In some code dealing with paypal callbacks, I have the following line:
set result [ns_httpspost $webscr "" $qsset]
on my dev server, with aolserver40r10 and ns_openssl (from cvs head) it
works fine.
On my production server, with aolserver and nsopenssl compiled from
exactly the same file versions, I get the following error:
failed to use either named or default client SSL context
while executing
"ns_openssl_sockopen -nonblock $host $port"
(procedure "ns_httpsopen" line 42)
invoked from within
"ns_httpsopen POST $url $rqset $timeout $querystring"
(procedure "ns_httpspost" line 124)
invoked from within
"ns_httpspost $webscr "" $qsset"
I am using exactly the same config file and certs in both cases (and
based on the openacs default). For you reference the relevant section
is below.
Can anyone shed some light onto this? As far as I can see, the defaults
are set up correctly. The fact that it works with the same config and
versions on a different server doesn't help my sanity!
#---------------------------------------------------------------------
# OpenSSL for Aolserver 4
#---------------------------------------------------------------------
ns_section "ns/server/${server}/module/nsopenssl"
# Note this portion of the configuration is not perfect, and you
# will get errors in the your error.log. However, it does
# work. Fixes welcome.
# this is used by acs-tcl/tcl/security-procs.tcl to get the
# https port.
ns_param ServerPort $httpsport
# We explicitly tell the server which SSL contexts to use as
defaults when an
# SSL context is not specified for a particular client or server SSL
# connection. Driver connections do not use defaults; they must be
explicitly
# specificied in the driver section. The Tcl API will use the
defaults as there
# is currently no provision to specify which SSL context to use for
a
# particular connection via an ns_openssl Tcl command.
ns_section "ns/server/${server}/module/nsopenssl/sslcontexts"
ns_param users "SSL context used for regular user access"
# ns_param admins "SSL context used for administrator
access"
ns_param client "SSL context used for outgoing script
socket connections"
ns_section "ns/server/${server}/module/nsopenssl/defaults"
ns_param server users
ns_param client client
ns_section "ns/server/${server}/module/nsopenssl/sslcontext/users"
ns_param Role server
ns_param ModuleDir ${serverroot}/etc/certs
ns_param CertFile certfile.pem
ns_param KeyFile keyfile.pem
# ns_param CADir ca-client/dir
# ns_param CAFile ca-client/ca-client.crt
# for Protocols "ALL" = "SSLv2, SSLv3, TLSv1"
ns_param Protocols "SSLv3, TLSv1"
ns_param CipherSuite
"ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"
ns_param PeerVerify false
ns_param PeerVerifyDepth 3
ns_param Trace false
# following from bartt's nsd4.tcl, might help stablize openssl
connections?
#
http://www.mail-archive.com/[email protected]/msg07092.html
ns_param SessionCache true
ns_param SessionCacheID 1
ns_param SessionCacheSize 512
ns_param SessionCacheTimeout 300
# ns_section "ns/server/${server}/module/nsopenssl/sslcontext/admins"
# ns_param Role server
# ns_param ModuleDir /path/to/dir
# ns_param CertFile server/server.crt
# ns_param KeyFile server/server.key
# ns_param CADir ca-client/dir
# ns_param CAFile ca-client/ca-client.crt
# for Protocols "ALL" = "SSLv2, SSLv3, TLSv1"
# ns_param Protocols "All"
# ns_param CipherSuite
"ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"
# ns_param PeerVerify false
# ns_param PeerVerifyDepth 3
# ns_param Trace false
ns_section "ns/server/${server}/module/nsopenssl/sslcontext/client"
ns_param Role client
ns_param ModuleDir ${serverroot}/etc/certs
ns_param CertFile certfile.pem
ns_param KeyFile keyfile.pem
# ns_param CADir ${serverroot}/etc/certs
# ns_param CAFile certfile.pem
# for Protocols "ALL" = "SSLv2, SSLv3, TLSv1"
ns_param Protocols "SSLv2, SSLv3, TLSv1"
ns_param CipherSuite
"ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"
ns_param PeerVerify false
ns_param PeerVerifyDepth 3
ns_param Trace false
# following from bartt's nsd4.tcl, might help stablize openssl
connections?
#
http://www.mail-archive.com/[email protected]/msg07092.html
ns_param SessionCache true
ns_param SessionCacheID 1
ns_param SessionCacheSize 512
ns_param SessionCacheTimeout 300
# SSL drivers. Each driver defines a port to listen on and an
explitictly named
# SSL context to associate with it. Note that you can now have
multiple driver
# connections within a single virtual server, which can be tied to
different
# SSL contexts.
ns_section "ns/server/${server}/module/nsopenssl/ssldrivers"
ns_param users "Driver for regular user access"
# ns_param admins "Driver for administrator access"
ns_section "ns/server/${server}/module/nsopenssl/ssldriver/users"
ns_param sslcontext users
# ns_param port $httpsport_users
ns_param port $httpsport
ns_param hostname $hostname
ns_param address $address
# following added per
#
http://www.mail-archive.com/[email protected]/msg07365.html
# Maximum File Size for uploads:
ns_param maxinput [expr 5 * 1024 * 1024] ;# in bytes
# Maximum request time
ns_param recvwait [expr 5 * 60] ;# in minutes
# ns_section "ns/server/${server}/module/nsopenssl/ssldriver/admins"
# ns_param sslcontext admins
# ns_param port $httpsport_admins
# ns_param port $httpsport
# ns_param hostname $hostname
# ns_param address $address
--
Mark Aufflick
e: [EMAIL PROTECTED]
w: www.pumptheory.com (business)
w: mark.aufflick.com (personal)
p: +61 438 700 647
f: +61 2 9436 4737
========================================================================
iBurst Wireless Broadband from $34.95/month www.platformnetworks.net
Forward undetected SPAM to: [EMAIL PROTECTED]
========================================================================
--
AOLserver - http://www.aolserver.com/
To Remove yourself from this list, simply send an email to <[EMAIL PROTECTED]>
with the
body of "SIGNOFF AOLSERVER" in the email message. You can leave the Subject:
field of your email blank.
