PHP failing to retrieve content over ssl

I am am getting the errors bellow when executing the following line of PHP:
include_once 'https://someserver/someotherfile.php';
Log output:
PHP Warning: include_once(): SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed in /files/somefile.php on line x
PHP Warning: include_once(): Failed to enable crypto in /files/someotherfile.php on line x
PHP Warning: include_once(https://someserver/someotherfile.php): failed to open stream: operation failed in /files/somefile.php on line x
PHP Warning: include_once(): Failed opening 'https://someserver/somefile.php' for inclusion (include_path='.:/usr/share/pear') in /files/somefile.php on line x
The issue does not occur for http sources (e.g. http://someserver/somefile.php) but will occur for any https source.
OpenSSL is installed and appears to be configured correctly (I am able to retrieve files from a https source via curl). The config (/etc/ssl/openssl.cnf) is default.
I have reinstalled PHP and the config (/etc/php/php.ini) is default except for the lines below:
extension=openssl.so (uncommented)
extension=phar.so (uncommented)
allow_url_include = On (changed from "Off")
Installed versions:
local/php 5.6.4-1
local/lib32-openssl 1.0.1.k-1
local/openssl 1.0.1.k-1
I have been searching for hours and am unable to find anyone with a similar issue. Any assistance would be greatly appreciated.
edit:
Issue occurs when using any function to access content over an ssl connection. E.g. the following line produces the same error:
echo file_get_contents('https://someserver/somefile');
Last edited by despian (2015-01-14 18:50:31)

