RTC Extensions Workshop – How to fix SSL protocol errors preventing connection to Jetty Debug server

Since some time now I started to run into a blocking issue with the Extensions workshop. I was not able to find a solution so far. Today a colleague saw the same and asked for help. Here what I found.

Problem: the browser prevents connecting to the Jetty server

When launching the Jetty Debug server, everything seems to be fine. You can even connect with an Eclipse client to the server. However, if you try to follow the description in the Extensions Workshop and you try to connect with a browser to https://localhost:7443/jazz/admin you see a screen like the one below.

In Chrome the error claims

This site can’t provide a secure connection localhost sent an invalid response.

Try running Windows Network Diagnostics.

ERR_SSL_PROTOCOL_ERROR

Firefox is even more alarming and says

Secure Connection Failed

An error occurred during a connection to localhost:7443. Peer reports it experienced an internal error. Error code: SSL_ERROR_INTERNAL_ERROR_ALERT

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.

Please contact the website owners to inform them of this problem.

Learn more…

Report errors like this to help Mozilla identify and block malicious sites

Edge complains

Can’t connect securely to this page

This might be because the site uses outdated or unsafe TLS security settings. If this keeps happening, try contacting the website’s owner.

Try this:

Go back to the last page

It looks like the usual SSL issue with the standard certificate, but it actually is not. It does not allow you to proceed and add an exception to connect to the web site.

You are basically stuck.

I had the same issue yesterday with 6.0.5 and 6.0.6 and I knew it was working very recently – when I moved to my new laptop. I searched the internet and was not really sure about a solution still. The answers pointed at version issues and certification mismatches. So I decided to switch the Eclipse environment to a current JDK and that solved the problem. I have tried it with RTC 6.0.5 and 6.0.6 but I am pretty sure it would work with other versions as well.

Please note that the Extensions workshop suggests to use the same JDK the Server uses. I think since Browsers have recently increased their security measures, this is no longer true.

Solution

Here how to fix the problem.

• Download and install a recent Java JDK/JRE that is compatible with the version of the RTC SDK you are working with.
  • 6.0.6 is compatible with Java 1.8
  • I use a JDK because there are other development tools that require a JDK
• Open the Eclipse server development workspace
• Open Window>preferences
• Type JRE and navigate to Java>Installed JREs
  • Add the new JDK/JRE
  • Select the JDK/JRE as active click Apply and Close
  • Navigate to Java>Installed JREs>Execution Environments
  • Select the Execution Environment with the matching version
  • Select the new JDK/JRE as active click Apply and Close
• Launch the Jetty debug server

Now try to login to https://localhost:7443/jazz/admin again. You still get an error, however the browser provides the Advanced link to continue connection to the site.

The different browsers display it different, but the concept is the same for all of them.

Summary

Recent increases of browser security checks and invalidation of certificates requires to update to recent versions of the Java JDK/JRE to be used with the Extensions workshop. As always I hope that this helps people out there.

Advertisement

Unable to Connect to the Jetty Server Using Current Browsers Due to SSL Error Extending RTC Versions Lower Than 6.x

Attempting to connect to my Jetty server to debug a new RTC Extension I was working on in RTC 4.0.1, failed with an SSL error with all my current Browsers, Chrome and Firefox without being able to find a workaround in the browsers. How to work around that issue?

This problem only occurs when using the RTC SDK for RTC versions prior to RTC 6.x. It will affect all of these versions. It does not prevents performing the RTC Extensions Workshop since most of the tasks there can be done using the Eclipse UI. However, it impacts developing RTC Server extensions and test them properly, if it is necessary to use the Web UI because it is impossible to go into the web UI to test.

The problem I ran into is basically related to Chrome Does Not Work With RTC Debug Server on Jetty. However, it turns out that the work around described there does no longer work. Neither Tomcat nor Chrome allow to enable SSL V3 anymore showing errors like this in FireFox.

The messages contain text like

Unable to Connect Securely

Firefox cannot guarantee the safety of your data on localhost:7443 because it uses SSLv3, a broken security protocol.
Advanced info: ssl_error_unsupported_version

or

This webpage is not available

ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Hide details
A secure connection cannot be established because this site uses an unsupported protocol.

The only ways around I found so far are:

• Use the internal browser of the RTC Eclipse client of the version of RTC you are trying to extend
• Use a browser that does not block SSL such as Chromium in a version that allows the work around described in Chrome Does Not Work With RTC Debug Server on Jetty
  

You can download Chromium of various versions here. Version 44.0.2385.0 does still work for me and it does not update automatically.

The development team tracks the issue in Defect 354890. As long as there is no other solution, use the workarounds provided above. As soon as there are new news, I will try to provide the details.

Chrome Does Not Work With RTC Debug Server on Jetty

Recently I tried to use Chrome with a RTC debug Server running on Jetty. I was unable to do so. Why does this happen and is there a work around?

Affected Versions

This problem only occurs when using the RTC SDK for RTC versions prior to RTC 6.x. The RTC 6.0 and later SDK’s are not affected as they enable TLS.

* Update * see Unable to Connect to the Jetty Server Using Current Browsers Due to SSL Error Extending RTC Versions Lower Than 6.x for newest developments and potential workarounds. This work around does no longer work for the newest versions of Chrome.

Symptoms

When I tried to navigate to the public URI https://localhost:7443/jazz/ of my debug server I got a message

This webpage is not available

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

See the screenshot below:

This webpage is not available ERR_SSL_VERSION_OR_CIPHER_MISMATCH

I created Defect 354890 to get it addressed.

Root Cause And Work Around

As described in the defect above, it appears that Jetty uses SSL as a default protocol to talk to the browser. Chrome version 4 has disabled SSL due to defects in the older SSL implementations. This can basically also happen in other browsers soon.

To fix this, Jetty would have to be set to TLS as default. Although this seems to be the documented default for newer versions, the SDK does not seem to have that setting. I searched around and was also not able to find a way to force it.

It would be good if there was a way to set e.g. a System Property in the server launch configuration.

This work around I found on the net worked for me for Chrome v40:

• Open the URL chrome://flags
  
• Look for “Minimum SSL/TLS version supported.“
• Change from Default and choose SSLv3
• Click on the “Relaunch now” button

Open your public URI https://localhost:7443/jazz/ again. You will be redirected to a page “Your connection is not private“. Click on the “Advanced” link. Finally click on “Proceed to (unsafe)“.

Update

Chromium has the same problem. And the same fix.