can't login to koji - ssl error

[Neal Becker]

chrome is refusing to login to:

https://koji.fedoraproject.org/koji/login

This site can’t provide a secure connection

koji.fedoraproject.org sent an invalid response.
Try:
Reloading the page
Learn more about this problem.
ERR_SSL_PROTOCOL_ERROR

Appears to be a deprecation in chrome 50:
https://developers.google.com/web/updates/2016/03/chrome-50-deprecations?...

[James Hogarth]

On 3 May 2016 12:34, "Neal Becker" <ndbecker2(a)gmail.com&gt; wrote:
>  chrome is refusing to login to:
>
>  https://koji.fedoraproject.org/koji/login
>
>  This site can’t provide a secure connection
>
>  koji.fedoraproject.org sent an invalid response.
>  Try:
>  Reloading the page
>  Learn more about this problem.
>  ERR_SSL_PROTOCOL_ERROR
>
>  Appears to be a deprecation in chrome 50:
https://developers.google.com/web/updates/2016/03/chrome-50-deprecations?...
>  -- 
What are you trying to do?

To my knowledge that login has never (or at least in a long long time)
worked as it authenticates using PKI certificates, not the Fedora oauth
stuff.

Generally you should be interacting with koji through the fedpkg/koji CLI
tools.

[Sérgio Basto]

On Ter, 2016-05-03 at 07:34 -0400, Neal Becker wrote:
>  chrome is refusing to login to:
>  
>  https://koji.fedoraproject.org/koji/login
>  
>  This site can’t provide a secure connection
>  
>  koji.fedoraproject.org sent an invalid response.
>  Try:
>  Reloading the page
>  Learn more about this problem.
>  ERR_SSL_PROTOCOL_ERROR
>  
>  Appears to be a deprecation in chrome 50:
>  https://developers.google.com/web/updates/2016/03/chrome-50-deprecati
>  ons?hl=en&p=ir_ssl_error&hl=en&rd=1#remove-insecure-tls-version-
>  fallback
>  org 
I just login to https://koji.fedoraproject.org/koji/login using Chrome
Version 51.0.2704.29 beta (64-bit)

Maybe you need renew your certificate:
fedora-cert -v

openssl pkcs12 -export -in ~/.fedora.cert -CAfile ~/.fedora-upload-ca.cert -out
~/fedora-browser-cert.p12

and import ~/fedora-browser-cert.p12 to Chrome 

-- 
Sérgio M. B.

[Rex Dieter]

Sérgio Basto wrote:

>  On Ter, 2016-05-03 at 07:34 -0400, Neal Becker wrote:
> > chrome is refusing to login to:
> > 
> > https://koji.fedoraproject.org/koji/login
> > 
> > This site can’t provide a secure connection
> > 
> > koji.fedoraproject.org sent an invalid response.
> > Try:
> > Reloading the page
> > Learn more about this problem.
> > ERR_SSL_PROTOCOL_ERROR
> > 
> > Appears to be a deprecation in chrome 50:
> > https://developers.google.com/web/updates/2016/03/chrome-50-deprecati
> > ons?hl=en&p=ir_ssl_error&hl=en&rd=1#remove-insecure-tls-version-
> > fallback
> > org
>  
>  I just login to https://koji.fedoraproject.org/koji/login using Chrome
>  Version 51.0.2704.29 beta (64-bit)
>  
>  Maybe you need renew your certificate:
>  fedora-cert -v
>  
>  openssl pkcs12 -export -in ~/.fedora.cert -CAfile ~/.fedora-upload-ca.cert
>  -out ~/fedora-browser-cert.p12 
Or:
fedora-packager-setup --with-browser-cert

In my experience, one needs to import both the user cert produced by that, 
*and* fedora-server-ca.cert (as CA cert)

-- Rex

[Sérgio Basto]

On Ter, 2016-05-03 at 08:49 -0500, Rex Dieter wrote:
>  Sérgio Basto wrote:
>  
>  > 
>  > On Ter, 2016-05-03 at 07:34 -0400, Neal Becker wrote:
>  > > 
>  > > chrome is refusing to login to:
>  > > 
>  > > https://koji.fedoraproject.org/koji/login
>  > > 
>  > > This site can’t provide a secure connection
>  > > 
>  > > koji.fedoraproject.org sent an invalid response.
>  > > Try:
>  > > Reloading the page
>  > > Learn more about this problem.
>  > > ERR_SSL_PROTOCOL_ERROR
>  > > 
>  > > Appears to be a deprecation in chrome 50:
>  > > https://developers.google.com/web/updates/2016/03/chrome-50-depre
>  > > cati
>  > > ons?hl=en&p=ir_ssl_error&hl=en&rd=1#remove-insecure-tls-version-
>  > > fallback
>  > > org
>  > I just login to https://koji.fedoraproject.org/koji/login using
>  > Chrome
>  > Version 51.0.2704.29 beta (64-bit)
>  > 
>  > Maybe you need renew your certificate:
>  > fedora-cert -v
>  > 
>  > openssl pkcs12 -export -in ~/.fedora.cert -CAfile ~/.fedora-upload-
>  > ca.cert
>  > -out ~/fedora-browser-cert.p12
>  Or:
>  fedora-packager-setup --with-browser-cert
>  
>  In my experience, one needs to import both the user cert produced by
>  that, 
>  *and* fedora-server-ca.cert (as CA cert) 
Correct, thanks for the tip, but we just need import fedora-server-
ca.cert one time, while fedora-browser-cert.p12 we need import/update
it every 6 months, because fedora-browser-cert.p12 expires every 6
months, so on "renew certificate", we just need import/update the new
~/fedora-browser-cert.p12 :) 

-- 
Sérgio M. B.

[Michael Catanzaro]

The login button in koji will not work unless you configure Chrome to
use your client certificate; I dunno how to do that.

I read somewhere that Chrome will be dropping support for client certs,
but I forget where I read it and I can't find any links to support
that.

On Tue, 2016-05-03 at 07:34 -0400, Neal Becker wrote:
>  Appears to be a deprecation in chrome 50:
>  https://developers.google.com/web/updates/2016/03/chrome-50-deprecati
>  ons?hl=en&p=ir_ssl_error&hl=en&rd=1#remove-insecure-tls-version-
>  fallback 
Nope, then you would get ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION.
Insecure version fallback is for the most seriously broken of servers.
The client says "I support TLS 1.2" but the server only supports an
older version, say 1.0. The server is supposed to say "too bad, we will
establish a TLS 1.0 connection," because min(1.0, 1.2) = 1.0, right?
Instead these broken servers see 1.2, think "what on Earth is 1.2?" and
terminate the connection.

I'm not aware of any open source servers that have ever been affected
by this; I've personally only seen it with old Microsoft IIS servers.

It turns out that the link that explains the error message is wrong:
https://bugs.chromium.org/p/chromium/issues/detail?id=607052

Michael

P.S. Now, the koji configuration IS seriously broken, as it uses a
self-signed certificate. This makes no sense, as the packager cannot
trust that the server is the real koji; I have to click through the
scary security warning whenever I visit koji for the first time after
restarting my browser, and I don't like doing that, so I only ever
access koji via plain HTTP and never HTTPS. I've heard claims that the
self-signed certificate is needed for client authentication, but I
don't think that's right and I know of no evidence to support this.
(Fortunately, much more important for koji is to authenticate the
packager's client certificate, and that seems to be working properly.)

P.S.S. koji is using an absurd 8096 RSA key size. This is pointless.
2048 is the recommended key size nowadays; 4096 is considered expensive
and paranoid.