The 32-bit ssl must have been installed as a dependency for some other 32-bit package I installed. Shouldn't cause a problem though, right?
I'm not too familiar with the output of strace but these lines look interesting. What do you think?
420: read(3, 0x21acce0, 7) = -1 EAGAIN (Resource temporarily unavailable)
427: stat("/etc/ssl/certs/c598f4ac.0", 0x7fffcab78250) = -1 ENOENT (No such file or directory)
Complete output:
1: execve("/usr/bin/php", ["php", "-dallow_url_include=on", "-r", "echo include_once 'https://"...], [/* 53 vars */]) = 0
2: brk(0) = 0x1fcb000
3: access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
4: open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
5: fstat(3, {st_mode=S_IFREG|0644, st_size=272204, ...}) = 0
6: mmap(NULL, 272204, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fbd286c4000
7: close(3) = 0
8: open("/usr/lib/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3
9: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220:\0\0\0\0\0\0"..., 832) = 832
10: fstat(3, {st_mode=S_IFREG|0755, st_size=89024, ...}) = 0
11: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c3000
12: mmap(NULL, 2194248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd282ce000
13: mprotect(0x7fbd282e2000, 2093056, PROT_NONE) = 0
14: mmap(0x7fbd284e1000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x13000) = 0x7fbd284e1000
15: mmap(0x7fbd284e4000, 6984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbd284e4000
16: close(3) = 0
17: open("/usr/lib/libreadline.so.6", O_RDONLY|O_CLOEXEC) = 3
18: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260e\1\0\0\0\0\0"..., 832) = 832
19: fstat(3, {st_mode=S_IFREG|0555, st_size=350087, ...}) = 0
20: mmap(NULL, 2402176, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd28083000
21: mprotect(0x7fbd280c4000, 2097152, PROT_NONE) = 0
22: mmap(0x7fbd282c4000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x41000) = 0x7fbd282c4000
23: mmap(0x7fbd282cd000, 1920, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbd282cd000
24: close(3) = 0
25: open("/usr/lib/libz.so.1", O_RDONLY|O_CLOEXEC) = 3
26: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000#\0\0\0\0\0\0"..., 832) = 832
27: fstat(3, {st_mode=S_IFREG|0755, st_size=88592, ...}) = 0
28: mmap(NULL, 2183688, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd27e6d000
29: mprotect(0x7fbd27e82000, 2093056, PROT_NONE) = 0
30: mmap(0x7fbd28081000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14000) = 0x7fbd28081000
31: close(3) = 0
32: open("/usr/lib/libpcre.so.1", O_RDONLY|O_CLOEXEC) = 3
33: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\27\0\0\0\0\0\0"..., 832) = 832
34: fstat(3, {st_mode=S_IFREG|0755, st_size=452840, ...}) = 0
35: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c2000
36: mmap(NULL, 2548328, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd27bfe000
37: mprotect(0x7fbd27c6c000, 2093056, PROT_NONE) = 0
38: mmap(0x7fbd27e6b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6d000) = 0x7fbd27e6b000
39: close(3) = 0
40: open("/usr/lib/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
41: read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200U\0\0\0\0\0\0"..., 832) = 832
42: fstat(3, {st_mode=S_IFREG|0755, st_size=1067456, ...}) = 0
43: mmap(NULL, 3162456, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd278f9000
44: mprotect(0x7fbd279fc000, 2097152, PROT_NONE) = 0
45: mmap(0x7fbd27bfc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x103000) = 0x7fbd27bfc000
46: close(3) = 0
47: open("/usr/lib/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
48: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\16\0\0\0\0\0\0"..., 832) = 832
49: fstat(3, {st_mode=S_IFREG|0755, st_size=14672, ...}) = 0
50: mmap(NULL, 2109712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd276f5000
51: mprotect(0x7fbd276f8000, 2093056, PROT_NONE) = 0
52: mmap(0x7fbd278f7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fbd278f7000
53: close(3) = 0
54: open("/usr/lib/libxml2.so.2", O_RDONLY|O_CLOEXEC) = 3
55: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\344\2\0\0\0\0\0"..., 832) = 832
56: fstat(3, {st_mode=S_IFREG|0755, st_size=1455160, ...}) = 0
57: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c1000
58: mmap(NULL, 3555672, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd27390000
59: mprotect(0x7fbd274ea000, 2093056, PROT_NONE) = 0
60: mmap(0x7fbd276e9000, 40960, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x159000) = 0x7fbd276e9000
61: mmap(0x7fbd276f3000, 4440, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbd276f3000
62: close(3) = 0
63: open("/usr/lib/libcrypto.so.1.0.0", O_RDONLY|O_CLOEXEC) = 3
64: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300-\6\0\0\0\0\0"..., 832) = 832
65: fstat(3, {st_mode=S_IFREG|0555, st_size=2425792, ...}) = 0
66: mmap(NULL, 4264248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd26f7e000
67: mprotect(0x7fbd27164000, 2097152, PROT_NONE) = 0
68: mmap(0x7fbd27364000, 163840, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e6000) = 0x7fbd27364000
69: mmap(0x7fbd2738c000, 12600, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbd2738c000
70: close(3) = 0
71: open("/usr/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
72: read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\1\2\0\0\0\0\0"..., 832) = 832
73: fstat(3, {st_mode=S_IFREG|0755, st_size=1984416, ...}) = 0
74: mmap(NULL, 3813200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd26bdb000
75: mprotect(0x7fbd26d74000, 2097152, PROT_NONE) = 0
76: mmap(0x7fbd26f74000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x199000) = 0x7fbd26f74000
77: mmap(0x7fbd26f7a000, 16208, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbd26f7a000
78: close(3) = 0
79: open("/usr/lib/libncursesw.so.5", O_RDONLY|O_CLOEXEC) = 3
80: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0P\1\0\0\0\0\0"..., 832) = 832
81: fstat(3, {st_mode=S_IFREG|0755, st_size=411648, ...}) = 0
82: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c0000
83: mmap(NULL, 2508816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd26976000
84: mprotect(0x7fbd269d5000, 2097152, PROT_NONE) = 0
85: mmap(0x7fbd26bd5000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5f000) = 0x7fbd26bd5000
86: close(3) = 0
87: open("/usr/lib/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
88: read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300`\0\0\0\0\0\0"..., 832) = 832
89: fstat(3, {st_mode=S_IFREG|0755, st_size=138248, ...}) = 0
90: mmap(NULL, 2208912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd2675a000
91: mprotect(0x7fbd26771000, 2093056, PROT_NONE) = 0
92: mmap(0x7fbd26970000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16000) = 0x7fbd26970000
93: mmap(0x7fbd26972000, 13456, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbd26972000
94: close(3) = 0
95: open("/usr/lib/liblzma.so.5", O_RDONLY|O_CLOEXEC) = 3
96: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340)\0\0\0\0\0\0"..., 832) = 832
97: fstat(3, {st_mode=S_IFREG|0755, st_size=141744, ...}) = 0
98: mmap(NULL, 2236920, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd26537000
99: mprotect(0x7fbd26559000, 2093056, PROT_NONE) = 0
100: mmap(0x7fbd26758000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x21000) = 0x7fbd26758000
101: close(3) = 0
102: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286bf000
103: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286be000
104: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286bd000
105: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286bc000
106: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286bb000
107: arch_prctl(ARCH_SET_FS, 0x7fbd286bc700) = 0
108: mprotect(0x7fbd26f74000, 16384, PROT_READ) = 0
109: mprotect(0x7fbd26970000, 4096, PROT_READ) = 0
110: mprotect(0x7fbd26758000, 4096, PROT_READ) = 0
111: mprotect(0x7fbd26bd5000, 16384, PROT_READ) = 0
112: mprotect(0x7fbd28081000, 4096, PROT_READ) = 0
113: mprotect(0x7fbd278f7000, 4096, PROT_READ) = 0
114: mprotect(0x7fbd27364000, 114688, PROT_READ) = 0
115: mprotect(0x7fbd27bfc000, 4096, PROT_READ) = 0
116: mprotect(0x7fbd276e9000, 32768, PROT_READ) = 0
117: mprotect(0x7fbd27e6b000, 4096, PROT_READ) = 0
118: mprotect(0x7fbd282c4000, 8192, PROT_READ) = 0
119: mprotect(0x7fbd284e1000, 8192, PROT_READ) = 0
120: mprotect(0xda6000, 667648, PROT_READ) = 0
121: mprotect(0x7fbd28707000, 4096, PROT_READ) = 0
122: munmap(0x7fbd286c4000, 272204) = 0
123: set_tid_address(0x7fbd286bc9d0) = 2834
124: set_robust_list(0x7fbd286bc9e0, 24) = 0
125: rt_sigaction(SIGRTMIN, {0x7fbd2675fb90, [], SA_RESTORER|SA_SIGINFO, 0x7fbd2676a210}, NULL, 8) = 0
126: rt_sigaction(SIGRT_1, {0x7fbd2675fc20, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fbd2676a210}, NULL, 8) = 0
127: rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
128: getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
129: brk(0) = 0x1fcb000
130: brk(0x1fec000) = 0x1fec000
131: rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7fbd26c0eb20}, {SIG_DFL, [], 0}, 8) = 0
132: mmap(NULL, 266240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c6000
133: getcwd("/somedir", 4096) = 45
134: mmap(NULL, 1052672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd285ba000
135: open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
136: fstat(3, {st_mode=S_IFREG|0644, st_size=1607760, ...}) = 0
137: mmap(NULL, 1607760, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fbd263ae000
138: close(3) = 0
139: open("/etc/localtime", O_RDONLY|O_CLOEXEC) = 3
140: fstat(3, {st_mode=S_IFREG|0644, st_size=3661, ...}) = 0
141: fstat(3, {st_mode=S_IFREG|0644, st_size=3661, ...}) = 0
142: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c5000
143: read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\7\0\0\0\7\0\0\0\0"..., 4096) = 3661
144: lseek(3, -2338, SEEK_CUR) = 1323
145: read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\10\0\0\0\0"..., 4096) = 2338
146: close(3) = 0
147: munmap(0x7fbd286c5000, 4096) = 0
148: lstat("/home/me/bin/php", 0x7fffcab77df0) = -1 ENOENT (No such file or directory)
149: lstat("/usr/local/bin/php", 0x7fffcab77df0) = -1 ENOENT (No such file or directory)
150: lstat("/usr/local/sbin/php", 0x7fffcab77df0) = -1 ENOENT (No such file or directory)
151: lstat("/usr/local/bin/php", 0x7fffcab77df0) = -1 ENOENT (No such file or directory)
152: lstat("/usr/bin/php", {st_mode=S_IFREG|0755, st_size=8730816, ...}) = 0
153: lstat("/usr/bin", {st_mode=S_IFDIR|0755, st_size=79146, ...}) = 0
154: lstat("/usr", {st_mode=S_IFDIR|0755, st_size=86, ...}) = 0
155: access("/usr/bin/php", X_OK) = 0
156: stat("/usr/bin/php", {st_mode=S_IFREG|0755, st_size=8730816, ...}) = 0
157: open("/usr/bin/php-cli.ini", O_RDONLY) = -1 ENOENT (No such file or directory)
158: open("/etc/php/php-cli.ini", O_RDONLY) = -1 ENOENT (No such file or directory)
159: open("/usr/bin/php.ini", O_RDONLY) = -1 ENOENT (No such file or directory)
160: open("/etc/php/php.ini", O_RDONLY) = 3
161: ioctl(3, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffcab78b40) = -1 ENOTTY (Inappropriate ioctl for device)
162: fstat(3, {st_mode=S_IFREG|0644, st_size=71932, ...}) = 0
163: mmap(NULL, 71964, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fbd285a8000
164: lseek(3, 0, SEEK_CUR) = 0
165: munmap(0x7fbd285a8000, 71964) = 0
166: close(3) = 0
167: openat(AT_FDCWD, "/etc/php/conf.d", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3
168: getdents(3, /* 2 entries */, 32768) = 48
169: getdents(3, /* 0 entries */, 32768) = 0
170: close(3) = 0
171: mmap(NULL, 323584, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd2856b000
172: brk(0x200d000) = 0x200d000
173: brk(0x202e000) = 0x202e000
174: brk(0x204f000) = 0x204f000
175: futex(0x7fbd278f80c8, FUTEX_WAKE_PRIVATE, 2147483647) = 0
176: open("/usr/lib/php/modules/curl.so", O_RDONLY|O_CLOEXEC) = 3
177: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0<\0\0\0\0\0\0"..., 832) = 832
178: fstat(3, {st_mode=S_IFREG|0755, st_size=85096, ...}) = 0
179: mmap(NULL, 2180288, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd26199000
180: mprotect(0x7fbd261ac000, 2093056, PROT_NONE) = 0
181: mmap(0x7fbd263ab000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12000) = 0x7fbd263ab000
182: close(3) = 0
183: open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
184: fstat(3, {st_mode=S_IFREG|0644, st_size=272204, ...}) = 0
185: mmap(NULL, 272204, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fbd28528000
186: close(3) = 0
187: open("/usr/lib/libcurl.so.4", O_RDONLY|O_CLOEXEC) = 3
188: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\243\0\0\0\0\0\0"..., 832) = 832
189: fstat(3, {st_mode=S_IFREG|0755, st_size=456000, ...}) = 0
190: mmap(NULL, 2551816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd25f29000
191: mprotect(0x7fbd25f96000, 2093056, PROT_NONE) = 0
192: mmap(0x7fbd26195000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6c000) = 0x7fbd26195000
193: mmap(0x7fbd26198000, 8, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbd26198000
194: close(3) = 0
195: open("/usr/lib/libidn.so.11", O_RDONLY|O_CLOEXEC) = 3
196: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00001\0\0\0\0\0\0"..., 832) = 832
197: fstat(3, {st_mode=S_IFREG|0755, st_size=211432, ...}) = 0
198: mmap(NULL, 2306528, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd25cf5000
199: mprotect(0x7fbd25d27000, 2097152, PROT_NONE) = 0
200: mmap(0x7fbd25f27000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x32000) = 0x7fbd25f27000
201: close(3) = 0
202: open("/usr/lib/libssh2.so.1", O_RDONLY|O_CLOEXEC) = 3
203: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220V\0\0\0\0\0\0"..., 832) = 832
204: fstat(3, {st_mode=S_IFREG|0755, st_size=167224, ...}) = 0
205: mmap(NULL, 2262720, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd25acc000
206: mprotect(0x7fbd25af4000, 2093056, PROT_NONE) = 0
207: mmap(0x7fbd25cf3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x27000) = 0x7fbd25cf3000
208: close(3) = 0
209: open("/usr/lib/libssl.so.1.0.0", O_RDONLY|O_CLOEXEC) = 3
210: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260z\1\0\0\0\0\0"..., 832) = 832
211: fstat(3, {st_mode=S_IFREG|0555, st_size=505240, ...}) = 0
212: mmap(NULL, 2552560, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd2585c000
213: mprotect(0x7fbd258c1000, 2093056, PROT_NONE) = 0
214: mmap(0x7fbd25ac0000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x64000) = 0x7fbd25ac0000
215: close(3) = 0
216: open("/usr/lib/libgssapi_krb5.so.2", O_RDONLY|O_CLOEXEC) = 3
217: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\302\0\0\0\0\0\0"..., 832) = 832
