SSL_HANDSHAKE_ERROR when trying to connect to irods server about davrods

[trel]

You say you can "run icommands inside davrods"...
can you confirm you're using the same /etc/apache2/irods/irods_environment.json file?

Is there a set of errors in the rodsLog on the iRODS server that can help?

[smoehrle]

Thanks for the fast response. For the icommands I used the irods_environment.json generated by iinit. For davrods I use the one which was provided. A quick swap of does two didn't solve the issue.

$ cat /root/.irods/irods_environment.json 
{
    "irods_host": "irods",
    "irods_port": 1247,
    "irods_user_name": "rods",
    "irods_zone_name": "zone_1"
}
$ cat /etc/apache2/irods/irods_environment.json 
{
    "irods_client_server_negotiation": "request_server_negotiation",
    "irods_client_server_policy": "CS_NEG_DONT_CARE",
    "irods_encryption_key_size": 32,
    "irods_encryption_salt_size": 8,
    "irods_encryption_num_hash_rounds": 16,
    "irods_encryption_algorithm": "AES-256-CBC",
    "irods_ssl_verify_server": "hostname"
}

The rodsLog on the iRODS server has the following entry. I havn't had time to investigate this further.

Feb 16 19:56:58 pid:614 remote addresses: 172.21.0.2, 172.21.0.4 ERROR: sslInit: couldn't read certificate chain file. SSL error: error:02001002:system library:fopen:No such file or directory
Feb 16 19:56:58 pid:614 remote addresses: 172.21.0.2, 172.21.0.4 ERROR: sslInit: couldn't read certificate chain file. SSL error: error:20074002:BIO routines:file_ctrl:system lib
Feb 16 19:56:58 pid:614 remote addresses: 172.21.0.2, 172.21.0.4 ERROR: sslInit: couldn't read certificate chain file. SSL error: error:140DC002:SSL routines:use_certificate_chain_file:system lib
Feb 16 19:56:58 pid:614 remote addresses: 172.21.0.2, 172.21.0.4 ERROR: [-]	/repos/irods/server/core/src/rodsAgent.cpp:556:int runIrodsAgentFactory(sockaddr_un) :  status [SSL_INIT_ERROR]  errno [] -- message [failed to call 'agent start']
	[-]	/repos/irods/lib/core/src/sockComm.cpp:129:irods::error sockAgentStart(irods::network_object_ptr) :  status [SSL_INIT_ERROR]  errno [] -- message [failed to call 'agent start']
		[-]	/repos/irods/plugins/network/ssl/libssl.cpp:827:irods::error ssl_agent_start(irods::plugin_context &) :  status [SSL_INIT_ERROR]  errno [] -- message [couldn't initialize SSL context]

Feb 16 19:56:58 pid:70  ERROR: Agent process [614] exited with status [16]

[trel]

Okay, the SSL error is quite clear in those logs. If you've got SSL CS_NEG_REQUIRE set somewhere, and the certs aren't available, then this is the problem. I expect this is a configuration issue between davrods and the iRODS server... especially since you say that iinit worked (without using the davrods credentials or environment file).

[smoehrle]

Hey,

took me a while to get back on this, but I found the issue. Both sides had CS_NEG_DONT_CARE configured.

• iRODS server in /etc/irods/core.re
• davrods in /etc/apache2/irods/irods_environment.json

Changing one of does to CS_NEG_REFUSE disabled SSL and now its working

[trel]

Ah, very good. Glad you figured it out.