipul Sharma (GDC)
>> ><sharma.vipul at in.g4s.com<mailto:sharma.vipul at in.g4s.com>> wrote:
>> >Hey,
>> >When you are running step 8 - Make sure spacewalk service is
>running,
>> >I'm hoping you've must have stopped the service. Service is
>important
>> >to push the data to postgres.
>> >Thanks
>> >    V
>> >
>> >On Mon, Jul 17, 2017 at 3:28 PM, Francis Lee Mondia
>>
>><endace.francis.mondia at gmail.com<mailto:endace.francis.mondia at gmail.com>>
>> >wrote:
>> >Hi Vipul,
>> >
>> >Thanks for the response.
>> >
>> >Still the same, I'm failing on step 8 on this guide
>>
>>(https://github.com/spacewalkproject/spacewalk/wiki/ChangeCaCert<https://
>>
>emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%
>> 2Fspacewalkproject%2Fspacewalk%2Fwiki%2FChangeCaCert&data=02%7C01%
>> 7CPaschedag.Netlution%40swr.de%7Cc7d92ced12154370d03a08d4cd0d31db%
>>
>7Cbcca095d88d442f88260cc216b81f62d%7C0%7C0%7C636358903948648506&sdata=
>> 6uTbKGUyx0DTFigKnfdy2kpc2bbLjoESTWBn%2BucL9to%3D&reserved=0>):
>> >
>> >[root at spw01 ~]# rhn-ssl-dbstore -vvv --ca-cert
>> >/root/ssl-build/RHN-ORG-TRUSTED-SSL-CERT
>> >Public CA SSL certificate:  /root/ssl-build/RHN-ORG-TRUSTED-SSL-CERT
>> >
>> >ERROR: unhandled exception occurred:
>> >Traceback (most recent call last):
>> >  File "/usr/bin/rhn-ssl-dbstore", line 43, in <module>
>> >    sys.exit(abs(mod.main() or 0))
>> >File
>> >"/usr/lib/python2.6/site-packages/spacewalk/satellite_
>> tools/rhn_ssl_dbstore.py",
>> >line 79, in main
>> >satCerts.store_rhnCryptoKey(values.label, values.ca_cert,
>> >verbosity=values.verbose)
>> >File
>>
>>"/usr/lib/python2.6/site-packages/spacewalk/satellite_tools/satCerts.py",
>> >line 673, in store_rhnCryptoKey
>> >    verbosity=verbosity)
>> >File
>>
>>"/usr/lib/python2.6/site-packages/spacewalk/satellite_tools/satCerts.py",
>> >line 614, in _checkCertMatch_rhnCryptoKey
>> >    h.execute(rhn_cryptokey_id=rhn_cryptokey_id)
>> >File
>>
>>"/usr/lib/python2.6/site-packages/spacewalk/server/rhnSQL/sql_base.py",
>> >line 153, in execute
>> >    return apply(self._execute_wrapper, (self._execute, ) + p, kw)
>> >File
>> >"/usr/lib/python2.6/site-packages/spacewalk/server/
>> rhnSQL/driver_postgresql.py",
>> >line 290, in _execute_wrapper
>> >    retval = apply(function, p, kw)
>> >File
>>
>>"/usr/lib/python2.6/site-packages/spacewalk/server/rhnSQL/sql_base.py",
>> >line 207, in _execute
>> >    return self._execute_(args, kwargs)
>> >File
>> >"/usr/lib/python2.6/site-packages/spacewalk/server/
>> rhnSQL/driver_postgresql.py",
>> >line 309, in _execute_
>> >    self._real_cursor.execute(self.sql, params)
>> >psycopg2.IntegrityError: update or delete on table "rhncryptokey"
>> >violates foreign key constraint "rhn_csssl_cacertid_fk" on table
>> >"rhncontentsourcessl"
>> >DETAIL:  Key (id)=(1) is still referenced from table
>> >"rhncontentsourcessl".
>> >
>> >
>> >I think the issue is because the server's RHNS-CA-CERT is expired. I
>> >found this
>> >[https://www.centos.org/forums/viewtopic.php?t=49388<h
>> ttps://emea01.safelinks.protection.outlook.com/?url=
>> https%3A%2F%2Fwww.centos.org%2Fforums%2Fviewtopic.php%3Ft%
>> 3D49388&data=02%7C01%7CPaschedag.Netlution%40swr.de%
>> 7Cc7d92ced12154370d03a08d4cd0d31db%7Cbcca095d88d442f88260cc216b81
>>
>f62d%7C0%7C0%7C636358903948648506&sdata=aahJV2c4U9lhprmcK0t105rV6DLA6G
>> b7frlWWQUciA0%3D&reserved=0>]
>> >but it's referencing a red hat article which is for RHEL 5.
