{"action":"closed","issue":{"url":"https://api.github.com/repos/dCache/dcache/issues/1898","labels_url":"https://api.github.com/repos/dCache/dcache/issues/1898/labels{/name}","comments_url":"https://api.github.com/repos/dCache/dcache/issues/1898/comments","events_url":"https://api.github.com/repos/dCache/dcache/issues/1898/events","html_url":"https://github.com/dCache/dcache/issues/1898","id":112012784,"number":1898,"title":"TLS fails with CANL and WebDAV for system-test","user":{"login":"paulmillar","id":533081,"avatar_url":"https://avatars.githubusercontent.com/u/533081?v=3","gravatar_id":"","url":"https://api.github.com/users/paulmillar","html_url":"https://github.com/paulmillar","followers_url":"https://api.github.com/users/paulmillar/followers","following_url":"https://api.github.com/users/paulmillar/following{/other_user}","gists_url":"https://api.github.com/users/paulmillar/gists{/gist_id}","starred_url":"https://api.github.com/users/paulmillar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paulmillar/subscriptions","organizations_url":"https://api.github.com/users/paulmillar/orgs","repos_url":"https://api.github.com/users/paulmillar/repos","events_url":"https://api.github.com/users/paulmillar/events{/privacy}","received_events_url":"https://api.github.com/users/paulmillar/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dCache/dcache/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-10-18T10:42:41Z","updated_at":"2015-11-22T11:14:47Z","closed_at":"2015-11-22T11:14:47Z","body":"After recent introduction of CANL for TLS/SSL, I am no longer able to upload files using TLS/SSL and curl.\r\n\r\nHere is my attempt to upload a file into system-test:\r\n\r\n    paul@sparkplug:~$ voms-proxy-info\r\n    subject   : /C=DE/O=GermanGrid/OU=DESY/CN=Alexander Paul Millar/CN=proxy\r\n    issuer    : /C=DE/O=GermanGrid/OU=DESY/CN=Alexander Paul Millar\r\n    identity  : /C=DE/O=GermanGrid/OU=DESY/CN=Alexander Paul Millar\r\n    type      : proxy\r\n    strength  : 1024 bits\r\n    path      : /tmp/x509up_u1000\r\n    timeleft  : 11:51:00\r\n    paul@sparkplug:~$ curl --insecure -E /tmp/x509up_u1000 -T /bin/bash https://localhost:2881/disk/test-1\r\n    curl: (35) Unknown SSL protocol error in connection to localhost:2881 \r\n    paul@sparkplug:~$ \r\n\r\nI've made a [network capture](https://desycloud.desy.de/public.php?service=files&t=1b890c1a48dc5f510f3afaa0b65a1df3) showing the interaction between the client and server.\r\n\r\nThere are several problems here:\r\n\r\n1. the connection fails -- obviously a problem, although it seems this is due to misconfiguration of system-test for my system.\r\n\r\n2. the server does not send the SSL alert frame indicating it is rejecting the connection -- I think the server should send such a frame -- otherwise the client cannot know why the connection has been rejected.\r\n\r\n3. nothing is logged at warn or info level: I think this merits something logged at info level.\r\n\r\n4. Switching on debug-level logging for pinboard, I see the following:\r\n\r\n\r\n        12:26:34 [jetty-992] [] javax.net.ssl.SSLHandshakeException: General SSLEngine problem\r\n            at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781) ~[na:1.8.0_66-internal]\r\n            at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) ~[na:1.8.0_66-internal]\r\n            at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:509) ~[jetty-io-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.server.HttpConnection.fillRequestBuffer(HttpConnection.java:315) [jetty-server-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:223) [jetty-server-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:245 [jetty-io-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:95) [jetty-io-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:192) [jetty-io-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:245) [jetty-io-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:95) [jetty-io-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.io.SelectChannelEndPoint$2.run(SelectChannelEndPoint.java:75) [jetty-io-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.produceAndRun(ExecuteProduceConsume.java:213) [jetty-util-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.run(ExecuteProduceConsume.java:147) [jetty-util-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:654) [jetty-util-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:572) [jetty-util-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            at java.lang.Thread.run(Thread.java:745) [na:1.8.0_66-internal]\r\n        Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem\r\n            at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.ServerHandshaker.clientCertificate(ServerHandshaker.java:1882) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:230) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.Handshaker$1.run(Handshaker.java:919) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.Handshaker$1.run(Handshaker.java:916) ~[na:1.8.0_66-internal]\r\n            at java.security.AccessController.doPrivileged(Native Method) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369) ~[na:1.8.0_66-internal]\r\n            at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:613) ~[jetty-io-9.3.3.v20150827.jar:9.3.3.v20150827]\r\n            ... 13 common frames omitted\r\n        Caused by: java.security.cert.CertificateException: The peer's certificate with subject's DN CN=proxy,CN=Alexander Paul Millar,OU=DESY,O=GermanGrid,C=DE was rejected. The peer's certificate status is: FAILED The following validation errors were found: error at position 1 in chain, problematic certificate subject: CN=Alexander Paul Millar,OU=DESY,O=GermanGrid,C=DE (category: CRL): No valid CRL was found for the CA which issued the chain Cause: No CRLs found for issuer \"CN=GridKa-CA, O=GermanGrid, C=DE\"\r\n            at eu.emi.security.authn.x509.helpers.ssl.SSLTrustManager.checkIfTrusted(SSLTrustManager.java:73) ~[canl-1.3.3.jar:1.3.3]\r\n            at eu.emi.security.authn.x509.helpers.ssl.SSLTrustManager.checkClientTrusted(SSLTrustManager.java:51) ~[canl-1.3.3.jar:1.3.3]\r\n            at sun.security.ssl.AbstractTrustManagerWrapper.checkClientTrusted(SSLContextImpl.java:929) ~[na:1.8.0_66-internal]\r\n            at sun.security.ssl.ServerHandshaker.clientCertificate(ServerHandshaker.java:1869) ~[na:1.8.0_66-internal]\r\n            ... 20 common frames omitted\r\n\r\n\r\nHere we log a stack-trace, therefore this is a bug.\r\n"}}