Card and CalDAV SSL problem

Question

admilon Author

Level 1

15 points

Card and CalDAV SSL problem

Hello,

since upgrading one client to 10.11 neither calendar nor addressbook is working anymore with SSL.

The settings for the Calenadar can't be changed, as Calendar hangs while trying to move data to the server account.

It works with Linux and iPhone without any problem.

Server is a MacOS 10.6.8 Server running the Apple Addressbook and iCal server.

The ssl certificate is a regular certificate, not a self-signed.

Thinking about moving to a different solution …

thx

admilon

Posted on Dec 22, 2015 2:03 AM

Reply

Answer 1

Linc Davis

Level 10

209,739 points

Dec 22, 2015 8:27 AM in response to admilon

Logs?

Reply

Answer 2

admilon Author

Level 1

15 points

Dec 22, 2015 4:52 PM in response to Linc Davis

Hello,

this is what I see:

23.12.15 09:45:27,423 CalendarAgent[365]: [com.apple.calendar.store.log.caldav.queue] [Account refresh failed with error: Error Domain=NSURLErrorDomain Code=-1200 "Es ist ein SSL-Fehler aufgetreten. Eine sichere Verbindung zum Server kann nicht hergestellt werden." UserInfo={CalDAVErrFromRefresh=YES, NSLocalizedRecoverySuggestion=Möchten Sie die Verbindung zu dem Server trotzdem herstellen?, NSErrorFailingURLKey=https://name@domain.tld:8443/principals/__uids__/3FC89D72-7145-4DAE-A83D-574E0BC DEAED/, NSUnderlyingError=0x7f87c67238a0 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "Es ist ein SSL-Fehler aufgetreten. Eine sichere Verbindung zum Server kann nicht hergestellt werden." UserInfo={NSErrorFailingURLStringKey=https://name@domain.tld:8443/principals/__uids__/3FC89D72-7145-4DAE-A83D-574E0BC DEAED/, NSLocalizedRecoverySuggestion=Möchten Sie die Verbindung zu dem Server trotzdem herstellen?, _kCFNetworkCFStreamSSLErrorOriginalValue=-9801, _kCFStreamPropertySSLClientCertificateState=0, NSLocalizedDescription=Es ist ein SSL-Fehler aufgetreten. Eine sichere Verbindung zum Server kann nicht hergestellt werden., _kCFStreamErrorDomainKey=3, NSErrorFailingURLKey=https://name@domain.tld:8443/principals/__uids__/3FC89D72-7145-4DAE-A83D-574E0BC DEAED/, _kCFStreamErrorCodeKey=-9801}}, _kCFStreamErrorCodeKey=-9801, NSLocalizedDescription=Es ist ein SSL-Fehler aufgetreten. Eine sichere Verbindung zum Server kann nicht hergestellt werden., NSErrorFailingURLStringKey=https://name@domain.tld:8443/principals/__uids__/3FC89D72-7145-4DAE-A83D-574E0BC DEAED/, _kCFStreamErrorDomainKey=3, AccountName=name@domain.tld}]

no changes have been made to the set-up, only update from 10.10 ->10.11

I'm also seeing smtp-issues with AppleMail since the update.

I more and more get the impression I made a mistake to update this box.

Thanks

admilon

Reply

Answer 3

Linc Davis

Level 10

209,739 points

Dec 22, 2015 8:04 PM in response to admilon

I suggest that you upgrade the server to El Capitan, if the hardware is capable. I doubt that such an old system can handle modern SSL. If you don't want to upgrade, just stop using SSL. It's probably insecure anyway.

Reply

Answer 4

admilon Author

Level 1

15 points

Dec 22, 2015 8:28 PM in response to Linc Davis

Well it works with current version of iOS, with Ubuntu and Win and any MacOS prior to 10.11.2

I also secured the ssl installation against the last ssl bug - was it heartbleed or something like that.

There should be no compatibility problem: the server is running OpenSSL 0.9.8y the box with problems is running 0.9.8zg. According the OpenSSL doku all 0.9.x should be backwards compatible.

Currently the server can't be updated, because there is a 4d v13.5 Serer running on it and it's not stable with 10.11, additional that would be a 2 days job at least until everything works fine again.

So I acutally think Apple screwed something up and we have to wait until they silently fix it again or I change to Baikal.

Thanks anyway

admilon

Reply