>> >
>> >Where do I get an updated RHNS-CA-CERT?
>> >
>> >On Sun, Jul 16, 2017 at 10:53 AM, Vipul Sharma (GDC)
>> ><sharma.vipul at in.g4s.com<mailto:sharma.vipul at in.g4s.com>> wrote:
>> >I completely forgot one thing --
>> >
>> >In the above given command - --set-org-unit  should be same as
>> >--set-common-name. They should be the FQDN only.
>> >
>> >On Sun, Jul 16, 2017 at 4:20 AM, Vipul Sharma (GDC)
>> ><sharma.vipul at in.g4s.com<mailto:sharma.vipul at in.g4s.com>> wrote:
>> >Hi Francis,
>> >
>> >In order to configure Spacewalk successfully - Follow these steps -
>> >
>> >Make sure your Hostname & FQDN are same.
>> >
>> >ex - HOSTNAME =
>> >abc.abc.com<https://emea01.safelinks.protection.outlook.
>> com/?url=http%3A%2F%2Fabc.abc.com&data=02%7C01%7CPaschedag.
>> Netlution%40swr.de%7Cc7d92ced12154370d03a08d4cd0d31db%
>>
>7Cbcca095d88d442f88260cc216b81f62d%7C0%7C0%7C636358903948648506&sdata=
>> VkXU9aiUQv7Ozusm1hYoZjkjdtmNIe80keWpY3Lb9vw%3D&reserved=0>
>> >FQDN =
>> >abc.abc.com<https://emea01.safelinks.protection.outlook.
>> com/?url=http%3A%2F%2Fabc.abc.com&data=02%7C01%7CPaschedag.
>> Netlution%40swr.de%7Cc7d92ced12154370d03a08d4cd0d31db%
>>
>7Cbcca095d88d442f88260cc216b81f62d%7C0%7C0%7C636358903948658518&sdata=
>> Npd3Evj28Im5AkpcqdE3jYToagiDzUUOgxR3RTqHplI%3D&reserved=0>
>> >
>> >Now,
>> >
>> >Regenerate all the Certs & Keys --
>> >
>> >* First change the hostname to FQDN
>> >
>> >/usr/bin/rhn-ssl-tool --gen-ca --set-country="abc" 
>--set-state="abc"
>> >--set-city="abc" --set-org="abc"
>> >--set-org-unit="abc.com<https://emea01.safelinks.
>> protection.outlook.com/?url=http%3A%2F%2Fabc.com&data=02%
>>
>7C01%7CPaschedag.Netlution%40swr.de%7Cc7d92ced12154370d03a08d4cd0d31db%
>>
>7Cbcca095d88d442f88260cc216b81f62d%7C0%7C0%7C636358903948658518&sdata=
>> IeWBvGsEH7IoYaHm74tn8Y1r9YOUFcoVhYQYLEmsxdM%3D&reserved=0>"
>> >--set-common-name="abc"
>> >--set-email="admin.com<https://emea01.safelinks.protection.
>> outlook.com/?url=http%3A%2F%2Fadmin.com&data=02%7C01%
>> 7CPaschedag.Netlution%40swr.de%7Cc7d92ced12154370d03a08d4cd0d31db%
>>
>7Cbcca095d88d442f88260cc216b81f62d%7C0%7C0%7C636358903948658518&sdata=
>> Orc0yjfy2ky0BuNN1HXD6CKD1mLwtRnXtq7UFVONyT0%3D&reserved=0>"
>> >--force
>> >
>> >*To generate new web-server keys --
>> >
>> >/usr/bin/rhn-ssl-tool --gen-server --set-country="abc"
>> >--set-state="abc" --set-city="abc" --set-org="abc"
>> >--set-org-unit="abc.com<https://emea01.safelinks.
>> protection.outlook.com/?url=http%3A%2F%2Fabc.com&data=02%
>>
>7C01%7CPaschedag.Netlution%40swr.de%7Cc7d92ced12154370d03a08d4cd0d31db%
>>
>7Cbcca095d88d442f88260cc216b81f62d%7C0%7C0%7C636358903948658518&sdata=
>> IeWBvGsEH7IoYaHm74tn8Y1r9YOUFcoVhYQYLEmsxdM%3D&reserved=0>"
>> >--set-email="admin.com<https://emea01.safelinks.protection.
