On 11/21/2018 03:14 AM, marcus jonsson wrote:
>
> We are using SSPR to send SMS tokens and new passwords using a SMS
> Gateway.
>
> Part of configuring this is to import the certificate from the SMS
> Gateway. In our case, this process imports the following certificates:
>
> Certificate structure:
> DST Root CA X3
> -- Let's encrypt Authority X3 -- THIS IS IMPORTED
> ---- api.obfuscated.com -- THIS IS IMPORTED

You should never import the end certificate, in your case
api.obfuscated.com, for any TLS/SSL service ever, at all, unless you are
using self-signed certificates (you are not) and know what you are doing
with them.

> It all works fine, but the problem I have is that the api.obfuscated.com
> certificate has a short validity period, it expires every 3 months and
> we don't know when the service provider renews the certificate.

That's part of the point of Let's Encrypt certs; they are meant to be
short-lived so if they are compromised they do not matter much, but the CA
allows for simple, even automatic, generation of new short-lived certificates.

> Would it not be sufficient to import the "Let's encrypt Authority X3"
> certificate? That one is valid for 10 years.

Yes, this is what you should always do, and usually one would import all
of the parent certs, assuming the existing truststore does not come with
those trusted already (older things may not yet, but newer things do). By
virtue of trusting the certificate authority (CA), your services trust all
certificates minted from that CA (unless revoked, used for the wrong
purpose, invalid time-wise/expired, etc.) which is why you should only
import the CA and not the endpoint certificate.

> Does anyone know how to work with this to ensure SSPR service
> reliability in the SMS gateway?

SSPR is just an app running in Apache Tomcat, and every time I have set it
up I have only done so trusting CAs, not endpoint certs.

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.

ab;2491288 wrote:
On 11/21/2018 03:14 AM, marcus jonsson wrote:
>
> We are using SSPR to send SMS tokens and new passwords using a SMS
> Gateway.
>
> Part of configuring this is to import the certificate from the SMS
> Gateway. In our case, this process imports the following certificates:
>
> Certificate structure:
> DST Root CA X3
> -- Let's encrypt Authority X3 -- THIS IS IMPORTED
> ---- api.obfuscated.com -- THIS IS IMPORTED

You should never import the end certificate, in your case
api.obfuscated.com, for any TLS/SSL service ever, at all, unless you are
using self-signed certificates (you are not) and know what you are doing
with them.

> It all works fine, but the problem I have is that the api.obfuscated.com
> certificate has a short validity period, it expires every 3 months and
> we don't know when the service provider renews the certificate.

That's part of the point of Let's Encrypt certs; they are meant to be
short-lived so if they are compromised they do not matter much, but the CA
allows for simple, even automatic, generation of new short-lived certificates.

> Would it not be sufficient to import the "Let's encrypt Authority X3"
> certificate? That one is valid for 10 years.

Yes, this is what you should always do, and usually one would import all
of the parent certs, assuming the existing truststore does not come with
those trusted already (older things may not yet, but newer things do). By
virtue of trusting the certificate authority (CA), your services trust all
certificates minted from that CA (unless revoked, used for the wrong
purpose, invalid time-wise/expired, etc.) which is why you should only
import the CA and not the endpoint certificate.

> Does anyone know how to work with this to ensure SSPR service
> reliability in the SMS gateway?

SSPR is just an app running in Apache Tomcat, and every time I have set it
up I have only done so trusting CAs, not endpoint certs.

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.

Hi AB!

I agree with everything you write. Just to clarify, I have not manually imported these certs, that is done automatically when I click "Import certificate" in the SSPR UI.

But based on your comments I will try and import the CA and intermeddiate (not endpoint) cert to tomcat certificate store and check if it works without using the "Import certificate" in the SSPR UI.

Thanks for helping me out!

Best Regards
Marcus

On 11/21/2018 05:46 AM, marcus jonsson wrote:
>
> I agree with everything you write. Just to clarify, I have not manually
> imported these certs, that is done automatically when I click "Import
> certificate" in the SSPR UI.

I have not used that import option for SMS things, so perhaps there is a
bug there, but it's a little one; imported expired certs are meaningless
so long as the CAs are trusted. I have only worked with the LDAP import
option and, while I think it shows the endpoing cert, my understanding is
that it would always import the CA only. With that said, my notes
indicate that I manually import into a truststore every time regardless,
probably as a practice from before the import option existed.


--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.

ab;2491293 wrote:
On 11/21/2018 05:46 AM, marcus jonsson wrote:
>
> I agree with everything you write. Just to clarify, I have not manually
> imported these certs, that is done automatically when I click "Import
> certificate" in the SSPR UI.

I have not used that import option for SMS things, so perhaps there is a
bug there, but it's a little one; imported expired certs are meaningless
so long as the CAs are trusted. I have only worked with the LDAP import
option and, while I think it shows the endpoing cert, my understanding is
that it would always import the CA only. With that said, my notes
indicate that I manually import into a truststore every time regardless,
probably as a practice from before the import option existed.


--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.

Hi.

I tried some ideas, but cant make it work.

Where do you suggest I import the CA and intermediate certificates? I tried to manually edit SSPRConfiguration.xml and removing only the endpoint certificate, but this does not work. I also tried to add these two certificates to the JRE cacerts, but the result is the same.

When I try to send I get the error message:
unable to send message: 5078 ERROR_SMS_SEND_ERROR (error while sending SMS, discarding message: 5057 ERROR_SERVICE_UNREACHABLE (error while making http request: java.security.cert.CertificateException: server certificate {subject=CN=api.obfuscated.com} does not match a certificate in the configuration trust store.

Do you have any guidance or ideas for me?

Best regards
Marcus

Hello,

was there any resolution to this? I am researching this and would help if there was a final solution in there. Perhaps you only needed a restart of service? 

Hi Zan,

It might be worth opening a case with the support team so this can be explored further

Regards

Liam O'Dowd

Hi Zan,

It might be worth opening a case with the support team so this can be explored further

Regards

Liam O'Dowd