maemo.org - Talk - cacert on N950 in OpenMode and MfE

maemo.org - Talk (https://talk.maemo.org/index.php)

- MeeGo / Harmattan (https://talk.maemo.org/forumdisplay.php?f=45)

- - cacert on N950 in OpenMode and MfE (https://talk.maemo.org/showthread.php?t=96373)

Re: cacert on N950 in OpenMode and MfE

@xelo

Your output looks exactly like on my stock kernel N950.
And on my OpenMode N9 the output is much longer (incl. certs/aegis stuff).
So I would say your device is in OpenMode but has been booted with the stock kernel. Once you have booted it (which does not require flashing) with an open mode kernel it will stay in OpenMode until a full reflash. But if you can access all functionality depends on the kernel you have flashed/booted afterwards.
Please post the output of
uname -a

Have you flashed the open kernel?
Or using ubiboot?
Or ...

About MfE:
???
Looks like it should at least accept the configs.
Can you reach the site
https://xxxxxx:443/Microsoft-Server-ActiveSync
in your normal browser inside the intranet?
And outside the intranet (internet)?
You should see some MS stuff or a message like
"The page cannot be displayed because the HTTP version is not supported."

I am not sure as this has been done by me ages ago.
possibly you need to give your domain/workgroup/windows/exchange user name instead of the e-mail address name as user!
At least this looks like in my settings on N950.

P.S.:
yep, we may do some testing (but it will be possible mainly in the evening/night only).
Meanwhile you should enable PMs (private messages) in your ControlPanel

Re: cacert on N950 in OpenMode and MfE

*although we're also interested" ... so PM, um :)

By the way, just saying this 'for' xelo ... this is actually Horde's ActiveSync plugin, not MS Exchange server. this is what the URL gives:

"Trying to access the ActiveSync endpoint from a browser. Not Supported."

Re: cacert on N950 in OpenMode and MfE

Quote:

Originally Posted by peterleinchen (Post 1495769)

@xelo
Please post the output of
uname -a

Have you flashed the open kernel?
Or using ubiboot?

Code:

~ $ uname -a

Linux RM680 2.6.32.54-dfl61-20121301 #1 PREEMPT Sat Mar 2 23:11:21 EET 2013 armv7l GNU/Linux

Afaik I flashed an Open Kernel.
I'm not using Ubiboot.
I could repeat flashing on Saturday. Right now I've no Problems to return everything back to stock-settings.

Quote:

Originally Posted by sicelo (Post 1495771)

*although we're also interested" ... so PM, um :)

All findings would be reported back to this thread. No worries :)

Quote:

Originally Posted by sicelo (Post 1495771)

By the way, just saying this 'for' xelo ... this is actually Horde's ActiveSync plugin, not MS Exchange server. this is what the URL gives:

"Trying to access the ActiveSync endpoint from a browser. Not Supported."

Sicelo is right.

Re: cacert on N950 in OpenMode and MfE

Quote:

Originally Posted by xelo (Post 1495781)

Code:

~ $ uname -a

Linux RM680 2.6.32.54-dfl61-20121301 #1 PREEMPT Sat Mar 2 23:11:21 EET 2013 armv7l GNU/Linux

This is the stock kernel!
Take a look at ubiboot thread and juice's instructions.
Or just flash an OpenMode kernel.

Quote:

Originally Posted by sicelo (Post 1495771)

*although we're also interested" ... so PM, um :)

Quote:

Originally Posted by xelo (Post 1495781)

All findings would be reported back to this thread. No worries :)

Yes, of course.
PM only for privacy data exchange :D

Re: cacert on N950 in OpenMode and MfE

Quote:

Originally Posted by peterleinchen (Post 1495784)

This is the stock kernel!

Splendid. This explains to me why develsh did not have sufficient rights to add the certificate.

It does not explain the not-working MFE.

I cannot offer you a testaccount or flash the Open kernel before saturday.

Re: cacert on N950 in OpenMode and MfE

Quote:

Originally Posted by xelo (Post 1495787)

...
I cannot offer you a testaccount or flash the Open kernel before saturday.

I am not in a hurry :D:D:D

Re: cacert on N950 in OpenMode and MfE

Peterleinchen: I've send you some login information.

