topic Timeouts posting XML after certificate upgrade in Integration and Testing

Timeouts posting XML after certificate upgrade

jayada — Sat, 06 Jun 2015 04:22:02 GMT

Having a bugger of a time here. We had a windows 2000 server with IIS5.0 working like a champ for a decade...then the A.N certificate updrade killed it. Upgraded our server to 2008 r2 with IIS7.5. We're using classic asp. I'm trying to use XML post and the thing keeps timing out on me. Posting to the test server works sweet...comes back fast, but in production I get the following:

using Msxml2.ServerXMLHTTP.6.0:

msxml6.dll error '80072ee2'

The operation timed out

using Microsoft.XMLHTTP:

msxml3.dll error '800c000b'

The operation was timed out.

Server has all the new certificates and got an A from www.ssllabs.com test (happy about that at least)

Clearly something is not right and it's likely very easy, but I'm stumped

Here's the post code

Dim xml
Dim strStatus
Dim strRetval
Set xml = Server.CreateObject("Msxml2.ServerXMLHTTP.6.0")

xml.Open "POST","https://secure.authorize.net/gateway/transact.dll?" & vPostData & "",false

xml.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"

xml.send ""

strStatus = xml.Status
strRetval = xml.responseText
Set xml = nothing

Someone must know the easy answer. My small brain cannot find it.

Re: Timeouts posting XML after certificate upgrade

kabutotx — Sat, 06 Jun 2015 06:11:03 GMT

Do you have a proxy setup? It uses different settings than IE. Can IE go to the https://secure.authorize.net site?

Re: Timeouts posting XML after certificate upgrade

jayada — Sat, 06 Jun 2015 12:55:02 GMT

No proxy.
We use godaddy for the certificate chain, however all recommended certificates are installed. Is there a new encryption required to encrypt the XML string before posting it something? The test server and production ought to be the same, but clearly and frustratingly they are not.

Re: Timeouts posting XML after certificate upgrade

kabutotx — Sat, 06 Jun 2015 16:41:49 GMT

1. This has nothing to do with your own SSL certificates. This is an update of Authorize.net's SSL certificates. So don't worry about those.

2. Did you try IE to browse to https://secure.authorize.net ? This will test at least basic communications and that your system can recognize Authorize's new SSL Certs and ciphers. It should since 2008r2 is newer. On anything above 2003 you shouldn't even need to import the certificates.

3. When you say "test server" are you talking about a whole new physical server or test.authorize.net? test.authorize.net uses a different SSL certificate chain than secure.authorize.net.

4. Try Microsoft.xmlhttp or at least the sample.asp in the SDK. I think this call is older and uses a different communication pathway than serverXMLHTTP.

Re: Timeouts posting XML after certificate upgrade

jayada — Sat, 06 Jun 2015 21:38:47 GMT

IE CANNOT access secure.authorize.net which is likely a huge clue...clearly a security issue, which seems to be beyond my IQ and pay grade.

Using either serverXMLHTTP or Microsoft.xmlhttp result the same timeouts...those errors are in the OP...but I would expect this will be solved with the IE connection problem. The system should be totally cool with security with all certificates meeting or exceeding new standards.

Re: Timeouts posting XML after certificate upgrade

RaynorC1emen7 — Sun, 07 Jun 2015 00:10:51 GMT

Talk you to your network person to see if they are blocking the site or ip. Can the server access any https site? are the windows updates current?

maybe to browswer settings issue, can you try with another browser?

did you use the IE buildin developer tool network traffic to see what the error is?

Re: Timeouts posting XML after certificate upgrade

jayada — Mon, 08 Jun 2015 02:10:38 GMT

-Sites are not being blocked.

