{"action":"created","issue":{"url":"https://api.github.com/repos/networkupstools/nut/issues/246","labels_url":"https://api.github.com/repos/networkupstools/nut/issues/246/labels{/name}","comments_url":"https://api.github.com/repos/networkupstools/nut/issues/246/comments","events_url":"https://api.github.com/repos/networkupstools/nut/issues/246/events","html_url":"https://github.com/networkupstools/nut/issues/246","id":120891393,"number":246,"title":"Securing connections with SSL not working on Solaris 10 x86","user":{"login":"tmcneill30","id":16198099,"avatar_url":"https://avatars.githubusercontent.com/u/16198099?v=3","gravatar_id":"","url":"https://api.github.com/users/tmcneill30","html_url":"https://github.com/tmcneill30","followers_url":"https://api.github.com/users/tmcneill30/followers","following_url":"https://api.github.com/users/tmcneill30/following{/other_user}","gists_url":"https://api.github.com/users/tmcneill30/gists{/gist_id}","starred_url":"https://api.github.com/users/tmcneill30/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tmcneill30/subscriptions","organizations_url":"https://api.github.com/users/tmcneill30/orgs","repos_url":"https://api.github.com/users/tmcneill30/repos","events_url":"https://api.github.com/users/tmcneill30/events{/privacy}","received_events_url":"https://api.github.com/users/tmcneill30/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/networkupstools/nut/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":38,"created_at":"2015-12-07T23:10:48Z","updated_at":"2016-01-23T18:45:06Z","closed_at":null,"body":"I have compiled versions 2.6.5, 2.7.1 & 2.7.3 and have been unable to implement ssl encryption between upsd and the other processes such as upsmon etc on Solaris 10.  \r\n\r\nMy target machine and build server are running Solaris 10/08 running in 32 bit mode.  Both servers are recently patched.  All other nut functionality is working fine on target server.  I am compiling with gcc, gmake, etc.  \r\n\r\nMy configure command is:\r\n./configure  --with-ssl --with-openssl --with-wrap --with-logfacility=LOG_DAEMON --with-openss\r\nl-includes=-I/usr/include:/usr/local/ssl/include/openssl -with-openssl-libs='-L/usr/lib:/usr/s\r\nfw/lib:/usr/local/ssl/lib -lssl -lcrypto' --with-group=ups --with-user=root  --with-snmp-libs=\r\n/usr/sfw/lib --with-snmp=no --with-usb=no\r\n \r\nmake && make install\r\n\r\nConfigure reports that all ssl libraries are found.  /usr/local/ssl contains a build of openssl 1.0.1p.  My openssl was used to create the certificate and works well with other packages I have on the system such as ntp and ssh.\r\n\r\nI have followed the instructions in the documentation in section 9.5 \"Configuring SSL\".  I  created upsd.pem and a certificate using instructions in documentation.\r\n\r\nI changed the following configuration entries\r\nupsd.conf: CERTFILE /usr/local/ups/etc/upsd.pem\r\nupsmon.conf: CERTPATH /usr/local/ups/etc/certs\r\nupsmon.conf: FORCESSL 1\r\n\r\nI also compiled and made a 2.7.3 and 2.7.1 nut package for RHEL 6.  When I change above config settings and use the exact same cert and key, the upsmon to upsd connection is encrypted!! I verified this thru packet sniffing and upmon itself now states it is using ssl. So I know my Solaris problem is not with the certficate files nor with my understanding of how to configure NUT.\r\n\r\nldd on upsd on rhel6 and solaris both list ssl shared objects as dependencies. \r\n\r\nupsmon and upsd debugging show that upsmon says hello and upsd does not understand the hello.  It should say hello back and then send its certificate.  This occurs on RHEL6 but the ssl handshake fails immediately on Solaris 10/08.\r\n\r\nUPS: power0@localhost (master) (power value 1)\r\n   0.000207     UPS: ups0@localhost (master) (power value 1)\r\n   0.000572     Using power down flag file /var/state/ups/killpower\r\n   0.001068     debug level is '2'\r\n   0.008958     Trying to connect to UPS [power0@localhost]\r\n   0.011489     SSL_connect do not accept handshake.: Error 0\r\n   0.011585     ssl_error() EOF from client\r\n   0.011617     Can not connect to localhost in SSL, disconnect\r\n   0.011825     UPS [power0@localhost]: connect failed: SSL error: error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure\r\n   0.011876     do_notify: ntype 0x0005 (COMMBAD)\r\n   0.011899     Communications with UPS power0@localhost lost\r\n   0.013125     Trying to connect to UPS [ups0@localhost]\r\n   0.015265     SSL_connect do not accept handshake.: Error 0\r\n   0.015355     ssl_error() EOF from client\r\n   0.015379     Can not connect to localhost in SSL, disconnect\r\n\r\nOpen config.txt in wordpad or vi.   This is config.log.\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/networkupstools/nut/issues/comments/174211491","html_url":"https://github.com/networkupstools/nut/issues/246#issuecomment-174211491","issue_url":"https://api.github.com/repos/networkupstools/nut/issues/246","id":174211491,"user":{"login":"clepple","id":193087,"avatar_url":"https://avatars.githubusercontent.com/u/193087?v=3","gravatar_id":"","url":"https://api.github.com/users/clepple","html_url":"https://github.com/clepple","followers_url":"https://api.github.com/users/clepple/followers","following_url":"https://api.github.com/users/clepple/following{/other_user}","gists_url":"https://api.github.com/users/clepple/gists{/gist_id}","starred_url":"https://api.github.com/users/clepple/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clepple/subscriptions","organizations_url":"https://api.github.com/users/clepple/orgs","repos_url":"https://api.github.com/users/clepple/repos","events_url":"https://api.github.com/users/clepple/events{/privacy}","received_events_url":"https://api.github.com/users/clepple/received_events","type":"User","site_admin":false},"created_at":"2016-01-23T18:45:06Z","updated_at":"2016-01-23T18:45:06Z","body":"> Note lack of --with-wrap.\r\n\r\nI think this is tangential to the SSL issue, but note that in ./configure option parsing, the lack of an option allows the script to auto-detect the library or feature. You might want `--without-wrap` or `--with-wrap=no`."}}