218: fstat(3, {st_mode=S_IFREG|0644, st_size=313696, ...}) = 0
219: mmap(NULL, 2409344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd2560f000
220: mprotect(0x7fbd25659000, 2093056, PROT_NONE) = 0
221: mmap(0x7fbd25858000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x49000) = 0x7fbd25858000
222: close(3) = 0
223: open("/usr/lib/libkrb5.so.3", O_RDONLY|O_CLOEXEC) = 3
224: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300P\2\0\0\0\0\0"..., 832) = 832
225: fstat(3, {st_mode=S_IFREG|0644, st_size=937552, ...}) = 0
226: mmap(NULL, 3033408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd2532a000
227: mprotect(0x7fbd253ff000, 2093056, PROT_NONE) = 0
228: mmap(0x7fbd255fe000, 69632, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xd4000) = 0x7fbd255fe000
229: close(3) = 0
230: open("/usr/lib/libk5crypto.so.3", O_RDONLY|O_CLOEXEC) = 3
231: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320H\0\0\0\0\0\0"..., 832) = 832
232: fstat(3, {st_mode=S_IFREG|0644, st_size=199504, ...}) = 0
233: mmap(NULL, 2298456, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd250f8000
234: mprotect(0x7fbd25127000, 2093056, PROT_NONE) = 0
235: mmap(0x7fbd25326000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2e000) = 0x7fbd25326000
236: mmap(0x7fbd25329000, 600, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbd25329000
237: close(3) = 0
238: open("/usr/lib/libcom_err.so.2", O_RDONLY|O_CLOEXEC) = 3
239: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\25\0\0\0\0\0\0"..., 832) = 832
240: fstat(3, {st_mode=S_IFREG|0755, st_size=14632, ...}) = 0
241: mmap(NULL, 2109960, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd24ef4000
242: mprotect(0x7fbd24ef7000, 2093056, PROT_NONE) = 0
243: mmap(0x7fbd250f6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fbd250f6000
244: close(3) = 0
245: open("/usr/lib/libkrb5support.so.0", O_RDONLY|O_CLOEXEC) = 3
246: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P0\0\0\0\0\0\0"..., 832) = 832
247: fstat(3, {st_mode=S_IFREG|0644, st_size=52208, ...}) = 0
248: mmap(NULL, 2147688, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd24ce7000
249: mprotect(0x7fbd24cf3000, 2093056, PROT_NONE) = 0
250: mmap(0x7fbd24ef2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7fbd24ef2000
251: close(3) = 0
252: open("/usr/lib/libkeyutils.so.1", O_RDONLY|O_CLOEXEC) = 3
253: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\25\0\0\0\0\0\0"..., 832) = 832
254: fstat(3, {st_mode=S_IFREG|0755, st_size=14568, ...}) = 0
255: mmap(NULL, 2109720, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd24ae3000
256: mprotect(0x7fbd24ae6000, 2093056, PROT_NONE) = 0
257: mmap(0x7fbd24ce5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fbd24ce5000
258: close(3) = 0
259: mprotect(0x7fbd24ce5000, 4096, PROT_READ) = 0
260: mprotect(0x7fbd24ef2000, 4096, PROT_READ) = 0
261: mprotect(0x7fbd250f6000, 4096, PROT_READ) = 0
262: mprotect(0x7fbd25326000, 8192, PROT_READ) = 0
263: mprotect(0x7fbd255fe000, 57344, PROT_READ) = 0
264: mprotect(0x7fbd25858000, 8192, PROT_READ) = 0
265: mprotect(0x7fbd25ac0000, 20480, PROT_READ) = 0
266: mprotect(0x7fbd25cf3000, 4096, PROT_READ) = 0
267: mprotect(0x7fbd25f27000, 4096, PROT_READ) = 0
268: mprotect(0x7fbd26195000, 8192, PROT_READ) = 0
269: mprotect(0x7fbd263ab000, 8192, PROT_READ) = 0
270: munmap(0x7fbd28528000, 272204) = 0
271: open("/usr/lib/php/modules/gettext.so", O_RDONLY|O_CLOEXEC) = 3
272: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\20\0\0\0\0\0\0"..., 832) = 832
273: fstat(3, {st_mode=S_IFREG|0755, st_size=14696, ...}) = 0
274: mmap(NULL, 2109872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd248df000
275: mprotect(0x7fbd248e1000, 2097152, PROT_NONE) = 0
276: mmap(0x7fbd24ae1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fbd24ae1000
277: close(3) = 0
278: mprotect(0x7fbd24ae1000, 4096, PROT_READ) = 0
279: open("/usr/lib/php/modules/openssl.so", O_RDONLY|O_CLOEXEC) = 3
280: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\260\0\0\0\0\0\0"..., 832) = 832
281: fstat(3, {st_mode=S_IFREG|0755, st_size=144968, ...}) = 0
282: mmap(NULL, 2244368, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd246bb000
283: mprotect(0x7fbd246da000, 2097152, PROT_NONE) = 0
284: mmap(0x7fbd248da000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1f000) = 0x7fbd248da000
285: mmap(0x7fbd248de000, 3856, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbd248de000
286: close(3) = 0
287: mprotect(0x7fbd248da000, 12288, PROT_READ) = 0
288: open("/usr/lib/php/modules/phar.so", O_RDONLY|O_CLOEXEC) = 3
289: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0Pc\0\0\0\0\0\0"..., 832) = 832
290: fstat(3, {st_mode=S_IFREG|0755, st_size=268592, ...}) = 0
291: mmap(NULL, 2365016, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd24479000
292: mprotect(0x7fbd244b8000, 2093056, PROT_NONE) = 0
293: mmap(0x7fbd246b7000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3e000) = 0x7fbd246b7000
294: close(3) = 0
295: mprotect(0x7fbd246b7000, 8192, PROT_READ) = 0
296: brk(0x2070000) = 0x2070000
297: futex(0x7fbd276f3e48, FUTEX_WAKE_PRIVATE, 2147483647) = 0
298: brk(0x2091000) = 0x2091000
299: brk(0x20b2000) = 0x20b2000
300: brk(0x20d3000) = 0x20d3000
301: brk(0x20f4000) = 0x20f4000
302: brk(0x2115000) = 0x2115000
303: brk(0x2136000) = 0x2136000
304: brk(0x2157000) = 0x2157000
305: brk(0x2178000) = 0x2178000
306: brk(0x2199000) = 0x2199000
307: open("/etc/ssl/openssl.cnf", O_RDONLY) = 3
308: fstat(3, {st_mode=S_IFREG|0644, st_size=10835, ...}) = 0
309: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c5000
310: read(3, "#\n# OpenSSL example configuratio"..., 4096) = 4096
311: read(3, "Netscape crash on BMPStrings or "..., 4096) = 4096
312: read(3, " this to avoid interpreting an e"..., 4096) = 2643
313: read(3, "", 4096) = 0
314: close(3) = 0
315: munmap(0x7fbd286c5000, 4096) = 0
316: brk(0x21ba000) = 0x21ba000
317: rt_sigaction(SIGPROF, {0x637f20, [PROF], SA_RESTORER|SA_RESTART, 0x7fbd26c0eb20}, {SIG_DFL, [], 0}, 8) = 0
318: rt_sigprocmask(SIG_UNBLOCK, [PROF], NULL, 8) = 0
319: fstat(0, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0
320: fstat(0, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0
321: lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
322: fstat(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0
323: fstat(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0
324: lseek(1, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
325: fstat(2, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0
326: fstat(2, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0
327: lseek(2, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
328: socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 3
329: close(3) = 0
330: socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
331: connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
332: close(3) = 0
333: socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
334: connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
335: close(3) = 0
336: open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 3
337: fstat(3, {st_mode=S_IFREG|0644, st_size=234, ...}) = 0
338: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c5000
339: read(3, "# Begin /etc/nsswitch.conf\n\npass"..., 4096) = 234
340: read(3, "", 4096) = 0
341: close(3) = 0
342: munmap(0x7fbd286c5000, 4096) = 0
343: open("/etc/host.conf", O_RDONLY|O_CLOEXEC) = 3
344: fstat(3, {st_mode=S_IFREG|0644, st_size=63, ...}) = 0
345: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c5000
346: read(3, "#\n# /etc/host.conf\n#\n\norder host"..., 4096) = 63
347: read(3, "", 4096) = 0
348: close(3) = 0
349: munmap(0x7fbd286c5000, 4096) = 0
350: futex(0x7fbd26f7d044, FUTEX_WAKE_PRIVATE, 2147483647) = 0
351: open("/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 3
352: fstat(3, {st_mode=S_IFREG|0644, st_size=51, ...}) = 0
353: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c5000
354: read(3, "# Generated by resolvconf\nnamese"..., 4096) = 51
355: read(3, "", 4096) = 0
356: close(3) = 0
357: munmap(0x7fbd286c5000, 4096) = 0
358: uname({sys="Linux", node="mymachinename", ...}) = 0
359: open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
360: fstat(3, {st_mode=S_IFREG|0644, st_size=272204, ...}) = 0
361: mmap(NULL, 272204, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fbd28528000
362: close(3) = 0
363: open("/usr/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3
364: read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\"\0\0\0\0\0\0"..., 832) = 832
365: fstat(3, {st_mode=S_IFREG|0755, st_size=51808, ...}) = 0
366: mmap(NULL, 2148488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbd2426c000
367: mprotect(0x7fbd24277000, 2097152, PROT_NONE) = 0
368: mmap(0x7fbd24477000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7fbd24477000
369: close(3) = 0
370: mprotect(0x7fbd24477000, 4096, PROT_READ) = 0
371: munmap(0x7fbd28528000, 272204) = 0
372: open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 3
373: fstat(3, {st_mode=S_IFREG|0644, st_size=264, ...}) = 0
374: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c5000
375: read(3, "#\n# /etc/hosts: static lookup ta"..., 4096) = 264
376: read(3, "", 4096) = 0
377: close(3) = 0
378: munmap(0x7fbd286c5000, 4096) = 0
379: open("/etc/gai.conf", O_RDONLY|O_CLOEXEC) = 3
380: fstat(3, {st_mode=S_IFREG|0644, st_size=2584, ...}) = 0
381: fstat(3, {st_mode=S_IFREG|0644, st_size=2584, ...}) = 0
382: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbd286c5000
383: read(3, "# Configuration for getaddrinfo("..., 4096) = 2584
384: read(3, "", 4096) = 0
385: close(3) = 0
386: munmap(0x7fbd286c5000, 4096) = 0
387: futex(0x7fbd26f7b284, FUTEX_WAKE_PRIVATE, 2147483647) = 0
388: socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
389: bind(3, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0
390: getsockname(3, {sa_family=AF_NETLINK, pid=2834, groups=00000000}, [12]) = 0
391: sendto(3, "\24\0\0\0\26\0\1\3\306\273\266T\0\0\0\0\0\0\0\0", 20, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 20
392: recvmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"L\0\0\0\24\0\2\0\306\273\266T\22\v\0\0\2\10\200\376\1\0\0\0\10\0\1\0\177\0\0\1"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 256
393: recvmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"H\0\0\0\24\0\2\0\306\273\266T\22\v\0\0\n\200\200\376\1\0\0\0\24\0\1\0\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 144
394: recvmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\24\0\0\0\3\0\2\0\306\273\266T\22\v\0\0\0\0\0\0", 4096}], msg_controllen=0, msg_flags=0}, 0) = 20
395: close(3) = 0
396: socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
397: connect(3, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
398: getsockname(3, {sa_family=AF_INET, sin_port=htons(53655), sin_addr=inet_addr("127.0.0.1")}, [16]) = 0
399: close(3) = 0
400: socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 3
401: connect(3, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0
402: getsockname(3, {sa_family=AF_INET6, sin6_port=htons(50202), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0
403: close(3) = 0
404: socket(PF_INET6, SOCK_STREAM, IPPROTO_IP) = 3
405: fcntl(3, F_GETFL) = 0x2 (flags O_RDWR)
406: fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
407: connect(3, {sa_family=AF_INET6, sin6_port=htons(443), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = -1 EINPROGRESS (Operation now in progress)
408: poll([{fd=3, events=POLLIN|POLLOUT|POLLERR|POLLHUP}], 1, 60000) = 1 ([{fd=3, revents=POLLOUT}])
409: getsockopt(3, SOL_SOCKET, SO_ERROR, [0], [4]) = 0
410: fcntl(3, F_SETFL, O_RDWR) = 0
411: open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 4
412: fstat(4, {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
413: poll([{fd=4, events=POLLIN}], 1, 10) = 1 ([{fd=4, revents=POLLIN}])
414: read(4, "\241\351\215'2y\320\235\315\23\231\251\f\36n\363\3568\226\25!9\231b\26\241\202&\303\22\332\202", 32) = 32
415: close(4) = 0
416: getuid() = 1000
417: fcntl(3, F_GETFL) = 0x2 (flags O_RDWR)
418: fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
419: write(3, "\26\3\1\2\0\1\0\1\374\3\3a\310\34\334\323\236\16\307\232\356\210\302\33\5\256\332s\267\254q\330"..., 517) = 517
420: read(3, 0x21acce0, 7) = -1 EAGAIN (Resource temporarily unavailable)
421: poll([{fd=3, events=POLLIN|POLLPRI}], 1, 59999) = 1 ([{fd=3, revents=POLLIN}])
422: read(3, "\26\3\3\0F\2\0", 7) = 7
423: brk(0x21db000) = 0x21db000
424: read(3, "\0B\3\3$\363|2\327=*\310;\266\33\337\317:\247\201\232\355\233\367\370\300\256\10\352\211\34\372"..., 68) = 68
425: read(3, "\26\3\3\5k", 5) = 5
426: read(3, "\v\0\5g\0\5d\0\5a0\202\5]0\202\3E\240\3\2\1\2\2\t\0\224\343#\256\276\206"..., 1387) = 1387
427: stat("/etc/ssl/certs/c598f4ac.0", 0x7fffcab78250) = -1 ENOENT (No such file or directory)
428: write(3, "\25\3\3\0\2\0020", 7) = 7
429: write(2, "PHP Warning: include_once(): SS"..., 201PHP Warning: include_once(): SSL operation failed with code 1. OpenSSL Error messages:
430: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed in Command line code on line 1
431: ) = 201
432: fcntl(3, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK)
433: fcntl(3, F_SETFL, O_RDWR) = 0
434: write(2, "PHP Warning: include_once(): Fa"..., 85PHP Warning: include_once(): Failed to enable crypto in Command line code on line 1
435: ) = 85
436: close(3) = 0
437: write(2, "PHP Warning: include_once(https"..., 141PHP Warning: include_once(https://someserver/somefile.php): failed to open stream: operation failed in Command line code on line 1
438: ) = 141
439: write(2, "PHP Warning: include_once(): Fa"..., 168PHP Warning: include_once(): Failed opening 'https://someserver/somefile.php' for inclusion (include_path='.:/usr/share/pear') in Command line code on line 1
440: ) = 168
441: close(2) = 0
442: close(1) = 0
443: close(0) = 0
444: munmap(0x7fbd24479000, 2365016) = 0
445: munmap(0x7fbd246bb000, 2244368) = 0
446: munmap(0x7fbd248df000, 2109872) = 0
447: munmap(0x7fbd26199000, 2180288) = 0
448: munmap(0x7fbd25f29000, 2551816) = 0
449: munmap(0x7fbd25cf5000, 2306528) = 0
450: munmap(0x7fbd25acc000, 2262720) = 0
451: munmap(0x7fbd2585c000, 2552560) = 0
452: munmap(0x7fbd2560f000, 2409344) = 0
453: munmap(0x7fbd2532a000, 3033408) = 0
454: munmap(0x7fbd250f8000, 2298456) = 0
455: munmap(0x7fbd24ef4000, 2109960) = 0
456: munmap(0x7fbd24ce7000, 2147688) = 0
457: munmap(0x7fbd24ae3000, 2109720) = 0
458: munmap(0x7fbd285ba000, 1052672) = 0
459: munmap(0x7fbd286c6000, 266240) = 0
460: munmap(0x7fbd2856b000, 323584) = 0
461: exit_group(0) = ?
462: +++ exited with 0 +++

