Re: Loaddap and HTTPS

[James Gallagher <jhrg@xxxxxxx>]

On Jul 6, 2006, at 3:30 AM, Arnaud FOREST wrote:

> HI James,
>
> I think I find the problem with my authentification,
> Remember I have no trouble with a web browser, but with matlab an  
> error occures.
> I thought that the problem should come from the command to access  
> to the server : libcurl library
>
> I try to acces to my test-server with the command "curl <url>" and  
> this error ocuures
>
> "curl: (60) SSL certificate problem, verify that the CA cert is 	 
> OK. Details:
> error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate  
> verify failed"
>
> So I use the command "curl -k <url>" and I acces to the server.
>
> Does an option, like "-k"  : to pass through the verification of  
> the certificate, exist ?

Arnaud,

Sorry for the delay in getting back to you, I had to check on several  
things in our library and libcurl. I was surprised because this used  
to work, but the explanation is in the libculr documentation. As of  
version 7.10 of libcurl the default behavior changed so that the peer  
is verified. Previously the peer was not verified.

There may be a work-around for you in that libcurl stores a set of CA  
certificates in /usr/local/share/curl and if you include include your  
certificate in that bundle, then authentication will be successful.  
Unfortunately, I'm pretty weak in my knowledge of SSL, so I cannot  
say for certain that will work.

I can change they way libdap uses libcurl so that the old default  
behavior of libcurl is what lidap gets, but that will have to wait  
for the next release.

James
> Does matlab toolbox be able to work with a server which delivers a  
> non-verified ssl certficate ?
>
> thanks
>
> Arnaud
>
> James Gallagher a écrit:
> > On Jun 26, 2006, at 6:22 AM, Arnaud FOREST wrote:
> > > Thanks for your responses.
> > >
> > > I setup Apache to provide the HTTPS support but when I try to   
> > > retrieve some data from my DODS Server (Java) to matlab with   
> > > 'loaddap', I have an Error.
> > > I watched the log files and didn't see any access to my DODS server.
> > >     loaddap('https://user:passwd@myserver/somedata?u,v&;...')   I  
> > > access to my DODS server without problems with a web Browser , I   
> > > get the certificate and it works !
> > >
> > > I try with only BASIC authentification with no HTTPS and it works.
> > >     loaddap('http://user:passwd@myserver/somedata?u,v&;...')
> > >
> > > "Dan: You asked about libdap support. Yes, libdap, and therefore any
> > >  client built using it, will support HTTPS ... "
> > >
> > > Should I re-compile my matlab tool-box ?
> > >
> > > Can someone give me an URL to a DODS server with HTTPS access to   
> > > try my 'loaddap' ?
> > I'll double check the installation at test.opendap.org and pass  
> > on  the URL to you, along with the test account info. Right now  
> > I'm  returning from vacation (was supposed to be back today) but  
> > am stuck  due to bad weather. It may take me a day or two to get  
> > to this. Sorry  for the hassles.
> > James
> > > Arnaud
> > >
> > >
> > > James Gallagher a écrit:
> > >
> > > > On Jun 16, 2006, at 2:06 PM, Yuan Ho wrote:
> > > >
> > > > > Arnaud FOREST wrote:
> > > > >
> > > > > > Hi all,
> > > > > >
> > > > > > I work on an opendap server for in-situ vertical profiles  
> > > > > > stored  in a
> > > > > > Oracle DBMS.
> > > > > >
> > > > > > I want to put my server on the extranet, and all on the   
> > > > > > extranet  is managed by https and authentification.
> > > > > > I know the authentification worked but for the certificate I    
> > > > > > didn't find any information.
> > > > > >
> > > > > > What do you suggest ?
> > > > > > Does loaddap have an special option for https or matlab  
> > > > > > doesn't   manage https ?
> > > > > >
> > > > > > Thanks a lot,
> > > > > >
> > > > > > Arnaud
> > > > >
> > > > >
> > > > >
> > > > > You can try our OPeNDAP Java server, and here is the link:
> > > > > "http://opendap.org/download/java-dap.html";
> > > >
> > > > Wait! Don't use this link since the Java code is not what you   
> > > > want.  Get the regular server and follow the directions about   
> > > > setting it up  as described in the SECURITY file that comes  
> > > > with  the server. This  will be part of the dap-server package.  
> > > > When you  install our server,  you will also need to have a web  
> > > > server.  Let's assume you use Apache.  In that case Apache  
> > > > provides the  HTTPS support and the password  protection.
> > > > Dan: You asked about libdap support. Yes, libdap, and therefore   
> > > > any  client built using it, will support HTTPS and both HTTP  
> > > > Basic  and  Digest authentication. To access data from a DAP  
> > > > server  which  requires a username and password include that  
> > > > information  in the URL  as in:
> > > > loaddap('http://user:passwd@xxxxxxxxxx/somedata.dat?u,v')
> > > > James
> > > >
> > > > > Yuan
> > > > --
> > > > James Gallagher                jgallagher at opendap.org
> > > > OPeNDAP, Inc                   406.723.8663
> > --
> > James Gallagher                jgallagher at opendap.org
> > OPeNDAP, Inc                   406.723.8663

--
James Gallagher                jgallagher at opendap.org
OPeNDAP, Inc                   406.723.8663