SSL client raises (9991) with certificate message

AppServer client connecting with SSL raises error (9991) with inner message similar to "The server domain <CN> was not in the server certificate subject field" when the same host has multiple host names.

Mar 7, 2016
Knowledge

Title

URL Name

SSL-client-raises-9991-with-certificate-message

Article Number

000118283

Environment

Product: OpenEdge Version: 10.x, 11.x OS: All Supported Platforms

Question/Problem Description

AppServer client connecting with SSL raises error (9991) with inner message similar to "The server domain <CN> was not in the server certificate subject field".

Different Common Names (CN) appear in inner message on different occasions.

Steps to Reproduce

Clarifying Information

Client may be ABL or OpenClient.

The IP address for the host is listed multiple times in the hosts file, each with a different host name. For example:

123.456.78.90 server1 server1.mydomain.com
123.456.78.90 alias1a alias1a.mydomain.com
123.456.78.90 alias1b alias1b.alt.mydomain.com
123.456.78.90 alias1c alias1c.mydomain.com

The Common Name in the server certificate (CN) is "server1.mydomain.com".

Error Message

NoAvailableSessions[AppServerS server authentication failed: The server domain ''''''''CN=alias1a..mydomain.com'''''''' was not in the server certificate subject field. (9991)]

Defect Number

Enhancement Number

Cause

OpenEdge verifies the host name against the Common Name listed in the certificate when making an SSL connection. In this case authentication error (9991) is raised for the alternate server names because they do not match the Common Name in the certificate.

Resolution

Use the No Host Verify connection parameter to bypass host verification.

From an ABL client:

Add "-nohostverify" as a parameter to the AppServer CONNECT statement. For example:

hServer:CONNECT ("-AppService MyAppService -H alias1a.mydomain.com -S 12345 -ssl -nohostverify", "myuserid", "mypassword") .

From a .NET Open Client:

Set the property in an application configuration file. The file should have any name with the extension ".config", and should look like the following example:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<appSettings>
<add key="PROGRESS.Session.NoHostVerify" value=TRUE />
</appSettings>
</configuration>

OR

Set the NoHostVerify property in the .NET language code using the setter in the Runtime Properties class, as in the following C# example:

RunTimeProperties.NoHostVerify = true;
Connection conn = new Connection("AppServerS://HostName:5162/asbroker1", "", "","");

From a Java Open Client:

Set the NoHostVerify on the command line with the "-D" parameter. For example:

-DPROGRESS.Session.noHostVerify = 1

OR

Set the NoHostVerify property in the Java code using the setter in the Runtime Properties class. For example:

RuntimeProperties.setNoHostVerify(TRUE); // set this *before* making the AppServer connection
conn = new Connection(url, "", "", "");

Workaround

Notes

OpenEdge does not support wildcard certificates or certificate alternate names.

References to Other Documentation:

OpenEdge Getting Started: Core Business Services - Security and Auditing, Chapter 6, "SSL in OpenEdge"
OpenEdge Deployment: Startup Command and Parameters Reference, Chapter 4, "Startup Parameter Descriptions > No Host Verify (-nohostverify)"
OpenEdge Development: ABL Reference, "Handle Attributes and Methods Reference > CONNECT() method (AppServer)
OpenEdge Development: .NET Open Clients
OpenEdge Development: Java Open Clients

Progress Articles:

Error with OE Authentication and SSL AppServer using wildcard certificate.

Keyword Phrase

Last Modified Date

3/15/2023 12:42 PM

SSL client raises (9991) with certificate message

Files(0)

Was this article helpful?

Was this article helpful?

SSL client raises (9991) with certificate message

Information

Related Articles