Similar Messages

Failed to use LDAP over SSL MUTUAL AUTHENTICATION with some Directory enable SSL.

In iPlanet Web Server, Enterprise Edition Administration's guide, chapter 5: secure your web server - Using SSL and TLS protocol specifying that the Administrator server camn communicate LDAP over SSL with some Directory enable SSL.
Is there any way to configure iplanet Administration server to talk ldap/ssl in mutual authentication mode with some directory?

Hi,
Sorry, I could not understand what your are trying to do with iWS.
Could you please berifly explain your question. So that I can help you.
Regards,
Dakshin.
Developer Technical Support
Sun Microsystems
http://www.sun.com/developers/support.

Web Service over SSL failing in BEA Workshop

I have deployed a web service on weblogic 9.2
I have enabled one-way ssl on it. got a trial ssl certificate from verisign. installed them on the keystore/truststore on the server as well as the jre (cacerts and jssecacerts truststores) being used by the client. the client is on different machine than the server.
i have developed the service through 'bea weblogic workshop 9.2' now when i try to test the service through the 'web services explorer' within bea weblogic workshop i receive the following error:
IWAB0135E An unexpected error has occurred.
IOException
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
on server:
<Jul 13, 2009 6:45:44 PM EDT> <Warning> <Security> <BEA-090485> <CERTIFICATE_UNKNOWN alert was received from yunus.l1id.local - 10.10.2.72. The peer has an unspecified issue with the certificate. SSL debug tracing should be enabled on the peer to determine what the issue is.>
if i try to access the web service (over ssl) through the browser (ie/firefox), it works fine. i have generated a proxy class to access this web service through the same bea workshop and that works fine too. certificates are identified and all. i also created a small .net (c#) application that calls this secure web service over ssl from another machine and it works fine too!
of course non-secure url for the web service is working fine in every case.
what can be the reason for this failing only in 'web services explorer' in bea workshop?
cross posted at: http://www.coderanch.com/t/453879/Web-Services/java/Web-Service-over-SSL-failing
thanks.

