Menu ▾ ▴

#1478 Cannot open keepass dbx via Seafile webdav https

KeePass_2.x
closed
nobody
None
5
2016-07-05
2016-02-11
Nomis
No

Hello,
I have a Seafile instance on my server configure with apache2 as a proxy.
I use https with a valid letsencrypt certificat and I'm able to open webdav in Chrome for exemple.
But when I try to open it with Keepass it fail with this message :
The request was aborted: Could not create SSL/TLS secure channel.
I've also try to check Accept invalid SSL certificates but no luck.

I'm using Keepass 2.31 in Windows 10.

Thank you.

Discussion

  • Paul

    Paul - 2016-02-12

    I know it's reporting an SSL error, but have you checked the URL you are using for the database?
    KeePass if fussy about the path and uses what appears to be an extra backslash to identify a path off the root.
    e.g. If your database is in /files/KeePass/database.kdbx and your home path is /usr/me, the URL would have to be https://server//files/KeePass/database.kdbx.
    If your database is in /usr/me/KeePass/database.kdbx and your home path is /usr/me, the URL would have to be https://server/KeePass/database.kdbx.

    cheers, Paul

     

  • Dominik Reichl

    Dominik Reichl - 2016-02-12

    Maybe the server enforces the use of TLS 1.1 or 1.2. Support for this has already been added for the next KeePass release.

    Here's the latest development snapshot for testing:
    http://keepass.info/filepool/KeePass_160212.zip

    Thanks and best regards,
    Dominik

     

    • Nomis

      Nomis - 2016-02-12

      Hello,
      SSLabs give me this result :

      Protocols
      TLS 1.2 Yes
      TLS 1.1 Yes
      TLS 1.0 Yes
      SSL 3 No
      SSL 2 No

      And I've tried with the latest development snapshot, I have the same error.

       

  • Dominik Reichl

    Dominik Reichl - 2016-02-12

    Please try turning off the option 'Use file transactions for writing databases' in 'Tools' -> 'Options' -> tab 'Advanced'.

    Best regards,
    Dominik

     

    • Nomis

      Nomis - 2016-02-12

      I still the issue.
      I tried with both version.

      Thank you.

      Regards,

       

  • Nomis

    Nomis - 2016-02-12

    Can I launch Keepass in debug mode to have some logs ?
    And how can I check logs in Windows 10 ?

    Regards,

     

  • Dominik Reichl

    Dominik Reichl - 2016-02-12

    There aren't any logs, but you could start KeePass.exe with the --debug command line option; KeePass then shows more detailed exception messages.

    Best regards,
    Dominik

     

  • Nomis

    Nomis - 2016-02-12

    Here is a screenshot of the error with debug, maybe this can help.

    Regards,

     
    Thumbnail
    Capture.PNG

  • Nomis

    Nomis - 2016-02-16

    Ok, I've upgraded apache2.2 to 2.4 and now it's working fine.
    I don't know why ...

    Thanks

     

  • Paul

    Paul - 2016-02-17

    Thanks for the feedback.

    cheers, Paul

     

  • Dominik Reichl

    Dominik Reichl - 2016-02-17
    • status: open --> closed
     

  • casso

    casso - 2016-05-12

    I have this issue still when using Apache 2.4. I'm happy to provide whatever information is relevant. I'm under the impression this is an issue with my setup, but I'd still like to know what's going on.

     

  • Paul

    Paul - 2016-05-12

    Can you access the server logs to see what happens with the transaction?
    Are you using a self generated certificate? Have you turned off the validity check as mentioned by the OP?
    Can you download the file using a browser?
    Can you save the file using a browser?

    cheers, Paul

     

  • casso

    casso - 2016-05-13

    I have turned off the validity check, I can download and save the file using a browser. I don't see anything in my server logs, and a packet capture shows that a server key exchange was initiated, but that was as far as things got.

    I relaxed the cipher suite settings and SSL protocol settings down to stupidly low values and it still stops at the server key exchange.

     

  • Paul

    Paul - 2016-05-13

    Can you use SCP from the KeePass directory to load / save the file?
    Turn on SCP logging to see if it has any hints.

    cheers, Paul

     

  • casso

    casso - 2016-05-13

    I don't see SCP in the KeePass installation directory, or the application data directory. I do have WinSCP installed and the only things it shows in the logs worth mentioning are related to certificate trust. This was after performing a directory browse and subsequently uploading the file. Logging level was normal

    I also did a directory browse at debug level 1 which didn't reveal anything further.

     

  • Paul

    Paul - 2016-05-14

    If you are using SFTP you must have the IOProtocol plug-in. That installs SCP to .\IOProtocolExt_WinSCP.

    cheers, Paul

     

  • casso

    casso - 2016-05-16

    I installed the IOProtocolExt plug-in. It currently uses WinSCP version 5.7.7, and I tested with version 5.7.6 earlier. Testing using KeePass gives the same SSL/TLS error. The output in the logs is the same when using this version of WinSCPl. This is what is shown around the SSL side of things, with some details redacted.

