SSL errors (secure provisioning issues)

Dan Lukes · ‎05-08-2014

Provisioning or XML address book may be configured to use SSL (HTTPS) connection. Such secure connection may fail for some reason. For the purpose of debugging, you need to turn on debug messages, level 3 or more. Debug messages will look like the following:

local3.debug | [create_tcp_netstrm1] use async to create tcp connection
local3.debug | connect succeed   
local3.debug | [create_tcp_netstrm1] connect SUCCEED
local3.debug | ssl cert err 20   
local3.debug | create ssl connection failed

The "ssl cert err N" show the SSL error and reveal the cause for failed SSL connection.

The following table summarise possible N values, their names and (in some cases) a description of it. The list of possible error and their names has been taken from OpenSSL sources (x509_vfy.h). Descriptions are mine.

N	Name	Description
0	X509_V_OK
2	X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT
3	X509_V_ERR_UNABLE_TO_GET_CRL
4	X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE
5	X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE
6	X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY
7	X509_V_ERR_CERT_SIGNATURE_FAILURE	mostly because of unsupported certificate hash alghoritm. Use SHA1 or MD5 only
8	X509_V_ERR_CRL_SIGNATURE_FAILURE
9	X509_V_ERR_CERT_NOT_YET_VALID	certificate not valid yet - check time on phone
10	X509_V_ERR_CERT_HAS_EXPIRED	certificate expired - check time on phone
11	X509_V_ERR_CRL_NOT_YET_VALID
12	X509_V_ERR_CRL_HAS_EXPIRED
13	X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD
14	X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD
15	X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD
16	X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD
17	X509_V_ERR_OUT_OF_MEM
18	X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT
19	X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN	self signed certificate not recognized as trusted
20	X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY	chain root certificate not recognized as trusted or intermediate certificate not supplied by SSL server
21	X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE
22	X509_V_ERR_CERT_CHAIN_TOO_LONG
23	X509_V_ERR_CERT_REVOKED
24	X509_V_ERR_INVALID_CA
25	X509_V_ERR_PATH_LENGTH_EXCEEDED
26	X509_V_ERR_INVALID_PURPOSE
27	X509_V_ERR_CERT_UNTRUSTED
28	X509_V_ERR_CERT_REJECTED
29	X509_V_ERR_SUBJECT_ISSUER_MISMATCH
30	X509_V_ERR_AKID_SKID_MISMATCH
31	X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH
32	X509_V_ERR_KEYUSAGE_NO_CERTSIGN
33	X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER
34	X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION
35	X509_V_ERR_KEYUSAGE_NO_CRL_SIGN
36	X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION
37	X509_V_ERR_INVALID_NON_CA
38	X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED
39	X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE
40	X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED
41	X509_V_ERR_INVALID_EXTENSION
42	X509_V_ERR_INVALID_POLICY_EXTENSION
43	X509_V_ERR_NO_EXPLICIT_POLICY
44	X509_V_ERR_DIFFERENT_CRL_SCOPE
45	X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE
46	X509_V_ERR_UNNESTED_RESOURCE
47	X509_V_ERR_PERMITTED_VIOLATION
48	X509_V_ERR_EXCLUDED_VIOLATION
49	X509_V_ERR_SUBTREE_MINMAX
50	X509_V_ERR_APPLICATION_VERIFICATION
51	X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE
52	X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX
53	X509_V_ERR_UNSUPPORTED_NAME_SYNTAX
54	X509_V_ERR_CRL_PATH_VALIDATION_ERROR

Notes:

Certificate used by SSL connection needs to be issued by an authority preconfigured in phone by Cisco (see SPA Certificate Authority (CA) List for more information). With firmware >=7.5.1 a certificate authority configured via "Custom CA Rule" option can be used as well (see Administrator's guide for more informations).
SPA[35]xx accepts certificates even they are expired or not valid yet. SPA[12]xx ATA devices with firmware < 1.3.2 ignore verification result at all, any certificate is considered valid.