Hello,
I used this example, when I made my experiments with SSL and Glassfish (GF):
http://java.sun.com/developer/EJTechTips/2006/tt0527.html#1
If you have problems with GF I suggest to post a message here:
http://forums.java.net/jive/forum.jspa?forumID=56
e.g. here is one thread:
http://forums.java.net/jive/thread.jspa?threadID=59993&tstart=0
Miro.

Cannot find api to implement RIDC connect WebCenter Content Server over SSL

Hi WebCenter Content team,
I find the following sample code from http://docs.oracle.com/cd/E23943_01/doc.1111/e10807/c23_ridc.htm#BJFIHEHI
Example 23-6 IDC Protocol over SSL
+// build a secure IDC client as cast to specific type+
IntradocClient idcClient = (IntradocClient)
manager.createClient("idcs://localhost:4443");
+// set the SSL socket options+
config.setKeystoreFile("ketstore/client_keystore"); //location of keystore file
config.setKeystorePassword ("password"); // keystore password
config.setKeystoreAlias("SecureClient"); //keystore alias
config.setKeystoreAliasPassword("password"); //password for keystore alias
I downloaded RIDC package from Individual Component Downloads in http://www.oracle.com/technetwork/middleware/webcenter/content/downloads/index.html.
But cannot find the above methods in IdcClientConfig and its subclasses. For example, cannot compile the following code.
IdcClientConfig config = idcClient.getConfig();
config.setKeystoreFile("ketstore/client_keystore"); // no such method
Could you please give a correct example.
Thanks a lot.

Most likely the port. RIDC listens usually at 4444, 16200 is the port for browser-based communication.

Ldapbind failed over SSL (U2 – "one way", "U3-two way") from Oracle DB to

Hi
I am facing the below error when I try ldapbind (database server to OID) over SSL (U2 – “one way”, “U3-two way”)
*** ACTION NAME:() 2010-09-29 07:09:46.691
*** MODULE NAME:(sqlplus@alddbux01 (TNS V1-V3)) 2010-09-29 07:09:46.691
*** SERVICE NAME:(SYS$USERS) 2010-09-29 07:09:46.691
*** SESSION ID:(121.274) 2010-09-29 07:09:46.691
kzld_discover received ldaptype: OID
KZLD_ERR: DB-OID SSL auth failed. Err=0
KZLD is doing LDAP unbind
KZLD_ERR: found err from kzldini
Environment details:
OID Server:
OS: Enterprise Linux Enterprise Linux AS release 5.3
Hostname : aldidmux02
Oracle Internet Directory 11.1.1.2.0
Realm in this OID is “dc=mycmsc,dc=com”
Oracle Database Server:
OS: Sun Solrais 5.10
Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bit Production
Hostname: alddbux01
Key points:
1.     As per metalink notes 466662.1, I am trying to setup EUS between DB - OID.
First difference I see here is OID version (10.1.4.0.1) in notes & using OID 11g (11.1.1.2.0) in my environment for testing.
a)     Are these steps applicable for OID11g(11.1.1.2.0) version?
b)     If not please provide me the references for achieving ldap authentication from Oracle database server with OID 11g as ldap user repository.
c)     As per task1 > step3 For the first time oidctl command is used to connect & start the instance before starting services using opmnctl. What is the procedure to do the same in OID11g?
2.     Wallet certificates in my environment OID & Database server status shows “Ready”

Is it possible to get an answer on this one from someone who knows?
"Leif Kristian Vadseth" <[email protected]> wrote in
message news:[email protected]..
In WLS 6.0 I was able to configue the server SSL protocol so that when
accessing the server (web application) from a web browser over https, the
browser showed a list of matching installed client certificates that the
client can choose, but the client could choose not to present his/hers
certificate and still continue to access the requested resources.
In WLS 6.1 I have not been able to repeat this behaviour, even if the SSL
configuration is exactly the same.
The project I work in wants to have both one-way SSL (using only username
and password for authentication) and two-way SSL (using both
username/password and certificate for authentication) in the same server.
Is it possible to configure the server the way I want or do we have to
configue two servers; one that does not require mutual authentication, and
one that requires this?
Leif Kristian Vadseth

WebDAV not working over SSL on CSS11503

SOME HISTORY
As you may recall we had an issue with interoperability between our WebCT Vista application and the Cisco CSS11503 Load Balancer. In a nutshell the Load Balancer would inject custom HTTP headers into HTTP packets, but only into the first HTTP packet of a TCP session. With your help we've learned that Cisco will change this in the August release of the CSS software.
OUR NEW PROBLEM
We are now having a related problem. In short, we cannot get WebDav to work over SSL. That is, when connect from Client to Load Balancer via SSL, and then Load Balancer to Web Server via plaintext, our application fails. Conversely, when we maintain a clear text connection straight through from Client to Web sever WebDav works.
After doing some network traces of WebDav connections both with and without SSL I think we've discovered the cause of the problem: the Load Balancer fails to add our custom HTTP header "WL-Proxy-SSL: true" to HTTP "PROPFIND" requests, even though it correctly adds them to the HTTP "OPTIONS" requests.
HOW WE CONFIGURED THE LOAD BALANCER
We configured our Load Balancer with the Global configuration of
http-method parse RFC2518-methods
and with the command
ssl-server 20 http-header static "WL-Proxy-SSL: true"
so that the header "WL-Proxy-SSL: true" will be passed with the HTTP headers used for WebDav was well as with the 'standard' HTTP headers "GET, POST, HEAD", etc.
Below is the relevant passage from the "CSS Command Reference" at
http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_750/cmdrefgd/cmdgloba.htm#wp1432749
======================================================================
"By default, a Layer 5 content rule supports the HTTP CONNECT, GET, HEAD, POST, and PUT methods. Unless configured, the CSS recognizes and forwards the following HTTP methods directly to the destination server in a transparent caching environment, but does not load balance them:
OPTIONS, TRACE, PROPFIND, PROPPATCH, MKCOL, MOVE, LOCK, UNLOCK, COPY, and DELETE.
When you enable the CSS to support all RFC-2518 methods, the CSS parses the Request-URI field in an attempt to match a Layer 5 rule. If the contents of the Request-URI field are not in a compliant format of an absolute URI or an absolute path, the CSS tries to match the field to the next best wildcard ("/*") rule. If the match fails, the CSS attempts to match the Layer 4 rule, and then the Layer 3 rule."
========================================================================
I interpret this to mean that when we configure "http-method parse RFC2518-methods" that the load balancer will treat all the HTTP headers in the group "OPTIONS, TRACE, PROPFIND, ...", etc the same as the "standard" HTTP headers "GET, POST, HEAD", etc.
As I said earlier our network traces show that the "WL-Proxy-SSL: true"
header present in the HTTP header OPTIONS but *not* in the header "PROPFIND".
A BUG IN THE CSS COMMAND PROCESSOR?
By my reckoning, this behaviour must be a bug in the CSS Command processor, because whatever the CSS does for the "OPTIONS" header it should also do for the "PROFIND" header.
ATTACHMENTS
I've included three attachments.
trace.txt
- text output from Ethereal of the network trace
on the web server, with comments.
webdav.ssl.snoop
- the original network trace in Sun's 'snoop' format.
css.2.cfg
- the running configuration on the CSS11503
Thanks in advance for your help.

