MiKTeX / Bugs / #2548 SSL connect error

Christian Schenk - 2016-11-15

labels: --> SSL

summary: Miktex update wizard cannot connect after installing "November package refactoring" update --> SSL connect error

assigned_to: Christian Schenk
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Christian Schenk - 2016-11-15

Thank you. Please give the following info:

what is the operating system (e.g., Windows 10)

what is your default browser (e.g., Edge)

Please try the following work-around:

1) start Internet Explorer 11
2) browse to this URL: https://api.miktex.org/Repository.asmx
3) step 2) must work (not SSL connect error)
4) close the browser
5) run the update wizard

Last edit: Christian Schenk 2016-11-15
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gabriele Garuglieri - 2016-11-15

os: Windows 7 pro 64 Bits (regularly updated)
def browser : Firefox 36.0.4

I can contact without problem your url both with IE and Firefox and i'm able to see the soap answers from any of the links in the first page.

I tried your procedure, step 2 works, but step 5 fails as above.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Christian Schenk - 2016-11-15

Sorry, I gave youthe old URL. This is the current URL:

https://api2.miktex.org/

If you can browse to this URL with IE without problems, then we must create a DebugView trace (I will post instructions).

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gabriele Garuglieri - 2016-11-16

Apart the usual complains about untrusted certificate, that i got also for the other site, i don't get any other error.
But i don't see anything equivalent to the other url. All that i see is a page titled "A SHORT STORY" "by A. U. Thor" :)

What should i be supposed to get?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Christian Schenk - 2016-11-16
  
  You shouldn't get a warning about an untrusted certificate. See:
  
  https://www.ssllabs.com/ssltest/analyze.html?d=api2.miktex.org&latest
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gabriele Garuglieri - 2016-11-16

If this may help you i traced the wizard connection with wireshark.
I looks that the client is rejecting the cerificate because after the server sends
Server Hello, Certificate, Server Key Exchange, Server Hello Done
the client replies with
Alert (Level: Warning, Description: Close Notify) (15 0303 0002 0100)

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Christian Schenk - 2016-11-16

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Christian Schenk - 2016-11-16

This seems to be a system dependent issue. Sorry that I can't help you.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Christian Schenk - 2016-11-16

status: open --> attic
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gabriele Garuglieri - 2016-11-16

Considering that i used the wizard for about 4 years without problems and that for sure i didn't change anithing in IE (i used it the last time about 2 years ago) can you tell me what you changed in the security handling?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gabriele Garuglieri - 2016-11-16

Doesn't matter.
I figured out myself.

The Let's Encript CA is in the trusted store of Firefox but not in IE.

You should document this in the site, because many other with old Widows installations may fall in this problem.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Christian Schenk - 2016-11-16

status: attic --> open
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Christian Schenk - 2016-11-16

Thank you for the info. So you don't have IE11, right? What is your IE version?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gabriele Garuglieri - 2016-11-16

I do have IE 11, precisely 11.0.9600.17843.
I installed IE 11 on april 2015 because i needed it to access a site that refused to work with anything different from IE 11, but i never used it since, because it's a stupid browser, and for sure i never tampered its trust store, i try to keep myself as far as i can from anything concerning security.

The fact is that Let's Encript cert was not in the trust store and i had to download and install it manually, after that the wizard works.

By the way, do you want a proof that IE is stupid?
I uninstalled the certificate to devise a correct installation procedure to document in stack exchange and now IE refuses to display the https://letsencrypt.org/certificates/ page (i get an empty page) and if i try to install the certificate downloaded elsewere, OBVIOUSLY it says the installation is executed correctly, but OBVIOUSLY the certificate is no longer saved in the trust store.
I hope a reboot will cure the thing...

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gabriele Garuglieri - 2016-11-16

Well... i think i talked too fast, there are still some problems somewhere.

