Bug 1437591

The PKI CLI could be modified to register an SSL socket listener so it can get the SSL alert from NSS and then show the actual error message to the user.

Upstream ticket:
https://pagure.io/dogtagpki/issue/2625

On 04/07/2017, edewata wrote:

* Fixed in master: 60f0adb9205d5c7d4d9294ca620530ff3df2000e

I see an expired certificate message but I still see the IOSocketException. Please confirm if this is expected.

[root@auto-hv-02-guest02 certdb]# pki -d . -c Secret123 -n CA_AdminE -h pki1.example.com -p 20080 ca-group-find
FATAL: SSL alert received: CERTIFICATE_EXPIRED
IOException: SocketException cannot write on socket
[root@auto-hv-02-guest02 certdb]# pki -v -d . -c Secret123 -n CA_AdminE -h pki1.example.com -p 20080 ca-group-find
PKI options: -v -d . -c Secret123
PKI command: CA_AdminE -n CA_AdminE -h pki1.example.com -p 20080 ca-group-find
Java command: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -Djava.ext.dirs=/usr/share/pki/lib -Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties com.netscape.cmstools.cli.MainCLI -d . -c Secret123 --verbose -n CA_AdminE -h pki1.example.com -p 20080 ca-group-find
Server URI: http://pki1.example.com:20080
Client security database: /root/multihost_tests/certdb/.
Message format: null
Command: ca-group-find
Initializing security database
Logging into security token
Module: ca
Initializing PKIClient
HTTP request: GET /pki/rest/info HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:20080
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 200 OK
  Server: Apache-Coyote/1.1
  Set-Cookie: JSESSIONID=10E86CA5AB43752E75697A644E0FBDB5; Path=/pki; HttpOnly
  Content-Type: application/xml
  Content-Length: 106
  Date: Fri, 19 May 2017 15:16:24 GMT
HTTP request: GET /ca/rest/account/login HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:20080
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
  Server: Apache-Coyote/1.1
  Cache-Control: private
  Expires: Wed, 31 Dec 1969 19:00:00 EST
  Location: https://pki1.example.com:20443/ca/rest/account/login
  Content-Length: 0
  Date: Fri, 19 May 2017 15:16:24 GMT
HTTP redirect: https://pki1.example.com:20443/ca/rest/account/login
Client certificate: CA_AdminE
HTTP request: GET /ca/rest/account/login HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:20443
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Server certificate: CN=pki1.example.com,OU=topology-02-CA,O=topology-02_Foobarmaster.org
FATAL: SSL alert received: CERTIFICATE_EXPIRED
javax.ws.rs.ProcessingException: Unable to invoke request
	at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:287)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:407)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:102)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
	at com.sun.proxy.$Proxy32.login(Unknown Source)
	at com.netscape.certsrv.account.AccountClient.login(AccountClient.java:45)
	at com.netscape.certsrv.client.SubsystemClient.login(SubsystemClient.java:47)
	at com.netscape.cmstools.cli.SubsystemCLI.login(SubsystemCLI.java:46)
	at com.netscape.cmstools.cli.SubsystemCLI.execute(SubsystemCLI.java:64)
	at com.netscape.cmstools.cli.CLI.execute(CLI.java:344)
	at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:628)
	at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:664)
Caused by: java.io.IOException: SocketException cannot write on socket
	at org.mozilla.jss.ssl.SSLSocket.write(SSLSocket.java:1496)
	at org.mozilla.jss.ssl.SSLOutputStream.write(SSLOutputStream.java:24)
	at org.apache.http.impl.io.AbstractSessionOutputBuffer.flushBuffer(AbstractSessionOutputBuffer.java:147)
	at org.apache.http.impl.io.AbstractSessionOutputBuffer.flush(AbstractSessionOutputBuffer.java:154)
	at org.apache.http.impl.AbstractHttpClientConnection.doFlush(AbstractHttpClientConnection.java:278)
	at org.apache.http.impl.AbstractHttpClientConnection.flush(AbstractHttpClientConnection.java:283)
	at org.apache.http.impl.conn.ManagedClientConnectionImpl.flush(ManagedClientConnectionImpl.java:175)
	at org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpRequestExecutor.java:260)
	at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:125)
	at org.apache.http.impl.client.DefaultRequestDirector.tryExecute(DefaultRequestDirector.java:715)
	at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:520)
	at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906)
	at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:805)
	at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:283)
	... 11 more
ERROR: Command '['/usr/lib/jvm/jre-1.8.0-openjdk/bin/java', '-Djava.ext.dirs=/usr/share/pki/lib', '-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties', 'com.netscape.cmstools.cli.MainCLI', '-d', '.', '-c', 'Secret123', '--verbose', '-n', 'CA_AdminE', '-h', 'pki1.example.com', '-p', '20080', 'ca-group-find']' returned non-zero exit status 255

Yes, this is the expected behavior.

The "FATAL: SSL alert received: CERTIFICATE_EXPIRED" message is a notification sent by the server through SSL alert mechanism.

The "IOException: SocketException cannot write on socket" message is the actual error encountered by the client when it tries to connect to the server with the expired certificate.

[root@auto-hv-02-guest02 certdb]# rpm -qi pki-ca
Name        : pki-ca
Version     : 10.4.1
Release     : 4.el7
Architecture: noarch
Install Date: Mon 15 May 2017 10:26:51 AM EDT
Group       : System Environment/Daemons
Size        : 2299431
License     : GPLv2
Signature   : (none)
Source RPM  : pki-core-10.4.1-4.el7.src.rpm
Build Date  : Tue 09 May 2017 09:23:16 PM EDT
Build Host  : ppc-021.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://pki.fedoraproject.org/
Summary     : Certificate System - Certificate Authority

Vertification steps in comment 6

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2110