Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 51 replies
  • Answers 1 answer
  • Subscribers 14 subscribers
  • Views 69044 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failed to get SSL certificate | Cannot verify peer's SSL certificate, unknown CA | Caught Empty IOR string from iiopAddressesInIOR

Maros Goc

Hello, I have a couple of servers which on the one hand have Sophos AV fully working, but on the other one they cannot be seen in SEC (Sophos Enterprise Console). After some investigations I found in logs this:

28.06.2018 11:58:47 1E04 W Failed to get certificate, retrying in 600 seconds
28.06.2018 12:08:47 1E04 I Getting parent router IOR from 10.183.173.88:8192
28.06.2018 12:08:47 1E04 I Getting a new router certificate...
28.06.2018 12:09:29 1E04 E Router::GetCertificate: Caught CORBA system exception, ID 'IDL:omg.org/CORBA/TRANSIENT:1.0'
OMG minor code (2), described as '*unknown description*', completed = NO

28.06.2018 12:20:11 1E04 W Failed to get certificate, retrying in 600 seconds
28.06.2018 12:30:11 1E04 I Getting parent router IOR from 10.183.173.88:8192
28.06.2018 12:30:11 1E04 I Getting a new router certificate...
28.06.2018 12:32:39 1E04 W SSL connection alert, peer address 10.183.173.88
28.06.2018 12:32:39 1E04 W Cannot verify peer's SSL certificate, unknown CA
28.06.2018 12:32:39 1E04 E Router::ReportInvalidCertificate: Caught Empty IOR string from iiopAddressesInIOR
28.06.2018 12:32:39 1E04 I This computer is part of the domain EU
28.06.2018 12:32:39 1E04 E ACE_SSL (7964|7684) error code: 336134278 - error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
28.06.2018 12:33:00 1E04 E Router::GetCertificate: Caught CORBA system exception, ID 'IDL:omg.org/CORBA/TRANSIENT:1.0'
OMG minor code (2), described as '*unknown description*', completed = NO

Then I read through several articles and forums which raised some questions for which I couldnt have been able to find answers yet.

1.) How are "ParentAddress" and "ParentPort" (found in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\Messaging System\Router) related to the IOR port?

2.) What is "http://www2.parc.com/istl/projects/ILU/parseIOR/" used for? I tried to get there IOR but then the page said "Your IOR is misformed. It must begin with either "IOR:" or "IOR2:", and then have an even number of hex digits." It seems as if the IOR wasnt correct.

3.) There are "pkc" and "pkp" missing under HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\Remote Management System\ManagementAgent\Private which should be crucial for a server . How I can get "pkc" and "pkp" back? (There is also no NotifyClientUpdate infound in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\Messaging System\Router)

4.) All the necessary ports (80,8192,8194) are opened. I can telnet the destination point without a problem. IOR is shown when telneting 8192. How come the router catching empty IOR string then?

5.) Finally. How can it be this whole issue fixed? I won't be able to do it without someone's help.

I would be realy greatful if someone knew what to do, because I have already ran out of all ideas. Thank you.



This thread was automatically locked due to age.
  • 0 in reply to QC

    Hi,

    I am back at work so I tried to the openssl thing, which i dont know if i managed to do it correctly, but his is the result:

     

    I tried the same thing on the server with no Sophos problem and it returned 0, so I guess i managed to do it correctly. But in both cases there is "9072:error:02001002:system library:.." which I dont know what it means.

  • 0 in reply to Maros Goc

    Hello Maros Goc,

    0.9.8r is outdated (the "oldest current" available at this site), please should use a newer version (note that they are alphabetically sorted and the newset are at the bottom).

    Christian

  • 0 in reply to QC

    Hi Christian,

    this is the result.

  • 0 in reply to Maros Goc

    Hello Maros Goc,

    the fopen() error suggests that you did not put cac.pem into the \openssl...-win64\ folder.
    Doesn't matter though as apparently it can't connect to the specified address/port at all. If this 10.x.x.12 is indeed the host return in the IOR string I wonder why the connection doesn't succeed.

    To make sure: telnet to the same address and port does connect? Normally I'd use Wireshark to verify that no connection is established but this is probably not an option for you. I mention it because in a post from a recent thread it seemed that telnet didn't return an error even though it simply timed out and failed to connect.

    Christian   

  • 0 in reply to QC

    Hi,

    telneting 80, 8192 ad 8194 works absolutely fine.

    This is how it looks after cac.pem was placed in the right directory.

  • 0 in reply to Maros Goc

    Hello Maros Goc,

    8194 works absolutely fine
    I don't think so but I might be wrong. What's the output if you try s_client -connect 127.0.0.1:8194? Dunno if the local Router is already in the state to answer requests but it's worth a try.

    Christian

  • 0 in reply to QC

    The result was the same as above.

  • 0 in reply to Maros Goc

    Hello Maros Goc,

    might be that the Router does not yet listen.

    Well, there's a small utility from Microsoft which should give a definite answer whether you can connect to the server's 8194: PortQry.exe.

    Christian

  • 0 in reply to QC

    Hi,

    it seems it is not supported when it comes to Windows Server 2008 R2, thus it cannot be ran :(

  • 0 in reply to Maros Goc

    Hello Maros Goc,

    not supported when it comes to Windows Server 2008 R2
    you mean:

    Applies to: Microsoft Windows Server 2003 Standard Edition (32-bit x86)Microsoft Windows Server 2003 Enterprise Edition (32-bit x86)Microsoft Windows XP Home Edition More

    ? Did you click more?

    Applies to: Microsoft Windows Server 2003 Standard Edition (32-bit x86)Microsoft Windows Server 2003 Enterprise Edition (32-bit x86)Microsoft Windows XP Home EditionMicrosoft Windows XP ProfessionalWindows Server 2008 StandardWindows Server 2008 EnterpriseWindows Server 2008 R2 StandardWindows Server 2008 R2 EnterpriseWindows Server 2012 StandardWindows Server 2012 StandardWindows Server 2012 R2 StandardWindows Server 2012 R2 DatacenterWindows Server 2012 DatacenterWindows Server 2012 DatacenterWindows 8.1 EnterpriseWindows 8 EnterpriseWindows 10, version 1607Windows 10, version 1511

    Christian

Unfiltered HTML