Unprettyfied SSL error message?

Question

I am trying to authenticate using my USB smartcard reader to a website.

I am running Ubuntu 10.04 LTS, with its most up to date Firefox browser 3.6.24.

I get the following error message:

Secure Connection Failed

An error occurred during a connection to www.socialsecurity.be.

SSL peer was unable to negotiate an acceptable set of security parameters.

(Error code: ssl_error_handshake_failure_alert)

• The page you are trying to view can not be shown because the authenticity of the received data could not be verified.
• Please contact the web site owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.

FUBAR

Now of course there are multiple potential problems, so I looked them up to try different configurations and settings (at a certain point SSL was modified due to a previously unknown attack)

Note that the error message seems selfcontradicting: either there was a mismatch between security parameters acceptable to the server and those acceptable to my setup, or data was sent but I miss a certificate or data was corrupted such that the hash is not the same as the one in the signature,...

Is it possible to display the mismatch of security parrameters? Is it possible to display the signature and the entity it refers to such that I can check if I have the certificate or if there's a new one or ...?

In theory I could start to debug mozilla, but I am not in the mood to start debugging a huge complex software like mozilla if somebody else can give me a tip on how to identify the real problem (other than that the error message has been standardized and prettyfied beyond all recognition).

Authentication is supposed to rely on the Belgian eID add-on (1.0.14) for FireFox. I have openjre and icedtea.

Since this is more of a question about mozilla firefox I thought unix/linux was more suitable than Ubuntu, mod's feel free to move if necessary.

Answer 1

Apparently my setup doesn't work with the featured 1.0.14 from code.google.com I used the 1.0.12 version as such:

• go to eID quick install page
• download their most recent .deb (contains Firefox eID add-on 1.0.12)
• close all Firefox instances
• connect USB reader to computer
• insert eID card into reader
• start browser
• ignore message that eID add-on could not properly configure your card (with their trojan)
• verify that the add-on works by going to edit->preferences->advanced->encryption->view certificates->your certificates
• you should see your 2 certificates loaded (from your eID card)

If you get this far (and see the certificates, and hence rule out problems between the card, the card reader, eIDaddon, and Firefox) but still can't identify with government sites, then make sure you have the right government root certificate (go to Certipost) and enable the 3 checkboxes (can always be changed in edit->preferences->advanced->encryption->view certificates->authorities)

If you still can't connect to them there must be a [secure] communication protocol problem (which wasn't the case with me): perhaps the government server is not adherent, perhaps your browser is not.

The error message above (ssl_cert_handshake_fell_down) could have been replaced by an error message saying the "eID could not properly (probably) install the rootkit"