Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to authenticate using my USB smartcard reader to a website.

I am running Ubuntu 10.04 LTS, with its most up to date Firefox browser 3.6.24.

I get the following error message:

Secure Connection Failed

An error occurred during a connection to www.socialsecurity.be.

SSL peer was unable to negotiate an acceptable set of security parameters.

(Error code: ssl_error_handshake_failure_alert)

  • The page you are trying to view can not be shown because the authenticity of the received data could not be verified.
  • Please contact the web site owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.

FUBAR

Now of course there are multiple potential problems, so I looked them up to try different configurations and settings (at a certain point SSL was modified due to a previously unknown attack)

Note that the error message seems selfcontradicting: either there was a mismatch between security parameters acceptable to the server and those acceptable to my setup, or data was sent but I miss a certificate or data was corrupted such that the hash is not the same as the one in the signature,...

Is it possible to display the mismatch of security parrameters? Is it possible to display the signature and the entity it refers to such that I can check if I have the certificate or if there's a new one or ...?

In theory I could start to debug mozilla, but I am not in the mood to start debugging a huge complex software like mozilla if somebody else can give me a tip on how to identify the real problem (other than that the error message has been standardized and prettyfied beyond all recognition).

Authentication is supposed to rely on the Belgian eID add-on (1.0.14) for FireFox. I have openjre and icedtea.

Since this is more of a question about mozilla firefox I thought unix/linux was more suitable than Ubuntu, mod's feel free to move if necessary.

share|improve this question
add comment

1 Answer

Apparently my setup doesn't work with the featured 1.0.14 from code.google.com I used the 1.0.12 version as such:

  • go to eID quick install page
  • download their most recent .deb (contains Firefox eID add-on 1.0.12)
  • close all Firefox instances
  • connect USB reader to computer
  • insert eID card into reader
  • start browser
  • ignore message that eID add-on could not properly configure your card (with their trojan)
  • verify that the add-on works by going to edit->preferences->advanced->encryption->view certificates->your certificates
  • you should see your 2 certificates loaded (from your eID card)

If you get this far (and see the certificates, and hence rule out problems between the card, the card reader, eIDaddon, and Firefox) but still can't identify with government sites, then make sure you have the right government root certificate (go to Certipost) and enable the 3 checkboxes (can always be changed in edit->preferences->advanced->encryption->view certificates->authorities)

If you still can't connect to them there must be a [secure] communication protocol problem (which wasn't the case with me): perhaps the government server is not adherent, perhaps your browser is not.

The error message above (ssl_cert_handshake_fell_down) could have been replaced by an error message saying the "eID could not properly (probably) install the rootkit"

share|improve this answer
    
afterwards in about:config I changed the 4 security.ssl. settings to their strictest form, restarted firefox, and succesfully authenticated again, so that at least for that goverment site SSL seems to be well implemented. –  propaganda Jan 24 '12 at 2:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.