I installed basic-miktex-2.9.6161-x64.exe, then run the update wizard. It stays "connecting..." for a while, then a popup says there are no available updates.
But if a trace it i see that that the encription handshaking goes correctly to end (Change Cipher Spec). The server starts sending encripted application frames (2 frames) then the client sends a TLS encripted alert (64 bytes long) and truncates the session.

1503030040a66a56b2ee93a69b052e957e1ec66d19c639e78de34782164e4ad0e65c0cafbd162cfe3b132fc0ddf24d58208b04039504c04a481f05bfc477f46974dfa65db3

If i launch setup-2.9.6100-x64.exe, "connecting..." flashes for a moment in the dialog that then remain there forever.
Tracing i see that the encription handshaking goes correctly to end (Change Cipher Spec). The server starts sending encripted application frames (22 frames) then the client sends a TLS encripted alert (64 bytes long) and truncates the session.

150303004068e166462de6a712d21533feea46e94a7ccd8e8a27ab5c1d10d635a7daad79512cef87cfe5a1faaddb3f6e8f21ddbdc91198a704986a2ae6628a79ef16ccee62

Can you export and send me the certificate you have in your IE Trust Store?
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gabriele Garuglieri - 2016-11-16

i imported in IE the full certificate suite exported from Firefox, but the problem is still there.

Can you try to decrypt the above alerts to see what's going on?

I've seen already at least a couple of people having this problem, and i guess that once that people starts to update and install the new packges this problem could become a hassle.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gabriele Garuglieri - 2016-11-16

i forgot to attache the certificate suite.

Cert.7z

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Christian Schenk - 2016-11-16

Is the "DST Root CA X3" certificate in the Trusted Root Certification Authorities certificate store?

dstrootcax3.PNG

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gabriele Garuglieri - 2016-11-16

Sure, otherwise i'd be still stuck with the previous SSL connect error

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Christian Schenk - 2016-11-16

MiKTeX uses curl and WinSSL (schannel) under the hood and you can create a curl trace which also includes SSL events. You will need a running DebugView (catches trace messages).

DebugView can be downloaded from here:
https://technet.microsoft.com/en-us/sysinternals/debugview.aspx

To create a trace:

1) start a DOS prompt
2) set the MIKTEX_TRACE environment variable
3) start DebugView
4) start the update wizard

For example:

set MIKTEX_TRACE=error,curl dbgview "C:\Program Files\MiKTeX 2.9\miktex\bin\x64\internal\miktex-update.exe"

I have attached a "normal" trace. In your case, we should see some error events.

dbgview-ok.log
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Mike Torrence - 2016-11-16

I am having the exact same problem described above (SSL Error) any time I try to update or if it needs to auto-retrieve a package. This was after the latest update, everything was working before I did an update yesterday.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Gabriele Garuglieri - 2016-11-17
  
  Mike, try to import into IE the certificates i attached above an see how you mileage is going.
  Be sure they are imported into the "Trusted Root Certification Authorities" certificate store, or it won't work.
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
  - Mike Torrence - 2016-11-17
    
    I imported the certificates and I still get the following:
    
    2016-11-17 07:31:16,027-0500 INFO Update - starting: Update Wizard (MiKTeX 2.9.6100 64-bit)
    2016-11-17 07:31:19,492-0500 INFO FileCopyPage -
    2016-11-17 07:31:19,492-0500 INFO FileCopyPage - Error: SSL connect error
    
    If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
    - Gabriele Garuglieri - 2016-11-17
      
      Here i'm shamelessly predating from Christian indications and from my experience.
      IE is sometimes a bit prickly, so be sure to close all the windows of IE, then reopen it and check that your Trusted Store is showing what you see in the attached screenshot.
      If you don't see it then try reimporting the certificates then close all the IE windows before trying again the wizard.
      
      For me it worked and SSL error was gone.
      
      If you see the certificates and after closing IE you still have the error, if Christian is not able to shed some light on this, may be the last chance is an exorcist...
      
      trusted-cert.png
      
      If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

SSL connect error

MiKTeX source code moved to GitHub

Milestone

Help

#2548 SSL connect error

Discussion