-I Cannot access https://secure.authorize.net from either IE or Chrome on the affected server. I can see many other https sites, but not secure.authorize.net

-F12 provides little information...just a timeout. with no other errors

-Doing a traceroute for secure.authorize.net stops at 10ge15-7.core1.ash1.he.net [184.105.213.197] which is the fifth hop

-I set IE security to the lowest level...all efforts are still not allowing the affected computer to access https://secure.authorize.net

Again this is a new install of Windows server 2008R2. It now has service pack 1 with all updates. All certificates are per Authorize.net spec. TLS 1.2 endbled, TLS 1.1 and 1.0 disabled. SSL3.0 and SSL2.0 disabled. (I enabled all that to try to get a connection without success, so now they're all off again)

-SSLLabs gives the server an A for security, just like Authorize.net wants. Still cannot connect.

Thoughts??

Re: Timeouts posting XML after certificate upgrade

jayada — Mon, 08 Jun 2015 02:23:00 GMT

-Lowering IE security to the lowest still doesnt allow access to connect to Authorize.net.

-By test server I meant posting the XML string by sending the the test authorize.net site at https://test.authorize.net/gateway/transact.dll?. THAT works perfect. Great connection, great response...no problems. Changing the URL within the same page to https://secure.authorize.net/gateway/transact.dll? will not connect.

-Putting the test URL in a browser works great

-Putting the secure production URL in a browser will not connect

-F12 is no help...just shows a long timeout with no error coming back aside from the generic one ERR_CONNECTION_RESET or ERR_CONNECTION_TIME_OUT

I'm not only stumped but down and stumped. Any help would be greatly appreciated

Re: Timeouts posting XML after certificate upgrade

kabutotx — Mon, 08 Jun 2015 03:04:40 GMT

secure.authorize.net uses totally different SSL certificates, so I think that is the problem. In IE, can you connect and click on the lock icon? I think you can click on the Certificate Path tab and it will show what cert isn't working. I would assume the Entrust G2 certificate. It needs to be added to Third Party Root Ceritificate section. You can check the Certificate mmc add-in.

Re: Timeouts posting XML after certificate upgrade

jayada — Mon, 08 Jun 2015 03:36:43 GMT

IE cannot connect to secure.authorize.net at all. Times out. It does connect to test.authorize.net without trouble, so I cannot find certificate info for secure.Authorize.net.

All certificates are propelry in place.

Still no joy

Re: Timeouts posting XML after certificate upgrade

kabutotx — Mon, 08 Jun 2015 04:18:34 GMT

The other thing is to try downloading the certificates on another machine in Firefox or IE. Copy the secure.authorize.net certificate file over to the machine having problems and run certutil on it. See what that says.

Re: Timeouts posting XML after certificate upgrade

jayada — Tue, 09 Jun 2015 16:21:28 GMT

Still down...after much investigation I'm convinced it has something to do with our firewall or ISP. Doing an OpenSSL session I get this:

OpenSSL> s_client -connect secure.authorize.net:443 -state
Loading 'screen' into random state - done
CONNECTED(0000011C)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:error in SSLv2/v3 read server hello A
write:errno=10060

Looks like we're sending info great, Authorize.net is getting it and sending info back. Our server is not getting the message...smehow it's being blocked or diverted or something. After 20 or 30 seconds it times out.

This behavior doesn't happen with most https sites (https://www.google.com as an example).The problem is happening with all higher security sites like secure.authorize.net and Geotrust as an example...Here's the Openssl to Geotrust:

OpenSSL> s_client -connect www.geotrust.com:443 -state
Loading 'screen' into random state - done
CONNECTED(0000011C)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:error in SSLv2/v3 read server hello A
write:errno=10060

Same problem. Thoughts anyone?

Re: Timeouts posting XML after certificate upgrade

RichardH — Tue, 09 Jun 2015 16:29:36 GMT

Are you filtering inboud connections? You may want to whitelist the addresses AuthorizeNet posts from:

https://community.developer.authorize.net/t5/Integration-and-Testing/Authorize-Net-Whitelist-IP-Addresses/m-p/48151/highlight/true#M24281

Richard

Re: Timeouts posting XML after certificate upgrade

jayada — Tue, 09 Jun 2015 21:02:07 GMT

No filtering is happening

Re: Timeouts posting XML after certificate upgrade

kabutotx — Tue, 09 Jun 2015 23:43:24 GMT

For giggles try my site www.houstonuniform.com:443 and see what it gets.