Hi
I finally discovered what is the issue here. In appears that in case of unsigned applets, the code is unable to access SunJCE provider which contains most of the ciphers used by SSL protocol. This means that a session with SSL server is broken and effectively applet is not initialised.
This problem is related to configuration of JRE under linux due to export control restrictions. Unfortunately I don't know how to make JRE to use SunJCE by default.
As a workaround I have set up the following policies using Policy Manager:
grant {
permission java.security.SecurityPermission "putProviderProperty.SunJCE";
grant {
permission java.lang.RuntimePermission "getProtectionDomain";
grant {
permission java.lang.RuntimePermission "accessClassInPackage.sun.security.*";
I don't know how insecure my actions are, but this definitely fixed problems with applets under SSL / HTTPS.
Feel free to send me your ideas how to fix this issue in more elegant way.
Best,
Marcin

Trying to determine if LDAP over SSL is working using LDP.exe

Hi,
I just wanted to confirm that LDAP over SSL is working properly on our domain controller. When I connect using LDP.exe on my Windows 7 computer, I get the following output:
ld = ldap_sslinit("dc1.domain.com", 636, 1);
Error 0 = ldap_set_option(hLdap, LDAP_OPT_PROTOCOL_VERSION, 3);
Error 0 = ldap_connect(hLdap, NULL);
Error 0 = ldap_get_option(hLdap,LDAP_OPT_SSL,(void*)&lv);
Host supports SSL, SSL cipher strength = 128 bits
Established connection to dc1.domain.com.
Retrieving base DSA information...
Getting 1 entries:
Dn: (RootDSE)
<unnecessary details>
It looks like it is working, but I wasn't sure if the Error 0's mean there is some sort of problem.
Also, when I run a Simple bind with my credentials, I get the following output:
res = ldap_simple_bind_s(ld, 'myuseraccount-at-domaindotcom', <unavailable>); // v.3
Authenticated as: 'DOMAIN\myuseraccount'.
Finally, when I run a Bind as currently logged on user (with Encrypt traffic after bind checked), I get the following output:
53 = ldap_set_option(ld, LDAP_OPT_ENCRYPT, 1)
res = ldap_bind_s(ld, NULL, &NtAuthIdentity, NEGOTIATE (1158)); // v.3
{NtAuthIdentity: User='NULL'; Pwd=<unavailable>; domain = 'NULL'}
Authenticated as: 'DOMAIN\myuseraccount'.
I followed all the instructions found in Microsoft article KB-321051 to get LDAP over SSL working with a valid 3rd party certificate on one of our Windows 2008 R2 domain controllers. However, when I test Active Directory Authentication on our
WatchGuard Management Server after importing the CA certificate, the test fails. In order to use Active Directory Authentication, LDAPS (LDAP over SSL) must be enabled in the Active Directory domain and I am not 100% sure that it is enabled properly.
Any advice or additional insight would be greatly appreciated.
Thanks!

Some ideas:
DNS Name: KB-321051 says that you need the DNS name in either Subject CN or Subject Alternative Name. Which one did you use? Windows clients are fine with an empty CN and only the SAN populated (there the "either or" statement in the article)
but third-party tools often look for the DNS name in the Subject CN.
Even if the WatchGuard Server runs on Windows it might use its own certificate checking logic.
DC certificate(s): Does the DC have more than this certificate? If yes I'd run a network trace to check which one the machine is actually sending in the SSL handshake.
Chaining issues at your LDAP client / the WatchGuard Management Server:
Very often such issues are related to the fact that the certificate chain is not validated properly. Some typical issues:
It is not clear whether the client uses the Windows certificate store (even if it runs on a Windows server).
Tools / systems / PKI clients can only deal with a single root CA, not with a hierarchy.
You need to import both Root and intermediate CAs as the client cannot fetch the intermediates from AIA URLs.
The client cannot access CRL URLs because of firewalls rules or missing access (e.g.: A CRL URL in AD is used but the client does not have an AD user in whose context it would try to fetch the CRL).
The client has issues with blanks or special characters in CDP or AIA URLs.
Having a quick look at
WatchGuard documentation it seems to me that they are using their own certificate stores you need to import CA certificates to. And they only mention a "Root CA" so if your PKI has two levels you might need to import both CAs to the so-called Root store.
Elke

DP's have Warning "Failed to retrieve the package list on the distribution point" - How to Clear it?

All but one of my DP's (A new one I just created) have this Warning Message: "Failed to retrieve the package list on the distribution point". They all seem to be working, I can update and push new content to them.
When I go to the smsdpmon.log, it has an error for a package, but I've since redistributed it, and it is working fine. (Items below are snips from the smsdpmon.log)
CContentDefinition::LibraryPackagesWmi: The package data in WMI is not consistent to PkgLib SMS_Distribution_Point_Monitoring 11/16/2013 6:00:01 PM 3920 (0x0F50)
CContentDefinition::LibraryPackagesWmi: Package PS10011B can't be found in PkgLib SMS_Distribution_Point_Monitoring 11/16/2013 6:00:01 PM 3920 (0x0F50)
CContentDefinition::LibraryPackagesWmi failed; 0x80004005 SMS_Distribution_Point_Monitoring 11/16/2013 6:00:01 PM 3920 (0x0F50)
Failed to evaluate package PS10011B, Error code 0x80070002 SMS_Distribution_Point_Monitoring 11/16/2013 6:29:50 PM 3920 (0x0F50)
Since then, after redistributing the package, it clears up the logs... but not the warning in Monitoring:
Start to evaluate package share for package 'PS10011B' version 0 ... SMS_Distribution_Point_Monitoring 11/18/2013 12:39:52 PM 868 (0x0364)
Package PS10011B is verified successfully SMS_Distribution_Point_Monitoring 11/18/2013 12:39:52 PM 868 (0x0364)
So since everything appears to be working fine, how do I clear out that Warning, so I have nice Green Check Mark Icons in my Monitoring Tab, so when something actually does go wrong, I won't just ignore it since it's always been set to Warning?

I'll have to review this. The script
here, alone did not solve the my issue. Interesting that it say I do not have any inconsistencies on any my DP's now, but I run the other one on a single DP, it states I have inconsistencies still.
$WMIPkgList = Get-WmiObject -Namespace Root\SCCMDP -Class SMS_PackagesInContLib | Select -ExpandProperty PackageID | Sort-Object
$ContentLib = (Get-ItemProperty HKLM:SOFTWARE\Microsoft\SMS\DP).ContentLibraryPath
$PkgLibPath = ($ContentLib) + "\PkgLib"
$PkgLibList = (Get-ChildItem $PkgLibPath | Select -ExpandProperty Name | Sort-Object)
$PkgLibList = ($PKgLibList | ForEach-Object {$_.replace(".INI","")})
$PksinWMIButNotContentLib = Compare-Object -ReferenceObject $WMIPkgList -DifferenceObject $PKgLibList -PassThru
##### section 1 #######################
Write-Host Items in WMI but not the Content Library
Write-Host ========================================
$PksinWMIButNotContentLib
Foreach ($Pkg in $PksinWMIButNotContentLib){
Get-WmiObject -Namespace Root\SCCMDP -Class SMS_PackagesInContLib -Filter "PackageID = '$Pkg'" | Remove-WmiObject -Confirm
I wonder if the first script is not looking for INI's whereas the second one is. I verified that the INI's do exist...
I'll run the second on all of my DP's, remove the left over INI's, and report back again next week on status.
-Tony

All DPs read "Failed to retrieve the package list on the distribution point"...

About 2 weeks ago all 10 of my DPs started reporting the following warning (roughly 2 weeks after upgrading to R2):
"Failed to retrieve the package list on the distribution point ["Display=\\<server.FQDN>\"]MSWNET:["SMS_SITE=<code>"]\\<server.FQDN>\. Or the package list in content library doesn't match the one in WMI. Review
smsdpmon.log for more information about this failure.
This warning has appeared in my environment once before and I've read a number of posts regarding it. In the previous situation I found the problematic package ID recorded in smsdpmon.log and followed the standard procedure of redistributing and then proceeded
with a validation check on the affected DP. These steps resolved the issue originally.
This time around the package ID is not referenced in smsdpmon.log. It had the same error but the ID was not listed. Unfortunately the logs have already rolled over and I forgot to save a copy so I don't have anything to reference. I'm curious if anyone else
has seen this behavior and what the recommended fix is.
As always, appreciate the help!

I used the following process to clean up these warnings on my DPs:
Setup content validation checks for each of my affected DPs to run every morning (previously only set to weekends). I did this so when I made a change I could validate whether or not it worked the following day. It would be great if there was a way to force
these checks manually but I haven't found a method yet.
After the content validation check completed I filtered through the smsdpmon.log on each affected DP. This revealed the package ID that was causing the issue.
In my environment the package in question was not needed so I deleted it. If it is required I suspect re-distributing it would work as well.
At this stage the problem was still not fully resolved for me. Even though I had deleted the package WMI was still inaccurate. I used this script to scrub WMI on all affected DPs and it picked up the problematic package ID:
http://gallery.technet.microsoft.com/Powershell-script-to-fix-81dc4e69
My content validation checks are now passing and the warnings are being cleared. YEAH!
As a final note - After running the PS script Nickolaj posted I ran started seeing dozens of error checks on my packages (Distribution Manager failed to process package "Laptop Drivers" (package ID = XYZ00123).) After doing some research
I found I was prone to this issue:
Failed to start DP health monitoring task. In my case the suspect file was called "Microsoft". I moved it to another location and the errors cleared immediately.
Hope this info is helpful to others!

