https connection

Discussion of open issues, suggestions and bugs regarding network security and data protection solution - SecureBridge
Post Reply
Geremiah
Posts: 1
Joined: Wed 27 Oct 2021 22:06

https connection

Post by Geremiah » Wed 27 Oct 2021 22:23

Hi all,
i would like to use the Securbridge https client for exchange data with the italian taxes authority.
I sent a digitally signed xml and i wait for an xml response.
I'm trying to use for the connection the certificate supplied from the above authority but i've always the following error:
"The certificate is not trusted from the trust provider'.
I'm doing some test with the CURL utility and it's running giving the following result:

Code: Select all

curl -v -k -X POST --header "Content-Type: application/xml" "https://apid-ivaservizi.agenziaentrate.gov.it/v1/dispositivi/corrispettivi/" --data-binary @firmato_cor.xml --verbose --cacert caentrate.cer
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 217.175.50.83:443...
* Connected to apid-ivaservizi.agenziaentrate.gov.it (217.175.50.83) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: caentrate.cer
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: C=IT; O=Agenzia delle Entrate; OU=Servizi Sicuri; CN=apid-ivaservizi.agenziaentrate.gov.it
*  start date: May 12 07:52:54 2021 GMT
*  expire date: May 11 07:52:54 2024 GMT
*  issuer: C=IT; O=Agenzia delle Entrate; CN=CA Agenzia delle Entrate
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> POST /v1/dispositivi/corrispettivi/ HTTP/1.1
> Host: apid-ivaservizi.agenziaentrate.gov.it
> User-Agent: curl/7.79.1
> Accept: */*
> Content-Type: application/xml
> Content-Length: 4115
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< X-Backside-Transport: OK OK
< Connection: Keep-Alive
< Transfer-Encoding: chunked
< Date: Wed, 27 Oct 2021 21:48:08 GMT
< X-Powered-By: Servlet/3.0
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET, POST, DELETE, PUT
< Access-Control-Allow-Headers: Content-Type
< Content-Type: text/xml
< Content-Language: en-US
< X-Global-Transaction-ID: e8ea01d86179c9182b7baacd
<
* TLSv1.2 (IN), TLS header, Supplemental data (23):
<?xml version="1.0" encoding="UTF-8"?>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
Is it possible to solve this trouble ?
Thank you.

YanishevskiyVI
Devart Team
Posts: 70
Joined: Wed 02 Jun 2021 09:30

Re: https connection

Post by YanishevskiyVI » Tue 02 Nov 2021 14:44

Kindly be informed that this issue occurs because on a stage of HTTPS connection establishing: the server send a certificate, which authority couldn't be verified.

In case you trust this server's certificate, you may decrease level of security by tweaking TScSSLSecurityOptions properties

Code: Select all

https://www.devart.com/sbridge/docs/index.html?tscsslsecurityoptions_properties.htm
For example, setting TScSSLSecurityOptions.TrustServerCertificate to True will omit server certificate validation, thus, connection will be established even with compromised certificate(man in the middle attack type).
Please refer to "Attack types and countermeasures" via

Code: Select all

https://www.devart.com/sbridge/docs/index.html?attack_types.htm

Post Reply