>> outlook.com/?url=http%3A%2F%2Fadmin.com&data=02%7C01%
>> 7CPaschedag.Netlution%40swr.de%7Cc7d92ced12154370d03a08d4cd0d31db%
>>
>7Cbcca095d88d442f88260cc216b81f62d%7C0%7C0%7C636358903948658518&sdata=
>> Orc0yjfy2ky0BuNN1HXD6CKD1mLwtRnXtq7UFVONyT0%3D&reserved=0>"
>> >
>> >*How to update the changes made to CA and web-server --
>> >
>>
>>https://github.com/spacewalkproject/spacewalk/wiki/ChangeCaCert<https://
>>
>emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%
>> 2Fspacewalkproject%2Fspacewalk%2Fwiki%2FChangeCaCert&data=02%7C01%
>> 7CPaschedag.Netlution%40swr.de%7Cc7d92ced12154370d03a08d4cd0d31db%
>>
>7Cbcca095d88d442f88260cc216b81f62d%7C0%7C0%7C636358903948658518&sdata=
>> uCijKeCu2h4oEINDB7vqfknIdpFPYndnFqVZ%2B5Cr2DA%3D&reserved=0>
>> >
>> >Thanks
>> >    V
>> >
>> >On Sun, Jul 16, 2017 at 2:00 AM, Francis Lee Mondia
>>
>><endace.francis.mondia at gmail.com<mailto:endace.francis.mondia at gmail.com>>
>> >wrote:
>> >Hi Michael,
>> >
>> >Thanks for the reply!
>> >
>> >On the following suggestions:
>> >1. Upgrade to latest version - definitely but I want to settle the
>SSL
>> >issue first (might just do this next week though if SSL isn't
>resolved)
>> >2. Spacewalk-hostname-rename
>> >- I've done this but haven't resolved the issue. Had to google how
>to
>> >install the certificate which led me to
>> >https://access.redhat.com/solutions/10809<https://
>> emea01.safelinks.protection.outlook.com/?url=https%3A%2F%
>> 2Faccess.redhat.com%2Fsolutions%2F10809&data=02%
>>
>7C01%7CPaschedag.Netlution%40swr.de%7Cc7d92ced12154370d03a08d4cd0d31db%
>>
>7Cbcca095d88d442f88260cc216b81f62d%7C0%7C0%7C636358903948658518&sdata=
>> kapJlAemcHWzc%2B3yMpcvzs2lq4JFZaR%2BmReUQpv%2FIdc%3D&reserved=0>
>> >-  Followed that guide in just installing the certificate (copying
>> >rpms, re-installing, etc)  but decided to do the the whole shebang
>> >instead after encountering the same issue
>> >- now I'm stuck with this:
>> >
>> >[root at spacewalkserver ~]# rhn-ssl-dbstore
>> >--ca-cert=/var/www/html/pub/RHN-ORG-TRUSTED-SSL-CERT -vvvvvvvv
>> >Public CA SSL certificate: 
>/var/www/html/pub/RHN-ORG-TRUSTED-SSL-CERT
>> >Nothing to do: certificate to be pushed matches certificate in
>> >database.
>> >Nothing to do: certificate to be pushed matches certificate in
>> >database.
>> >
>> >ERROR: unhandled exception occurred:
>> >Traceback (most recent call last):
>> >  File "/usr/bin/rhn-ssl-dbstore", line 43, in <module>
>> >    sys.exit(abs(mod.main() or 0))
>> >File
>> >"/usr/lib/python2.6/site-packages/spacewalk/satellite_
>> tools/rhn_ssl_dbstore.py",
>> >line 79, in main
>> >satCerts.store_rhnCryptoKey(values.label, values.ca_cert,
>> >verbosity=values.verbose)
>> >File
>>
>>"/usr/lib/python2.6/site-packages/spacewalk/satellite_tools/satCerts.py",
>> >line 673, in store_rhnCryptoKey
>> >    verbosity=verbosity)
>> >File
>>
>>"/usr/lib/python2.6/site-packages/spacewalk/satellite_tools/satCerts.py",
>> >line 614, in _checkCertMatch_rhnCryptoKey
>> >    h.execute(rhn_cryptokey_id=rhn_cryptokey_id)
>> >File
>>
>>"/usr/lib/python2.6/site-packages/spacewalk/server/rhnSQL/sql_base.py",
>> >line 153, in execute
>> >    return apply(self._execute_wrapper, (self._execute, ) + p, kw)
>> >File
>> >"/usr/lib/python2.6/site-packages/spacewalk/server/
>> rhnSQL/driver_postgresql.py",
>> >line 290, in _execute_wrapper
>> >    retval = apply(function, p, kw)
>> >File
>>
>>"/usr/lib/python2.6/site-packages/spacewalk/server/rhnSQL/sql_base.py",
>> >line 207, in _execute
>> >    return self._execute_(args, kwargs)
>> >File
>> >"/usr/lib/python2.6/site-packages/spacewalk/server/
>> rhnSQL/driver_postgresql.py",
>> >line 309, in _execute_
>> >    self._real_cursor.execute(self.sql, params)
>> >psycopg2.IntegrityError: update or delete on table "rhncryptokey"
>> >violates foreign key constraint "rhn_csssl_cacertid_fk" on table
>> >"rhncontentsourcessl"
>> >DETAIL:  Key (id)=(1) is still referenced from table
>> >"rhncontentsourcessl".
