0

UPDATE/FOUND ISSUE: After checking and checking I found it had to do with our OpenSLL module being 0.9.x (....oh man) which does not support TLSv1 and why my test failed but SSL Labs passed. So I have a couple of under the hood issues to fix here.

I can see why this post can be deemed off topic so do as you will :)

I am testing the update that Salesforce will be making in March given this document https://help.salesforce.com/articleView?id=000221207&type=1. I am using the SOAP API to connect and on my local machine I can connect to https://tls1test.salesforce.com/services/Soap/u/34.0 (via updating the WSDL) but on our production machine I cannot.

I verified that TLSv1.1 is being used on our server and even went so far as disabling TLSv1 all together to no avail. The error message is very vague so I have run out of ideas as to why the connection is failing on our production machine (LE/AMP stack) but works locally for me (LAMP stack).

Fault Code = "HTTP" and Error message is "Could not connect to host"

I am going to ask one of our SF Admins to enable this on one of our sandboxes but I do not think it will give me a different outcome.

To help you prepare for the Salesforce disabling TLS 1.0 beginning in June 2016, we are providing a new Critical Update Console (CRUC) setting, "Require TLS 1.1 or higher for HTTPS connections", for you to test the disablement of TLS 1.0 for your sandbox and production org prior to the Salesforce TLS 1.0 disablement schedule

Please let me know if I can provide further information!

UPDATE: Tried to connect from production via wget command

-bash-3.2$ wget https://tls1test.salesforce.com/services/Soap/u/34.0

--2017-01-25 16:25:45--  https://tls1test.salesforce.com/services/Soap/u/34.0
Resolving tls1test.salesforce.com... 136.146.30.119

Connecting to tls1test.salesforce.com|136.146.30.119|:443... connected.

OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Unable to establish SSL connection.
-bash-3.2$

enter image description here

SSLv3 is disabled on the server

  • can you hit the url directly from a browser located behind the same proxies/firewall that the production machine is behind or better yet the production machine itself? - You should get a 405 error (only post allowed) but at least you know you can hit it. – Eric Jan 25 '17 at 21:23
  • @Eric I've added a wget call and response to the question. Thanks! – Ray Jan 25 '17 at 21:26
  • I'm not familiar with the term 'LE/AMP' (I am familiar with 'LAMP'), but can you confirm the language that you are using to attempt to connect to the TLS test url for Salesforce? I'd imagine it's PHP (and that you're thus using cURL), but Python also starts with 'P'. – Derek F Jan 25 '17 at 21:28
  • Sure so 'LE/AMP' to me at least is Linux Nginx & Apache MySql and in my instance PHP – Ray Jan 25 '17 at 21:30
  • 1
    Hey @Eric so I think it's a combination of problems that I've now inherent ed. PHP 5.3.x only had OpenSSL 0.9 which doesn't support TLSv1.1+. Also the box is running CentOS 5 so judging from my research both PHP and the OS need to update. We are gonna move the server to an updated OS with PHP5.6 – Ray Jan 26 '17 at 22:14
1

Per your comment (now an edit to your question) above seem you are using SSL 3

Salesforce has disabled SSL 3 11/12-2014 (POODLE Vulnerability):

https://help.salesforce.com/articleView?id=Salesforce-disabling-SSL-3-0-encryption&l_1=&type=1

In November and December 2014 Salesforce disabled SSL 3.0 encryption to prevent it from being used to access the Salesforce platform. Any channels connecting to Salesforce will need to use TLS 1.0 encryption or higher—see below for supported encryption protocols. There are three different channels that require encryption to access Salesforce: internet browser, API (inbound) integrations, and call-out (outbound) integrations.

Sister site related question with similar characteristics:

https://unix.stackexchange.com/questions/192944/how-to-fix-curl-sslv3-alert-handshake-failure

so curl needed to be upgraded to the latest version (>7.40) and it worked fine.

(this is the extent of my knowledge level on curl/unix/gobblygook to be able to help so if this is not it I am not your guy lol)

  • Thanks @Eric! Hmmm I understand and my server does not use SSLv3 according to the ssllabs test. Only TLSv1.1 and TLSv1.2 – Ray Jan 25 '17 at 21:34
  • @Ray - Your wget shows ssl3 SSL23_GET_SERVER_HELLO:sslv3 - Maybe this will help unix.stackexchange.com/questions/192944/… – Eric Jan 25 '17 at 21:35
  • Thanks @Eric! I will give those suggestions a shot later tonight – Ray Jan 25 '17 at 21:40
  • Its unlikely that the SSL config of your servers HTTPS endpoint is related to the SSL config used to connect as a HTTPS client. If you can test with curl, remember to use the --tls1.2 option – superfell Jan 26 '17 at 5:29
  • Valid point @superfell and something I did not consider at the time – Ray Feb 1 '17 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.