[standalone] Peppol certificate validation not working #682
Replies: 7 comments 8 replies
-
|
@karelkryda : Here is screenshot which mention Oxalis successfully passed all tests under eDELIVERY TEST SUITE including "TC2A.4: Invalid certificate handling" using Oxalis/Oxalis-AS4 version 6.5.0 with Audit ID: 1467:262 https://github.com/OxalisCommunity/oxalis/wiki/OpenPeppol-Testbed-and-Accreditation Oxalis check "revoked" and "expired" certificate while sending and fail delivery with proper error message e.g. "Certificate is revoked" Please check whether you are bypassing certificate validation Also please attach complete logs which you promised but Not shared. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @aaron-kumar, |
Beta Was this translation helpful? Give feedback.
-
|
@aaron-kumar, any news? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @karelkryda |
Beta Was this translation helpful? Give feedback.
-
|
I apologize for the late reply. Yes, we only completed the Testbed because we intentionally did not send the second file and thus simulated that Oxalis refused to send it due to an incorrect certificate. |
Beta Was this translation helpful? Give feedback.
-
|
@aaron-kumar, may I ask why the issue has been transferred to a discussion? Do you have any information about this issue? |
Beta Was this translation helpful? Give feedback.
-
|
@karelkryda, can you give me one reason to keep it as issue? Oxalis is perfectly throwing "Certificate is revoked" error as part of "TC2A.4: Invalid certificate handling" . See: |
Beta Was this translation helpful? Give feedback.
-
|
@aaron-kumar, Obviously, we are not the only ones for whom this check does not work. And given that we need to guarantee a functional certificate check process to meet Peppol's conditions, this sounds like a pretty good reason to look into this potential issue. Don't take it badly, but from this point of view, it seems appropriate to me to try to devote time and effort to this problem and try to reproduce it somehow and possibly fix it, rather than having a "it works on my machine" approach. |
Beta Was this translation helpful? Give feedback.
-
|
I'd like to add my feedback. I finally passed the Test-bed. The "bad certificate" test succeeded also. I noticed in the Oxalis log a message about "a revoked certificate". @karelkryda : do you want to compare your configuration to mine ? |
Beta Was this translation helpful? Give feedback.
-
|
@Robcio35, Thanks for the information. We will be happy for all information. Our configuration is attached in one of the comments. Since then, it has undergone a thorough modification, I can share our current configuration tomorrow. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @Robcio35 for confirming & letting @karelkryda knows about it. So @karelkryda unfortunately you are the only one, who is getting issue now. @karelkryda if you want extended support from community of Peppol certified AP Oxalis users then please join Oxalis Membership. |
Beta Was this translation helpful? Give feedback.
-
|
@karelkryda @Robcio35 @aaron-kumar |
Beta Was this translation helpful? Give feedback.
-
|
@perneninag: Refer: OxalisCommunity/oxalis-ng#3 PS: If you need extended support from the community of Peppol certified AP Oxalis users then please join Oxalis Membership. |
Beta Was this translation helpful? Give feedback.
-
|
@perneninag, Unfortunately, I can't help you. I wasn't able to reach a state that, according to Aaron, "works perfectly with minimal configuration". P.S.: You can join the Oxalis Club for 3k euros a year if you want to get at least a minimum of support - maybe... |
Beta Was this translation helpful? Give feedback.
-
|
@karelkryda, Would you be willing to review the comment from @perneninag in this discussion? It may be worthwhile to retry as I understand you have spent several days without success, and I sympathize with the frustration this may have caused. I also noticed that you did not carry forward further discussion when @Robcio35 kindly offered assistance with the suggestion, "Do you want to compare your configuration to mine?" Please note that neither @Robcio35, @perneninag, nor any other community member have encountered similar issues. It's possible there might be a simple mistake on your end. |
Beta Was this translation helpful? Give feedback.
-
Hi,
I would like to report issue with Oxalis standalone component.
When sending a message to the Peppol network, the sender - in this case the Oxalis standalone component - should check the validity of the certificate and reject the message if the certificate is not valid.
This behavior is tested in Peppol Testbed using the
TC2A.4: Invalid certificate handlingtest. This test generates three test XML files, the second of which is signed with a revoked certificate. Oxalis should therefore refuse to send this file. Unfortunately, this expected behavior does not happen and Oxalis still performs delivery of this message. The Peppol test in this case ends in an error because sending this message is undesirable and against Peppol security practices.I am attaching here a log dump from the Oxalis standalone component. These are the logs from sending the message signed with a revoked certificate:
Thank you in advance for checking the situation.
Additional information:
Oxalis version:
6.5.0AS4 plugin version:
6.5.0Beta Was this translation helpful? Give feedback.
All reactions