PatrickTingen
Member
On our 11.7 server we try to connect to an api that runs on another server, but we encounter this error:
Secure Socket Layer (SSL) failure. error code -54: self signed certificate
in certificate chain: for aff19c05.0 in c:\dlc11.7\certs (9318)
To resolve this, we opened a browser, navigated to the URI in question and exported the certificates (Lets Encrypt). Note: in chrome/edge the URI can be accessed without any issues. We then imported the root and the intermediate certificate to the local certificate store in c:\dlc11.7\certs. However, the problem remains.
We consulted our networking guy and he claims there is an error in OpenEdge that results in the wrong hash being generated, quote:
I have serious doubts regarding his conclusion, I cannot find any information on such a bug. We are on 11.7.20 witch is the latest v11
Secure Socket Layer (SSL) failure. error code -54: self signed certificate
in certificate chain: for aff19c05.0 in c:\dlc11.7\certs (9318)
To resolve this, we opened a browser, navigated to the URI in question and exported the certificates (Lets Encrypt). Note: in chrome/edge the URI can be accessed without any issues. We then imported the root and the intermediate certificate to the local certificate store in c:\dlc11.7\certs. However, the problem remains.
We consulted our networking guy and he claims there is an error in OpenEdge that results in the wrong hash being generated, quote:
So OE’s tooling registers the certificate under alias 4042bcee (the modern OpenSSL-style hash, SHA-1). But the runtime SSL-C resolver looks it up using the old MD5-style hash → aff19c05.0. Those two parts of Progress use a different hash algorithm. This is a real product bug in 11.7, not a configuration error on your side.
I have serious doubts regarding his conclusion, I cannot find any information on such a bug. We are on 11.7.20 witch is the latest v11