2

I'm trying to mount a remote WebDAV (OwnCloud) using https on my Ubuntu 12.04 machine.

I run this command and it prompts me for a username and password

sudo mount -t davfs -o uid=ne,gid=users https://example/owncloud/remote.php/webdav/ /mount/remote

I then get the error

/sbin/mount.davfs: Mounting failed. SSL handshake failed: SSL error: sslv3 alert handshake failure

Other machines (including Android) are able to connect to the WebDAVS correctly.

How can I prevent this error? The certificate is signed by CloudFlare, if that makes a difference - but that doesn't seem to cause a problem for any other systems accessing the OwnCloud instance.

Running curl -v https://example.com everything seems fine

* About to connect() to example.com port 443 (#0)
*   Trying 104.28.29.14... connected
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using ECDHE-ECDSA-AES128-SHA
* Server certificate:
*    subject: OU=Domain Control Validated; OU=PositiveSSL Multi-Domain; CN=sni29581.cloudflaressl.com
*    start date: 2014-10-26 00:00:00 GMT
*    expire date: 2015-09-30 23:59:59 GMT
*    subjectAltName: example.com matched
*    issuer: C=GB; ST=Greater Manchester; L=Salford; O=COMODO CA Limited; CN=COMODO ECC Domain Validation Secure Server CA 2
*    SSL certificate verify ok.
> GET / HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: example.com
> Accept: */*
> 
< HTTP/1.1 302 Moved Temporarily
< Server: cloudflare-nginx
< Date: Mon, 27 Oct 2014 11:30:08 GMT
< Content-Type: text/html
< Transfer-Encoding: chunked
< Connection: keep-alive
< Set-Cookie: __cfduid=da7fc86a1e00780f7eea162120e2c4fe51414409408265; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.example.com; HttpOnly
< Set-Cookie: DYNSRV=lin194; path=/
< CF-RAY: 17fe8f51aaa71365-LHR
< 
* Connection #0 to host example.com left intact
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):

I've also tried openssl s_client -host example.com -port 443 but that gives me Verify return code: 20 (unable to get local issuer certificate)

CONNECTED(00000003)
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - G2
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=CA/L=San Francisco/O=CloudFlare, Inc./CN=ssl2000.cloudflare.com
   i:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - G2
 1 s:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - G2
   i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
(truncated)
bJLtKDaYbNmULxY=
-----END CERTIFICATE-----
subject=/C=US/ST=CA/L=San Francisco/O=CloudFlare, Inc./CN=ssl2000.cloudflare.com
issuer=/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - G2
---
No client certificate CA names sent
---
SSL handshake has read 3158 bytes and written 363 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : ECDHE-RSA-AES128-SHA
    Session-ID: EAC9072E6FFBD3E7AEA20B6C4D57F229DCC887CFAB08C2D47C0A546318A794E0
    Session-ID-ctx: 
    Master-Key: 50ED2846908537665D348FCB07BB69ACEAD182F062F8235E5C7ED4958B4D446D70701E4C6876DE2DA06322BA090C46D5
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 64800 (seconds)
    TLS session ticket:
    0000 - f1 98 d3 dc 67 02 22 1f-24 88 b7 dc 1c 1a 13 6a   ....g.".$......j
    (truncated)
    Start Time: 1414409459
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)

I've tried updating to the latest libneon but that hasn't made a difference.

Update

Since upgrading to the latest OpenSSL, I now get a different error

SSL handshake failed: SSL alert received: Handshake failed

As suggested elsewhere, running openssl s_client -host example.com -port 443 -ssl3 returns:

Verify return code: 0 (ok)

I've compiled and installed libneon 30.1

./configure --prefix=/usr --enable-shared --with-ssl=openssl --disable-static

but the error persists.

1

Right, here's what I did!

Grab libneon 30.1 - and extract it to a directory.

Compile

./configure --prefix=/usr --enable-shared --with-ssl=openssl --disable-static
make
sudo make install

We now need to replace the old libneon-gnutls.so - and we want the end result to look like

/usr/lib/libneon-gnutls.so.27 -> /usr/lib/libneon.so.27
/usr/lib/libneon.so -> libneon.so.27.3.1
/usr/lib/libneon.so.27 -> libneon.so.27.3.1

First, back up the old version. sudo mv /usr/lib/libneon-gnutls.so.27 /usr/lib/libneon-gnutls.so.27.old

Then, in /usr/lib/

sudo ln -s /usr/lib/libneon.so.27.3.1 libneon.so.27 
sudo ln -s /usr/lib/libneon-gnutls.so.27.3.1 libneon.so 
sudo ln -s /usr/lib/libneon.so.27 libneon-gnutls.so.27

That made everything work!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.