Connecting to a remote OpenLDAP server over SSL.

I've been trying for several weeks now to get a remote OpenLDAP server up and running; configured in such a way that it only allows SSL and requires certificate validation.
I've created a CA with a self-signed certificate.
I used that CA to create a server and client certificate.
The server certificate is in /etc/ssl/certs, has a link by the name of its hash.0 pointing to it; permissions are all correct and /etc/ssl/slapd.conf point to it and the CA certificate.
The client certificate is on my MacBook Pro in /etc/ssl/certs along with the CA certificate; each of which also has its hash linked to it. /etc/ssl/ldap.conf is set up properly, the permissions are correct, and the following test command ran as my user produces a successful result:
ldapsearch -v -x -H ldaps://ldap.foo.org -b "dc=foo,dc=org" -d -1
Now the problem part. I open Directory Utility; go to Services with Advanced Settings enabled. After unlocking it, I click the LDAPv3 and the pencil icon.
I hit New... in the window that pops up and use ldap.foo.org as servername, SSL box ticked. I hit Continue, and behold; nothing happens.
It is to say; Directory Utility hangs for a while; after which it goes back to the box I clicked Continue in without any error or warning popping up; but obviously hasn't advanced.
The server logs indicate my Mac had actually connected; received the server certificate; but didn't send a client certificate at which point the TLS connection got aborted for some reason and the session ended.
My Mac Console shows something even more bizare, though:
11/09/08 23:09:22 com.apple.DirectoryServices[97123] Assertion failed: (ld != NULL), function ldapsearchext, file search.c, line 76.
My suspicion is that Directory Utility can't verify the server certificate and aborts the TLS connection. I expect it also uses /etc/openldap/ldap.conf? How can I diagnose the root of this problem?
Thanks a lot for your assistance; I just can't figure this out and any hint or pointer would be greatly appreciated. It now just looks like OSX does not support a secure LDAP over SSL configuration.
Though it currently isn't set up to be that way, I'd like to have my client also provide a certificate (CN=lhunath.foo.org) and have the server validate that. For now I've got the server set to:
TLSVerifyClient never
(And of course, the client:)
TLS_REQCERT demand
Message was edited by: lhunath

By the way; about the assertion error I get in Console; here's the relevant source of ldap.c. Looks like ld is not set; probably something going wrong before that with setting up the TLS connection, perhaps? Or not?
* ldapsearchext - initiate an ldap search operation.
* Parameters:
* ld LDAP descriptor
int
ldapsearchext(
LDAP *ld,
assert( ld != NULL );

How to set up iPhone 5 iOS 6 email with IMAP over SSL on a custom port?

Basically I have the same problem as this guy 5 years ago but the thread contained no useful answer. Maybe there are people out there who became smarter in the meantime? Please help me out how to get my iPhone read emails via IMAP over SSL on a custom port to the corporate server. The issue is that the iPhone only seems to work if you use the standard 993 port for IMAPS, not with a custom port as we have. I've installed the corporate root certificate in a profile, and it shows up as trusted and verified in the phone, so that should not be the issue. The mail app in the iPhone tries to connect, I can verify that from the server, but then does nothing, doesn't try to authenticate, doesn't log out, nothing is going on, and then drops the connection after 60 seconds. Repeats this every 5 minutes (as set to fetch e-mail every 5 minutes.)
Original thread 5 years ago: https://discussions.apple.com/message/8104869#8104869

Solved it by some (a lot) of fiddling.
Turns out it's not a bug in the iPhone, it's a feature.
Here's how to make it work.
DOVECOT
If the IMAPS port is anything other than 933 (the traditional IMAPS port) the iPhone's Mail App takes the "Use SSL" setting on the IMAP server as 'TLS', meaning it starts the communication in plain text and then issues (tries to issue) the STARTTLS command to switch the connection to encrypted. If, however, Dovecot is set up to start right away in encrypted mode, the two cannot talk to each other. For whatever reason neither the server nor the client realizes the connection is broken and only a timeout ends their misery.
More explanation about SSL/TLS in the Dovecot wiki: http://wiki2.dovecot.org/SSL
So to make this work, you have to set Dovecot the following way. (Fyi, I run Dovecot 2.0.19, versions 1.* have a somewhat different config parameters list.)
1. In the /etc/dovecot/conf.d/10-master.conf file make sure you specify the inet_listener imap and disable (set its port to 0) for imaps like this:
service imap-login {
inet_listener imap {
    port = --your port # here--
inet_listener imaps {
    port = 0
    ssl = yes
This of course enables unencrypted imap for all hackers of the universe so you quickly need to also do the things below.
2. In the /etc/dovecot/conf.d/10-ssl.conf file, make sure you set (uncomment) the following:
ssl = required
This sets Dovecot to only serve content to the client after a STARTTLS command was issued and the connection is already encrypted.
3. In /etc/dovecot/conf.d/10-auth.conf set
disable_plaintext_auth = yes
This prevents plain text password authentication before encryption (TLS) is turned on. If you have also set ssl=required as per step 2, that will prevent all other kinds of authentications too on an unencrypted connection.
When debugging this, please note that if you connect from localhost (the same machine the server runs on) disable_plaintext_auth=yes has no effect, as localhost is considered secure. You have to connect from a remote machine to make sure plain text authentication is disabled.
Don't forget service dovecot restart.
To test if your setup works as it's supposed to, issue the following (green) from a remote machine (not localhost) (I'm using Ubuntu, but telnet and openssl is available for almost all platforms) and make sure Dovecot responds with something like below (purple):
telnet your.host.name.here yourimapsportnumber
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot ready.
Most importantly, make sure you see 'STARTTLS' and 'LOGINDISABLED'. Then issue STARTTLS and hopefully you see something like this:
a STARTTLS
a OK Begin TLS negotiation now.
(The 'a' in front of STARTTLS is not a typo, a prefix is required by the IMAP server in front of all commands.)
Close the telnet (with 'a logout' or Ctrl+C) and you can use openssl to further investigate as you would otherwise; at the end of a lot of output including the certificate chain you should see a line similar to the one below:
openssl s_client -starttls imap -connect your.domain.name.here:yourimapsportnumber
. OK Pre-login capabilities listed, post-login capabilities have more.
You can then use the capability command to look for what authentication methods are available, if you see AUTH=PLAIN, you can then issue a login command (it's already under an encrypted connection), and if it's successful ("a OK Logged in"), then most likely your iPhone will be able to connect to Dovecot as well.
a capability
* CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN
a login username password
* CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS
a OK Logged in
POSTFIX
Likewise, you have to set Postfix to wait for STARTTLS before encrypting the communication.
1. You have to delete the setting smtpd_tls_wrappermode=yes from /etc/postfix/master.cf and/or /etc/postfix/main.cf, if it was enabled. This will mean Outlook won't be able to connect any more because it requires a TSL connection without issuing STARTTLS as per Postfix documentation (haven't tested.) In my case we don't use Outlook so I didn't care. Outlook + iPhone + custom SMTPS port are simply not possible together at the same time as far as I understand. Pick one to sacrifice.
2. Require encrypted (TLS) mode for any data transfer in /etc/postfix/main.cf:
smtpd_tls_security_level = encrypt
3. Authentication should only happen while already in encrypted (TLS) mode, so set in /etc/postfix/main.cf:
smtpd_tls_auth_only = yes
Don't forget postfix reload.
To test if this works, issue the following telnet and wait for the server's greeting:
telnet your.host.name.here yoursmtpsportnumber
220 your.host.name ESMTP Postfix (Ubuntu)
Then type in the EHLO and make sure the list of options contains STARTTLS and does not include an AUTH line (that would mean unencrypted authentication is available):
ehlo your.host.name.here
250-STARTTLS
Then issue starttls and wait for the server's confirmation:
starttls
220 2.0.0 Ready to start TLS
Once again, it's time to use openssl for further testing, detailed info here http://qmail.jms1.net/test-auth.shtml
CERTIFICATES
You also need to be aware that iOS is somewhat particular when it comes to certificates. First of all, you have to make sure to set the following extensions on your root certificate (probably in the [ v3_ca ] section in your /etc/ssl/openssl.cnf, depending on your openssl setup), especially the 'critical' keyword:
basicConstraints = critical,CA:true
keyUsage = critical, cRLSign, keyCertSign
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
And then on the certificate you sign for your mail server, set the following, probably in the [ usr_cert ] section of /etc/ssl/openssl.cnf:
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
subjectAltName = DNS:your.domain.name.here
issuerAltName=issuer:copy
Please note, the above are results of extensive google-ing and trial and error, so maybe you can omit some of the stuff above and it still works. When it started working for me, I stopped experimenting because figuring this all out already took way too much time. The iPhone is horribly undocumented when it comes to details of its peculiar behaviors. If you experiment more and have more accurate information, please feel free to post here as a reply to this message.
You have to import your root certificate into your iPhone embedded in a profile via the iPhone Configuration Utility (free, but only available in Windows or a Mac; details here: http://nat.guyton.net/2012/01/20/adding-trusted-root-certificate-authorities-to- ios-ipad-iphone/ ), after having first added it to Windows' certificate store as a trusted root certificate. This way the Utility will sign your certificate for the phone and it becomes usable; if you just add it from the phone it will be there but won't be used. Using a profile has the added benefit of being able to configure mail settings in it too, and that saves a lot of time when you have to install, remove, reconfigure, install again, etc. a million times until it works.
Another undocumented constraint is that the key size is limited to a max of 4096. You can actually install a root certificate with a larger key, the iPhone Configuration Utility will do that for you without a word. The only suspicious thing is that on the confirmation screen shown on your iPhone when you install the profile you don't get the text "Root Certificate/ Installing the certificate will add it to the list of trusted certificates on your iPhone" in addition to your own custom prompt set up in the iPhone Configuration Utility. The missing additional text is your sign of trouble! - but how would know that before you saw it working once? In any case, if you force the big key certificate on the device, then when you open the Mail App, it opens up and then crashes immediately. Again, without a word. Supposedly Apple implemented this limit on the request of the US Government, read more here if you're interested: http://blogs.microsoft.co.il/blogs/kamtec1/archive/2012/10/13/limitation-of-appl e-devices-iphone-ipad-etc-on-rsa-key-size-bit.aspx .
IN CLOSING...
With all this, you can read and send email from your iPhone.
Don't forget to set all your other clients (Thunderbird, Claws, etc.) to also use STARTTLS instead of SSL, otherwise they won't be able to connect after the changes above.