A quick look shows www.google.com still seems to allow SSLv3 where authorize.net only allow TLS1.0 or higher. My site should be the same in only allowing TLSv1.0 or higher. If you get the same error your system isn't allowing TLS for some reason.

Re: Timeouts posting XML after certificate upgrade

jayada — Wed, 10 Jun 2015 02:08:14 GMT

That worked great in openssl.. And I'm able to browse the site in both IE and Chrome. But going to https it takes a very long time to load the page as it establishes a connection, but finally does load. Here are the Openssl results:

OpenSSL> s_client -connect www.houstonuniform.com:443 -state
Loading 'screen' into random state - done
CONNECTED(0000011C)
SSL_connect:before/connect initialization
SSL_connect: SSLv2/v3 write client hello A
SSL_connect: SSLv3 read server hello A
depth=3 /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Autho
rity
verify error:num=19:self signed certificate in certificate chain
verify return:0
SSL_connect: SSLv3 read server certificate A
SSL_connect: SSLv3 read server key exchange A
SSL_connect: SSLv3 read server done A
SSL_connect: SSLv3 write client key exchange A
SSL_connect: SSLv3 write change cipher spec A
SSL_connect: SSLv3 write finished A
SSL_connect: SSLv3 flush data
SSL_connect: SSLv3 read finished A
---
Certificate chain
0 s:/OU=Domain Control Validated/CN=www.houstonuniform.com
i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.c
om/repository//CN=Go Daddy Secure Certificate Authority - G2
1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.c
om/repository//CN=Go Daddy Secure Certificate Authority - G2
i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certific
ate Authority - G2
2 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certific
ate Authority - G2
i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authorit
y
3 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authorit
y
i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authorit
y
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFOjCCBCKgAwIBAgIIdNPClFATgckwDQYJKoZIhvcNAQELBQAwgbQxCzAJBgNV
BAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMRow
GAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjEtMCsGA1UECxMkaHR0cDovL2NlcnRz
LmdvZGFkZHkuY29tL3JlcG9zaXRvcnkvMTMwMQYDVQQDEypHbyBEYWRkeSBTZWN1
cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzIwHhcNMTUwNTE0MjAzNzM4WhcN
MTUwOTI5MDA1OTAyWjBEMSEwHwYDVQQLExhEb21haW4gQ29udHJvbCBWYWxpZGF0
ZWQxHzAdBgNVBAMTFnd3dy5ob3VzdG9udW5pZm9ybS5jb20wggEiMA0GCSqGSIb3
DQEBAQUAA4IBDwAwggEKAoIBAQDYCw689SaDaWjgwdvMALkPF8CHPuw7Lc7GIKpW
V2oXZ26J5hHUB25gU34viDhWt7Jx6QokF/HSO5q4Axw3LRVGQFXntqqQ6AnwbUXU
3AsEKGUiEzFyEzNnLNLJMu2DK3/zIlwPwWuiZYzaEloaJsbL6L1q3DUpJKx8+MFi
sCDMs1EGHoT7YNhjc2QfBMfcsV3Ykt3AsrRsBybKqGa/7B1psIzDIc6S2br+ENg/
OAs4wgXUbXjD6uElNv3R60clGbsrASqzgQVpznYrYNcOPRkTt/XCvvF/BrGwJK9T
mH/7whMm1KaSV3rGpg3jGFhFo26XDi3L/rUB7y44Bhk+6GOVAgMBAAGjggG9MIIB
uTAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAO
BgNVHQ8BAf8EBAMCBaAwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nb2Rh