    HTTP session to https://<servername>:443 begins.
ssl: SNI enabled by default.
ah_create, for WWW-Authenticate
Sending request headers:
OPTIONS /DAV/fs.php/private HTTP/1.1
User-Agent: WinSCP/5.7.7 neon/0.30.1
Keep-Alive: 
Connection: TE, Keep-Alive
TE: trailers
Host: <servername>

Sending request-line and headers:
Doing DNS lookup on <servername>...
req: Connecting to xx.xx.xx.xx:443
Doing SSL negotiation.
ssl: Verify callback @ 1 => 19
ssl: Verify failures |= 8 => 8
Chain depth: 2
ssl: Match common name '<servername>' against ''
Identity match for '': bad
ssl: Match common name '<Signing Authority>' against ''
Identity match for '': bad
ssl: Match common name '<servername>' against '<servername>'
Identity match for '<servername>': good
Verifying certificate for "<servername>" with fingerprint XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX and 08 failures
Certificate for "<servername>" matches cached fingerprint and failures
Using TLSv1.2, cipher TLSv1/SSLv3: ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Request sent; retry is 0.
[status-line] < HTTP/1.1 401 Unauthorized
Header Name: [date], Value: [Mon, 16 May 2016 01:53:24 GMT]
Header Name: [server], Value: [Apache]
Header Name: [www-authenticate], Value: [Digest realm="SabreDAV",qop="auth",nonce="....",opaque="....]
Header Name: [content-length], Value: [355]
Header Name: [keep-alive], Value: [timeout=15, max=100]
Header Name: [connection], Value: [Keep-Alive]
Header Name: [content-type], Value: [application/xml; charset=utf-8]
End of headers.
ah_post_send (#0), code is 401 (want 401), WWW-Authenticate is Digest realm="SabreDAV",qop="auth",nonce="....",opaque="...."
auth: Got challenge (code 401).
auth: Got 'Digest' challenge.
auth: Trying Digest challenge...
auth: Got qop, using 2617-style.
auth: H(A1) is [....]
auth: Accepting digest challenge.
auth: Accepted Digest challenge.
auth: Sending 'Digest' response.
auth: H(A2): ....
Sending request headers:
OPTIONS /DAV/fs.php/private HTTP/1.1
User-Agent: WinSCP/5.7.7 neon/0.30.1
Keep-Alive: 
Connection: TE, Keep-Alive
TE: trailers
Host: <servername>
Authorization: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Sending request-line and headers:
Request sent; retry is 1.
[status-line] < HTTP/1.1 200 OK
Header Name: [date], Value: [Mon, 16 May 2016 01:53:31 GMT]
Header Name: [server], Value: [Apache]
Header Name: [x-sabre-version], Value: [3.1.1]
Header Name: [allow], Value: [OPTIONS, GET, HEAD, DELETE, PROPFIND, PUT, PROPPATCH, COPY, MOVE, REPORT, LOCK, UNLOCK]
Header Name: [dav], Value: [1, 3, extended-mkcol, access-control, calendarserver-principal-property-search, 2]
Header Name: [ms-author-via], Value: [DAV]
Header Name: [accept-ranges], Value: [bytes]
Header Name: [content-length], Value: [0]
Header Name: [keep-alive], Value: [timeout=15, max=99]
Header Name: [connection], Value: [Keep-Alive]
Header Name: [content-type], Value: [text/html; charset=UTF-8]
End of headers.
ah_post_send (#1), code is 200 (want 401), WWW-Authenticate is (none)
Request ends, status 200 class 2xx, error line:
200 OK
Request ends.
Server capabilities: 1, 2, 3, access-control, extended-mkcol
     

  • Paul

    Paul - 2016-05-16

    The log looks OK.
    Have you been able to download the file using just WinSCP?

    cheers, Paul

     

  • casso

    casso - 2016-05-16

    Confirmed. It downloads just fine.

     

  • Paul

    Paul - 2016-05-16

    Comparing the logs between a KeePass open and WinSCP download?

    cheers, Paul

     

  • casso

    casso - 2016-05-16

    How do I enable logging in KeePass and where do I retrieve the log? I don't see this information on the help pages, and I don't see anything under options.

     

  • Paul

    Paul - 2016-05-17

    WinSCP logs, not KeePass.

    cheers, Paul

     

  • casso

    casso - 2016-07-05

    It would seem that even though I have selected "Accept invalid SSL certificates" under the options, the selection of this is not applying correctly. I have one certificate signed by CAcert which is failing, and the other by LetsEncrypt which is succeeding. When I try from a browser that has the CAcert root CA added both URLs are accessible and the certificate chain is valid. Both URLs point to the same file but use different virtual host configurations in Apache.

    For now I have changed the URL so that it is provided the LetsEncrypt certificate. It is working with the invalid SSL certificates option unchecked.

     

Log in to post a comment.

Monday.com Logo