Failed to Retrieve SQL

Hi,
Using STANDARD REPORT CREATION WIZARD, I connected to UNIVERSES Data Sources and RUN a querry in BUSINESS OBJECTS QUERY PANEL,i am getting ERROR Message "Failed to Retrieve SQL".What would be the causes?
Thanks,
Sandeep

Hi,
try this link, [Click HEre|http://www.forumtopics.com/busobj/viewtopic.php?t=40450&sid=14981ec8c36d528ba129eedb58fe2e18]
Regards,
Clint

AD Password Sync connector 9.1.1 With OIM 11g R2 - ERROR OVER SSL

I have set up AD password sync with from AD to OIM 11G R2
The password syncs from AD to OIM 11G R2 on non ssl port 389.
But if fails on SSL Port 636.
Errors in OIMMain.Log:_
Debug [10/11/2012 10:49:34 AM] Inside ConnectToADSI
Debug [10/11/2012 10:49:34 AM]
ldap_connect failed with
Debug [10/11/2012 10:49:34 AM] Server Down
Debug [10/11/2012 10:49:34 AM]
Steps Carried Out thus far:_
AD is up and running.
Configured AD Password Sync Connector on 636 and selected ssl.
Created Certificate on OIM host, configured custom identity key store on weblogic. Restarted Weblogic.
Imported Certificate to AD. After this, restarted the AD
I can Telnet port 636 from OIM Box and also connect to AD through LDAP Browser on 636 and view OU and CN, so this seems fine.
Provisioning from OIM through Connector Server to AD works over SSL and this works fine.
Help would be appreciated.
Many Thanks

This question is now been fixed.
Instead of explicitly stating 636 for SSL,
Use the same port 389 for ssl and also configured oim port to be 140001 which is the ssl port for oim in the configuration of OIM Password Sync.
Export Certificates from AD to java security keystore and to weblogic keystore
Export .pem certificate created on OIM host machine to AD.
Restart weblogic, oim and AD
Everything would work fine.
For all the other information, refer to doc.
Thanks

BizTalk Tracking Profile Editor not tracking the data and how to implement the Orchestration as wcf service over SSL

Hi Ashwinprabhu,
thank you very much for your answer.
i have one more query, I have orchestration published as wcf service in IIS and internally orchestration calling one more service , it means orchestration sending a request and getting response back from the service.
actually we are implementing the copy of that called service through biztalk orchestration for system automatic and tracking failed messages and n/w failures.
But tracking profiler not tracking the Data.
And we need to develop the http service as https(Over SSL), we implemented in iis using self
signed certificate, it is working just browser for wsdl(in browser), we are not able to test the service in wcf test client, it is giving wsdl error, in wsdl schema reference showing with HTTP only,
please help me how to resolve the issue.
Teegala

First things first, I think it's best to publish only schemas as WCF service for dependency management reasons. That said - WSDL availability is covered in the WCF adapter under the behaviors. If you're using HTTPBasic this may be hard to modify, but using
WCFCustom allows you to add the WSDL behavior and specify that it should be available via HTTPS.
As to the BAM, are you using TPE within the orchestration or at the port level? I'd imagine your TPE tracks the start and end events of your orchestration using the Orchestration Schedule. If you're fairly confident that the TPE is correct and
yet don't see BAM data 1) make sure your SQL Agent is running healthy and all jobs look OK and 2) check the TDDS tables in both the message box and the BAMPrimaryImport databases. These will show you if there has been some sort of sync issue. There's
even a TDDS errors tables - so check that out.
Kind Regards,
-Dan
If this answers your question, please Mark as Answer

Failed to open XML document. Failed to retrieve Public ID

I have a client posting to Weblogic 6.1 server with the help of Apache
SOAP 2.2. The posting works fine if the contents of the SOAP message
is small. But when the contents of SOAP reached more than 11KB, the
following error occurs:
Error: Failed to open XML document. Failed to retrieve PUBLIC id or
SYSTEM id from the document. Decrease the number of char between the
beginning of the document and its root element.
The SOAP document looks like:
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Body>
<mn:sMethodName xmlns:mn="sMethodURI">
<batch appid="1">
<employee>
<name>...</name>
<address>...</address>
</employee>
<employee>
<name>...</name>
<address>...</address>
</employee>
</batch>
</mn:sMethodName>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
The Max Post Size in Weblogic is set to (-1).
The program is able to handle less than 50 items of
<employee>.....</employee>. The error occurs when more than 50 items
are used. The problem is that our application should be able to handle
more than 1000 items of <employee>....</employee>.
My questions are:
1. How should I configure weblogic to solve the problem?
2. How should I configure the deployment of Apache SOAP to solve the
problem?
Pls advise. Thanks.

One can deduce from the error message that the parser is looking for the
<?XML...?> portion of the document because that is where the SYSTEM and
PUBLIC ids are found in the document.
Peace,
Cameron Purdy
Tangosol Inc.
Tangosol Coherence: Clustered Coherent Cache for J2EE
Information at http://www.tangosol.com/
"Grace" <[email protected]> wrote in message
news:[email protected]...
>
Sorry, but I didn't get what you mean. I thought that was handled by theApache
SOAP API already? And if it couldn't see the XML document header, then whydoes
this only happens when the document size is large? It doesn't haveproblems whenever
the document size is small.
"Cameron Purdy" <[email protected]> wrote:
It's looking for the XML document header "<?XML" ....
Peace,
Cameron Purdy
Tangosol Inc.
Tangosol Coherence: Clustered Coherent Cache for J2EE
Information at http://www.tangosol.com/
"Grace" <[email protected]> wrote in message
news:[email protected]...
I have a client posting to Weblogic 6.1 server with the help of Apache
SOAP 2.2. The posting works fine if the contents of the SOAP message
is small. But when the contents of SOAP reached more than 11KB, the
following error occurs:
Error: Failed to open XML document. Failed to retrieve PUBLIC id or
SYSTEM id from the document. Decrease the number of char between the
beginning of the document and its root element.
The SOAP document looks like:
<SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Body>
<mn:sMethodName xmlns:mn="sMethodURI">
<batch appid="1">
<employee>
<name>...</name>
<address>...</address>
</employee>
<employee>
<name>...</name>
<address>...</address>
</employee>
</batch>
</mn:sMethodName>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
The Max Post Size in Weblogic is set to (-1).
The program is able to handle less than 50 items of
<employee>.....</employee>. The error occurs when more than 50 items
are used. The problem is that our application should be able to handle
more than 1000 items of <employee>....</employee>.
My questions are:
1. How should I configure weblogic to solve the problem?
2. How should I configure the deployment of Apache SOAP to solve the
problem?
Pls advise. Thanks.

PHP failing to retrieve content over ssl

Similar Messages

Maybe you are looking for