Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Next challenges

Recent achievements

  • Global
  • Personal

Recognition

  • Give kudos
  • Received
  • Given

Leaderboard

  • Global

Trophy case

Kudos (beta program)

Kudos logo

You've been invited into the Kudos (beta program) private group. Chat with others in the program, or give feedback to Atlassian.

View group

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Crowd Apache Connector (mod_authnz_crowd) fails when using https with self signed certificates

I ran into this problem today and wasted many hours debugging & fixing so I thought I would share with the community..

The issue:

when using self signed certificates for SSL, the apache mod_authnz_crowd module (Crowd Apache Connector) rejects the certificate regardless of configuration on the crowd server.

The symptoms:

when setting CrowdURL to a https value in apache you will receive a 500 error through the browser, looking in the apache error_log you will see: "Failed to send authentication request (CURLcode 60)" - this is returned by the CURL library that the module uses to make its connection, and error code 60 from the CURL library can be found here http://curl.haxx.se/libcurl/c/libcurl-errors.html<br< a=""> />
CURLE_SSL_CACERT (60) - Peer certificate cannot be authenticated with known CA certificates.

A quick look at the CURL manual (
http://curl.haxx.se/libcurl/c/curl_easy_setopt.html#CURLOPTSSLVERIFYPEER) reveals: This option determines whether curl verifies the authenticity of the peer's certificate. A value of 1 means curl verifies; 0 (zero) means it doesn't.

The Solution:

Download the source code for mod_authnz_crowd from https://studio.plugins.atlassian.com/svn/CWDAPACHE/tags/2.0.2/ and apply the following patch

--- src/crowd_client.orig    2011-07-29 15:44:46.000000000 +0800
+++ src/crowd_client.c 2011-07-29 15:33:29.000000000 +0800
@@ -517,6 +517,7 @@
#endif
|| curl_easy_setopt(curl_easy, CURLOPT_HTTPHEADER, headers)
|| curl_easy_setopt(curl_easy, CURLOPT_TIMEOUT, config->crowd_timeout)
+ || curl_easy_setopt(curl_easy, CURLOPT_SSL_VERIFYPEER, 0)
|| (post && (curl_easy_setopt(curl_easy, CURLOPT_POST, 1)
|| curl_easy_setopt(curl_easy, CURLOPT_READFUNCTION, read_crowd_authentication_request)
|| curl_easy_setopt(curl_easy, CURLOPT_READDATA, &read_data)

recompile the module, install over the old one in apache and self signed certificates in crowd are no longer a problem!

shame on you atlassian for not even documenting that we cannot use self signed certificates with this module!

2 answers

1 accepted

0 votes
Answer accepted

See above.

Hi Jordan,

I too agree that Atlassian hasn't documented well on Connectors for Windows. Which C compiler you used to compile the source. Can you just share this information how you went about generating a connector from the C source. This will too helpful for others who are following the compilation path to generate connectors.

Thanks and Regards,

Anantha

Anantha,

I'm doubt mod_authnz_crowd will compile on Windows - it is an apache module that depends on unix/linux development libraries.

I use GCC - the default linux compiler package and related development packages (autoconf etc..)

I actually compiled the package directly to an RPM using the spec file provided by atlassian at https://studio.plugins.atlassian.com/svn/CWDAPACHE/tags/2.0.2/packages/mod_authnz_crowd.spec but the package does include its own Makefile so you could run it through autoconf/make/gcc yourself.

Since the underlying mechanism to authenticate of the peer's certificate is CURL, you can get around the issue by updating the certificate bundle that CURL uses with your self-signed certificate. You do not need to apply any patches by doing this.

In RedHat Linux, the file and location is: /etc/pki/tls/certs/ca-bundle.crt

(Note: You will need root privileges to update the file as it is owned by root.)

Steps to import your self-signed certificate into the certificate bundle.

1. Export your certificate into a file and store it as Base-64 X.509.

2. On the linux host, use the following command to import the certificate.

$ openssl x509 -in ./your_certificate -text >> /etc/pki/tls/certs/ca-bundle.crt

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Data Center

Introducing Data Center Community licenses

I'm Alison Huselid, Head of Product for Data Center at Atlassian. As we shared in our last post, we’ve been working on a solution for those of you who work for charitable non-profit organizations tha...

770 views 10 45
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you