>> >
>> >
>> >- I've found this:
>> >[https://www.redhat.com/archives/spacewalk-list/2016-
>> January/msg00046.html<https://emea01.safelinks.protection.
>> outlook.com/?url=https%3A%2F%2Fwww.redhat.com%2Farchives%
>> 2Fspacewalk-list%2F2016-January%2Fmsg00046.html&data=
>>
>02%7C01%7CPaschedag.Netlution%40swr.de%7Cc7d92ced12154370d03a08d4cd0d31db%
>>
>7Cbcca095d88d442f88260cc216b81f62d%7C0%7C0%7C636358903948658518&sdata=
>> aObzHeFK8Cnmze6MkZeMTptWi%2BUK6CJyqvwRi8hBJkQ%3D&reserved=0>]
>> >which states I should remove the assignment first. THIS I DON'T KNOW
>> >HOW TO DO.
>> >- I think it's this
>> >[http://gatwards.org/techblog/replacing-spacewalk-ssl-certificates<
>> https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%
>> 2Fgatwards.org%2Ftechblog%2Freplacing-spacewalk-ssl-
>> certificates&data=02%7C01%7CPaschedag.Netlution%40swr.de%
>> 7Cc7d92ced12154370d03a08d4cd0d31db%7Cbcca095d88d442f88260cc216b81
>> f62d%7C0%7C0%7C636358903948658518&sdata=Nfw6HCtk99eotgWR%
>> 2Bsh5DxM0UUKUrh21Z3wOTH24kcQ%3D&reserved=0>]
>> >shows how to do it but I'm adamant to delete the only pair on it.
>I've
>> >deleted all expired certs before.
>> >
>> >Thanks in advance.
>> >
>> >Kind regards,
>> >Francis
>> >
>> >On Fri, Jul 14, 2017 at 11:35 PM, Michael Mraka
>> ><michael.mraka at redhat.com<mailto:michael.mraka at redhat.com>> wrote:
>> >Francis Lee Mondia:
>> >> Hi All,
>> >>
>> >> Sorry for this seemingly noob question but I'm new to spacewalk
>and
>> >just
>> >> inherited a system which was not being used for about 2 years and
>now
>> >I've
>> >> been tasked to revive it.
>> >
>> >Hi,
>> >
>> >First of all I'd suggest upgrade to latest Spacewalk (2.6) because
>> >there
>> >were a lot of bugs fixed since then (including security issues).
>> >
>> >> So I've got the system running, updated the channels, repos and
>now
>> >came
>> >> the process of re-adding hosts to the system. I was being shown
>the
>> >SSL
>> >> certicate error as I think the certificate has expired. I can
>> >register
>> >> hosts fine without SSL, and can push package updates to hosts fine
>> >without
>> >> it. I do want to resolve this though moving forward. I've tried
>the
>> >> numerous suggestions I can find (we have a red hat subscription so
>> >was able
>> >> to try their solutions too but none worked).
>> >
>> >Install spacewalk-utils package and run spacewalk-hostname-rename
>> >script.
>> >It will regenerate all SSL certs.
>> >
>> >> I'd also like to know though if upgrading spacewalk to a newer
>> >version
>> >> install a new SSL cert. When we first took a look at the system,
>we
>> >
>> >AFAIR upgrade will not change SSL certs.
>> >
>> >> couldn't log-in as the satellite certificate was expired and we
>had
>> >to
>> >> generate one from red hat support to be able to log back in.
>> >>
>> >> Hoping for some guidance on this from the community.