ZGR5LmNvbS9nZGlnMnMxLTg3LmNybDBTBgNVHSAETDBKMEgGC2CGSAGG/W0BBxcB
MDkwNwYIKwYBBQUHAgEWK2h0dHA6Ly9jZXJ0aWZpY2F0ZXMuZ29kYWRkeS5jb20v
cmVwb3NpdG9yeS8wdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8v
b2NzcC5nb2RhZGR5LmNvbS8wQAYIKwYBBQUHMAKGNGh0dHA6Ly9jZXJ0aWZpY2F0
ZXMuZ29kYWRkeS5jb20vcmVwb3NpdG9yeS9nZGlnMi5jcnQwHwYDVR0jBBgwFoAU
QMK9J47MNIMwojPX+2yz8LQsgM4wNQYDVR0RBC4wLIIWd3d3LmhvdXN0b251bmlm
b3JtLmNvbYISaG91c3RvbnVuaWZvcm0uY29tMB0GA1UdDgQWBBSVQmXX3DSmp3uu
rxbAcs7LpaGXwTANBgkqhkiG9w0BAQsFAAOCAQEAWfRJf/3sBOT1QlUG87yh4xb4
Nde21CRPuwUtuEA53vBMX0GNjENUZsPfEnNgWU2NhBzG+7C3s7HvSy3Jgq1q2ool
E5GptkR0rUD/hwg+aVi1Nyg2H+vU8peJLGn0U/4MtSmOjyKOV9RaPMP56B1CUOZ3
zx/NIpc4uykZcbB6r0po+QhnygoYU8mp/bsFPcsJ7kmFncY3sVf+Y3KEFFlaQuKs
XEeRRQQtPAmYInOeMSDyzwH9Cc4UNT4MPEQMiyvMmQGME8TuDrb05z/EQ5DMDtqA
ToD1B4MCKLr7P8VW6uxQsWwxZ3RtkpHkcZKE7gVAvah+tJFxSm74cq4PjgT8tA==
-----END CERTIFICATE-----
subject=/OU=Domain Control Validated/CN=www.houstonuniform.com
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy
.com/repository//CN=Go Daddy Secure Certificate Authority - G2
---
No client certificate CA names sent
---
SSL handshake has read 5460 bytes and written 322 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-SHA
Server public key is 2048 bit
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : DHE-RSA-AES128-SHA
Session-ID: 53B1E1D646FE06CFF3E2FA59247FB8B4BAC7B3D87C048257A5D2B3AE00F1BB0D
Session-ID-ctx:
Master-Key: E460B5F43357CDC5729B4DDE61E6DC8A0F069B7BCA9B82E09FA7BEAD92578ECF
BBC6F7755FD53A8E5AFA06D8C089A882
Key-Arg : None
Start Time: 1433901445
Timeout : 300 (sec)
Verify return code: 19 (self signed certificate in certificate chain)
---

Re: Timeouts posting XML after certificate upgrade

kabutotx — Wed, 10 Jun 2015 06:08:18 GMT

The only thing I can think of is to try going to secure.authorize.net in a browser on another computer and see if it just your server or your whole network blocking.

Re: Timeouts posting XML after certificate upgrade

keithnkim — Wed, 10 Jun 2015 16:30:42 GMT

Did you ever get a solution to this problem. Last night, I began experiencing this issue exactly as you described. I cannot access secure.authorize.net from any servers on my work network, but I can access it from my home network. Any insights are appreciated.

Re: Timeouts posting XML after certificate upgrade

jayada — Wed, 10 Jun 2015 18:01:33 GMT

I can access secure.authorize.net from an XP computer on the network as the affected server but still no secure connection with our server. But I will say, browsing around with the XP computer was very slow, and in fact accessing these boards and this post was extremely slow and when it did come back the formatting was a mess. Could that be a sign that the firewall might be malfunctioning? That's a total dart throw guess.

Re: Timeouts posting XML after certificate upgrade

kabutotx — Wed, 10 Jun 2015 20:30:50 GMT

Something is weird then. Try to do some type of speedtest or something to test your line and ISP. I would also double check your DNS settings. Good luck.