Blocking certificates with the CA block list

  • Updated

The CA block list is a text file, conf/cablocklist, that identifies certificates Harmony never trusts. These certificates are blocked regardless of the CA store, the certs directory, or any “trust any CA” setting. Each entry is the fingerprint of one certificate. A certificate is rejected if its chain contains an identified certificate. Blocking applies to individual certificates, not to an entire CA.

File format

Each line has a flag, whitespace, and a certificate fingerprint. Text after # is a comment, and lines without a valid flag are ignored.

*   1396BE1372BC93DFA2A433CA964DBA91548A6E57      # comment
FlagEffect
*Blocks the certificate as both client and server
CBlocks only when Harmony is a client connecting to an SSL server
SBlocks only when Harmony is a server using a certificate signed by the identified certificate

 The fingerprint can be SHA-256 or SHA-1 (the Thumbprint in Certificate Manager). Colons, spaces, and case are ignored. To get a fingerprint, use either command or the Thumbprint field in Certificate Manager:

openssl x509 -in cert.pem -noout -fingerprint -sha256
keytool -printcert -file cert.cer

Troubleshooting

If a certificate in a connection or listener chain matches an entry in the block list, Harmony rejects it. What you see depends on whether VersaLex is acting as the server or the client.

Symptom: VersaLex will not start

Message in the log

Error: The SMTP/s server certificate ‘alias’ (Subject=subject) was issued under a CA 
certificate that is blocked for server use. Certificate is blocked in conf/cablocklist: 
Subject=subject, Issuer=issuer, Serial#=serial, SHA-256=fingerprint, SHA-1=fingerprint, Flag=*. 
Replace the certificate, or change the flag for this fingerprint in conf/cablocklist to ‘C’ to 
allow it to be served.

Possible cause

A listener (HTTP/s, FTP/s, SMTP/s, or OFTP/s) is serving a certificate issued under a blocked certificate.

Possible solution

  • Replace the listener certificate with one issued under a trusted CA.
  • Or change the flag on that line in conf/cablocklist from * to C. VersaLex will serve the certificate but still blocks it when connecting to other servers.
Symptom: An action fails with “Certificate is blocked in conf/cablocklist”

Exception

Exception: “iaik.security.ssl.SSLCertificateException: Peer certificate rejected by ChainVerifier: 
Certificate is blocked in conf/cablocklist: Subject=subject, Issuer=issuer, 
Serial#=serial, SHA-256=fingerprint, SHA-1=fingerprint”

Possible cause

The remote server’s certificate chain contains a blocked certificate.

Possible solution

Ask your trading partner to replace their certificate with one issued under a trusted CA. If they can’t, contact Cleo Customer Support. Allowing a blocked certificate means trusting a certificate that may be compromised, and Support can help you understand that risk before you decide how to proceed.

Before you update

A blocked listener certificate stops VersaLex from starting. Before you apply an update that includes the block list, use Certificate Manager to check whether the chain for each listener certificate contains any certificate identified in conf/cablocklist. Replace any that do.

For more information, contact Cleo Customer Support.

Comments

0 comments

Please sign in to leave a comment.