>> >>
>> >> Kind regards,
>> >> Francis
>> >
>> >Regards,
>> >
>> >
>> >--
>> >Michael Mráka
>> >System Management Engineering, Red Hat
>> >
>> >_______________________________________________
>> >Spacewalk-list mailing list
>> >Spacewalk-list at redhat.com<mailto:Spacewalk-list at redhat.com>
>> >https://www.redhat.com/mailman/listinfo/spacewalk-list<
>> https://emea01.safelinks.protection.outlook.com/?url=
>> https%3A%2F%2Fwww.redhat.com%2Fmailman%2Flistinfo%
>> 2Fspacewalk-list&data=02%7C01%7CPaschedag.Netlution%40swr.de%
>> 7Cc7d92ced12154370d03a08d4cd0d31db%7Cbcca095d88d442f88260cc216b81
>> f62d%7C0%7C0%7C636358903948658518&sdata=8wAw4%
>> 2BnmfT7kGNPIyFYDK64dBe3zs5vDIr8YFI%2BmS7c%3D&reserved=0>
>> >
>> >
>> >_______________________________________________
>> >Spacewalk-list mailing list
>> >Spacewalk-list at redhat.com<mailto:Spacewalk-list at redhat.com>
>> >https://www.redhat.com/mailman/listinfo/spacewalk-list<
>> https://emea01.safelinks.protection.outlook.com/?url=
>> https%3A%2F%2Fwww.redhat.com%2Fmailman%2Flistinfo%
>> 2Fspacewalk-list&data=02%7C01%7CPaschedag.Netlution%40swr.de%
>> 7Cc7d92ced12154370d03a08d4cd0d31db%7Cbcca095d88d442f88260cc216b81
>> f62d%7C0%7C0%7C636358903948658518&sdata=8wAw4%
>> 2BnmfT7kGNPIyFYDK64dBe3zs5vDIr8YFI%2BmS7c%3D&reserved=0>
>> >
>> >
>> >
>> >
>> >Please consider the environment before printing this email.
>>
>>*********************************************************************
>> >This communication may contain information which is confidential,
>> >personal and/or privileged. It is for the exclusive use of the
>intended
>> >recipient(s).
>> >If you are not the intended recipient(s), please note that any
>> >distribution, forwarding, copying or use of this communication or
>the
>> >information in it is strictly prohibited. If you have received it in
>> >error please contact the sender immediately by return e-mail. Please
>> >then delete the e-mail and any copies of it and do not use or
>disclose
>> >its contents to any person.
>> >Any personal views expressed in this e-mail are those of the
>individual
>> >sender and the company does not endorse or accept responsibility for
>> >them. Prior to taking any action based upon this e-mail message, you
>> >should seek appropriate confirmation of its authenticity.
>> >This message has been checked for viruses on behalf of the company.
>>
>>*********************************************************************
>> >
>> >
>> >
>> >
>> >Please consider the environment before printing this email.
>>
>>*********************************************************************
>> >This communication may contain information which is confidential,
>> >personal and/or privileged. It is for the exclusive use of the
>intended
>> >recipient(s).
>> >If you are not the intended recipient(s), please note that any
>> >distribution, forwarding, copying or use of this communication or
>the
>> >information in it is strictly prohibited. If you have received it in
>> >error please contact the sender immediately by return e-mail. Please
>> >then delete the e-mail and any copies of it and do not use or
>disclose
>> >its contents to any person.
>> >Any personal views expressed in this e-mail are those of the
>individual
>> >sender and the company does not endorse or accept responsibility for
>> >them. Prior to taking any action based upon this e-mail message, you
>> >should seek appropriate confirmation of its authenticity.
>> >This message has been checked for viruses on behalf of the company.
>>
>>*********************************************************************
>> >
>> >
>> >
>> >
>> >Please consider the environment before printing this email.
>>
>>*********************************************************************
>> >This communication may contain information which is confidential,
>> >personal and/or privileged. It is for the exclusive use of the
>intended
>> >recipient(s).
>> >If you are not the intended recipient(s), please note that any
>> >distribution, forwarding, copying or use of this communication or
>the
>> >information in it is strictly prohibited. If you have received it in
>> >error please contact the sender immediately by return e-mail. Please
>> >then delete the e-mail and any copies of it and do not use or
>disclose
>> >its contents to any person.
>> >Any personal views expressed in this e-mail are those of the
>individual
>> >sender and the company does not endorse or accept responsibility for
>> >them. Prior to taking any action based upon this e-mail message, you
>> >should seek appropriate confirmation of its authenticity.
>> >This message has been checked for viruses on behalf of the company.
>>
>>*********************************************************************
>>
>> But just another information. When you get a SSL error from the
>client,
>> then you have to check the SSL certificate on the "webserver"!
>>
>> Robert
>>

Also forgot...

Of course, you have to use the exact name that is stored within the server SSL cert (CN=<your server name>) in your client configs.

Robert