topic Hi, in Software Archive

Problem with App Security API. Calling a web service in a server with self signed certificate

Ismael_M_ — Wed, 29 Jun 2016 09:18:27 GMT

Hello,

I'm developing an apk that communicates with a web service with a self-signed certificate and have problems with the App Security API.
- The error that gives me the device is "fail: code = 33, message authentication = Communication error"
- And in the emulator error is "fail: code = 16, message = Server not accessible error"

This is the function, the lines discussed, I think they are not useful because the function of webservice which I call has no input parameter, ie data only returns me.

function Prueba(){
    var options = { url: "https://XXXXXXXXXX", method:'POST', serverKey: "-----BEGIN PUBLIC KEY-----\nXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX-----END PUBLIC KEY-----" };
    intel.security.secureTransport.open(
        function (instanceID) {
		alert("Succeeded in open, instance id is: "+instanceID);
                var instance=instanceID;
			// Define the head Content-type
//    		intel.security.secureTransport.setHeaders(
//        		function(){
//					alert('Succeeded in setHeaderValue');
//					// Send the request
//					intel.security.secureTransport.sendRequest(
//						function(response){alert(response.responseBody);}, 
//						function(errorObj){alert('fail: code = '+errorObj.code+', message = '+errorObj.message);},
//						{instanceID:instance, requestBody:'', requestFormat:'JSON'}
//					);     
//				}, 
//        		function(errorObj){alert('fail: code = '+errorObj.code+', message = '+errorObj.message);},
//        		{instanceID:instance, 'key':'Content-Type', 'value':'application/xml'}
//    		);
            intel.security.secureTransport.sendRequest(
                function(response){alert(response.responseBody);}, 
                function(errorObj){alert('fail: code = '+errorObj.code+', message = '+errorObj.message);},
                {instanceID:instance, requestBody:'', requestFormat:'JSON'}
            ); 
        },
        function (errorMsg) {
            alert("failed callback is called, code: "+errorMsg.code+', message = '+errorMsg.message);
        },
        options
    );
}

I have seen the following thread because my problem is similar, but I could not fix it.

https://software.intel.com/es-es/forums/intel-xdk/topic/562592

Regards.

Hi Ismael,

Dennis_F_Intel — Wed, 29 Jun 2016 21:22:02 GMT

Hi Ismael,

Thank you for your interest in AppSecurityAPI.

Self signed certificate feature is not supported by the AppSecurityAPI on the XDK Emulator, however there exists a workaround.

In the link you provided, OHAD.B provides an explanation of how to enable this functionality on the XDK emulator for a specific server and how to correctly extract the public key for your server. Were you able to follow those examples?

Are you able to provide a full code snippet so we can recreate the issue?

thanks,

Dennis.

Hi Dennis,

Ismael_M_ — Thu, 30 Jun 2016 07:56:36 GMT

Hi Dennis,

Yes, I have followed all the steps to create public key.

This is my way to extract the public key certificate:

OpenSSL> x509 -pubkey -noout -in Certificado_SSL.cer
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqEKrwux1Pbpk5l1UNq7NoG5An
usSvqShTxKtuO35dSq+s36nXiiycZRatcPODVlFsVgW+6Gujl59rEF4SjKHOzyoQ
L9j8NyM7nIXfMoFQwjFEfNiip74/lkLjTmzrKiQAvuP/TzRdLHie6TqrgdxAUPkK
mdKgwkD7p82G0M+NrwIDAQAB
-----END PUBLIC KEY-----

This is the function complete:

function PruebaHTTPS(){
	var options = { 'url':"https://81.45.78.242/Service1.asmx/Sincronizar", 'method':"POST", serverKey:"-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqEKrwux1Pbpk5l1UNq7NoG5An\nusSvqShTxKtuO35dSq+s36nXiiycZRatcPODVlFsVgW+6Gujl59rEF4SjKHOzyoQ\nL9j8NyM7nIXfMoFQwjFEfNiip74/lkLjTmzrKiQAvuP/TzRdLHie6TqrgdxAUPkK\nmdKgwkD7p82G0M+NrwIDAQAB\n-----END PUBLIC KEY-----" };
	intel.security.secureTransport.open(
	function (instanceID) {
		alert("Succeeded in open, instance id is: "+instanceID);
		var myInstanceID=instanceID;  
        intel.security.secureTransport.setHeaders(   
			function(){
				alert('Succeeded in setHeaderValue');
				intel.security.secureTransport.sendRequest(
					function(response){
						alert('Succeeded in sendRequest, response.responseBody = ' + response.responseBody);
					},
					function(errorObj){
						alert('Failed in sendRequest, code = '+errorObj.code+', message = '+errorObj.message);
					},
					{'instanceID':myInstanceID}
				);
			},
			function(errorObj){
				alert('Failed in setHeaderValue, code = '+errorObj.code+', message = '+errorObj.message);
			},
			{'instanceID':myInstanceID}
		);
	},
	function (errorObj) {
		alert('Failed in open, code = '+errorObj.code+', message = '+errorObj.message);
	},
	options
	);  
}

Thanks.

Hi,

Dennis_F_Intel — Sun, 03 Jul 2016 12:10:00 GMT

Hi,

I'm getting timeout error when i try to open the url of your service, can you check that it is correct and accessible?

i don't get a response even in a browser.

Can you also detail for me the steps you took to generate the server key you use?

Thanks.

Dennis.

Hi DENNIS,

Ismael_M_ — Mon, 04 Jul 2016 06:27:19 GMT

Hi DENNIS,

The server has been shutdown at the weekeend.

To extract public key from a server.

- Download the certificate from the server URL (using browser go to the server’ URL, right click on the certificate (left side of the navigation bar), go to connection tab, click on certificate information, go to Details tab, copy to File, Next, Base 64 encoded x.509 (.cer), Next, c:\Certificado_SSL.cer, Save, Next and Finish).
Extract the public key from the certificate file using OpenSSL command line tool: OpenSSL> x509 -pubkey -noout -in Certificado_SSL.cer

Thank you so much.

Hi Ismael,

Dennis_F_Intel — Thu, 07 Jul 2016 22:26:00 GMT

Hi Ismael,

Please excuse me for the delay in response,

There are a number of possible reasons for the error you are getting.

AppSecurityAPI's Secure Transport API enforces a number of security policies.

Looking at your certificate i can see two possible issues, it uses an obsolete cipher suite (SHA-1) and in addition the Host name on the certificate is different then the host name in the URL (you provide an IP address).

Are you able to generate a new certificate for your web server that addresses these issues?

Dennis.