SSL : The authentication or decryption has failed

[khanhmas]

Hello,

I set up a Document server (Docker version) by following this guide https://github.com/ONLYOFFICE/Docker-DocumentServer
But i have encountered the same problem such as this link : http://dev.onlyoffice.org/ru/viewtopic.php?f=30&t=1481
It's likely an error of my certificate and the certificate of mono.

In fact, my application lies on two servers (they have the same certificate): a VM for document server and another for my application (PHP, Apache, Alfresco with AJP proxy).
As far as the CALLBACK is concerned, i can receive the status 1 and 4, but i have never got the status 2 which encountered the error "The authentication or decryption has failed".

The information of my servers :

Code: Select all

Centos 7 64 bit (30 GB RAM)
My certificate's signature algorithm : SHA256RSA
My certificate's signature hash algorithm : SHA256
This is a wildcard certificate.

I also tried this command : mozroots --import --sync --machine, but it didn't help.

I have been stucked with this problem for a week. Any helps will be appreciated ! Thank you very much.

[Dean]

Did you use the command of mozroots inside the container or on the host?

[khanhmas]

Yes, i tried both : on my host and inside the container

Code: Select all

Mozilla Roots Importer - version 3.12.1.0
Download and import trusted root certificates from Mozilla's MXR.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2008 Novell. BSD licensed.

Downloading from 'http://mxr.mozilla.org/seamonkey/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1'...
Importing certificates into machine store...
1 new root certificates were added to your trust store.
83 previously trusted certificates were removed.
Import process completed.

[khanhmas]

Could you give me some solutions to this problem, please ?

[khanhmas]

After being blocked by this for a month, i found the original reason, it's because our system use a proxy which includes :

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"

Solution : We replaced that by a permissive version like below :

SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA