topic Re: Webhook - HTTPS error "Certificate Unknown" in Endpoint Security

Webhook - HTTPS error "Certificate Unknown"

nabalaji — Tue, 08 Sep 2020 19:02:02 GMT

We are integrating meraki with another application which acts as web server. SSL certificate configured in application webserver. Certificated has been signed and issued by authorized CA

1. Webhook configured towards application webserver in Meraki

2. When we click "send test webhooks" from Meraki GUI it shows "failed" whereas in application server side below error reported,

Traceback (most recent call last):
File "/usr/lib64/python2.7/SocketServer.py", line 295, in _handle_request_noblock
self.process_request(request, client_address)
File "/usr/lib64/python2.7/SocketServer.py", line 321, in process_request
self.finish_request(request, client_address)
File "/usr/lib64/python2.7/SocketServer.py", line 334, in finish_request
self.RequestHandlerClass(request, client_address, self)
File "/usr/lib64/python2.7/SocketServer.py", line 649, in __init__
self.handle()
File "/usr/lib64/python2.7/BaseHTTPServer.py", line 340, in handle
self.handle_one_request()
File "/usr/lib64/python2.7/BaseHTTPServer.py", line 310, in handle_one_request
self.raw_requestline = self.rfile.readline(65537)
File "/usr/lib64/python2.7/socket.py", line 476, in readline
data = self._sock.recv(self._rbufsize)
Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert certificate unknown'), ('SSL routines', 'ssl23_read', 'ssl handshake failure')]

3. TCPDUMP shows Meraki responds backs "Certificate Unknown (46)" for "Server Hello, Certificate, Server Hello Done".

Questions,

1. How Meraki differentiates Known and unknown certificates?

2. Do we need add webserver certificates in Meraki?

Re: Webhook - HTTPS error "Certificate Unknown"

Philip D'Ath — Tue, 08 Sep 2020 20:50:28 GMT

Have you checked which certificate you are presenting? It's definitely the public certificate you have bought?

Can you point your web browser at your server and get it to connect with no TLS errors?

Is your server presenting a correct chain of certificates?

Re: Webhook - HTTPS error "Certificate Unknown"

nabalaji — Wed, 23 Sep 2020 14:34:19 GMT

@Philip D'Ath Thanks for response.

Sorry for the late update on this thread.

The issue turned out to be one of the intermediate certificates was not issued by Global CA. So we created the entire chain of certificates again with proper Global CA and it resolved the issue.

Suggestions:

1. Ensure certificates are issued by Global CA.

2. If there are multiple chain of certificates then present all chain of certificates until root (server certificates + Intermediate certificates + root certificates) while connecting to Meraki.