Edit:

Flashed different kernels today:

zImage-2.6.32.54-dfl61-20121301
zImage_2.6.32.54-openmode_l2fix

But Installing Certificates did still not work:
"Permission denied"

So next try: Clean Flash and I'm going to start over.

Re: cacert on N950 in OpenMode and MfE

Before clean flashing read ubiboot thread - instruction - wiki.
flash back-to-back

But before even that use develsh (I needed that too even with open kernel().

--
strange, strange

Get the same message about invalid host address and find this in logs

Code:

Jan 23 23:59:05 (2016) mfeplugin[32201]: [Debug] Connecting to URL: "https://:443/Microsoft-Server-ActiveSync"

and as I did not obfuscate: looks like server name/address is not handed over from UI!?

I can log in on web portal.
And got the cert warning once at first connect where I said 'yes, forever'.

---
some progress?

Code:

Jan 24 00:09:24 (2016) mfeplugin[32252]: [Debug] Connecting to URL:  "https://xxx.xxx.xxx.xxx:443/Microsoft-Server-ActiveSync"

Jan 24 00:09:28 (2016) mfeplugin[32252]: [Debug] CertManager: ssl error"The host name did not match any ofthe valid hosts for this certificate" : "The host name did not match any of the valid hosts for this certificate"

Jan 24 00:09:28 (2016) mfeplugin[32252]: [Debug] CertManager: server certificate "*.crater.uberspace.de" has been already accepted by user

So, as you see: I changed from server name to IP address and it went further. I was asked to accept another cert '*.crater.uberspace.de'
Then it failed with same UI message.
But according to logs it may now be prob regarding certs, or?

Re: cacert on N950 in OpenMode and MfE

Quote:

Originally Posted by peterleinchen (Post 1496091)

Before clean flashing read ubiboot thread - instruction - wiki.
flash back-to-back

But before even that use develsh (I needed that too even with open kernel().

Maybe I got something wrong with develsh:

Do you mean:
1. run devel-su
2. run develsh
(now I've a shell in a shell)

Quote:

Originally Posted by peterleinchen (Post 1496091)

Get the same message about invalid host address and find this in logs

Code:

Jan 23 23:59:05 (2016) mfeplugin[32201]: [Debug] Connecting to URL: "https://:443/Microsoft-Server-ActiveSync"

and as I did not obfuscate: looks like server name/address is not handed over from UI!?

I figured that this happens, when "/rpc.php" was appended to the Host address. When /rpc.php is not used, the UI adds the correct URL.

Quote:

Originally Posted by peterleinchen (Post 1496091)

some progress?

Code:

Jan 24 00:09:24 (2016) mfeplugin[32252]: [Debug] Connecting to URL:  "https://xxx.xxx.xxx.xxx:443/Microsoft-Server-ActiveSync"

Jan 24 00:09:28 (2016) mfeplugin[32252]: [Debug] CertManager: ssl error"The host name did not match any ofthe valid hosts for this certificate" : "The host name did not match any of the valid hosts for this certificate"

Jan 24 00:09:28 (2016) mfeplugin[32252]: [Debug] CertManager: server certificate "*.crater.uberspace.de" has been already accepted by user

Yes, that's some progress.

I'm running Horde on a shared space. Which works fine with android, windows phone, zPush, etc...
Instead of the webadress, use the hostname I gave you in PM. When cacert root is installed certificate validation should not fail then. The root certificate of my hoster seems to be missing in Harmattan.

The shared space uses ServerNameIndication (SNI) to detect the "Server" which shall answer.

uuuuuh wait. What if MFE does not always send the ~~"server-name"~~ "host" header with each request? This would cause the process to fail.

Re: cacert on N950 in OpenMode and MfE

okay.

I did a clean reflash today, like described in
http://www.swagman.org:8008/juice/ubiboot/README

and used the zImage_2.6.32.54-openmode_l2fix kernel.

I did not install ubiboot.

Still uname -a says (in develsh):

Code:

~ # uname -a

Linux RM680 2.6.32.54-dfl61-20121301 #1 PREEMPT Sat Mar 2 23:11:21 EET 2013 armv7l GNU/Linux

and installing the root-certificate with acmcli is not possible.

Code:

~ # acmcli -c common-ca -a 16b5321bd4c7f3e0e68ef3bdd2b03aeeb23918d1.pem

ERROR: cannot add certificates (Permission denied)