search

cassproject / cass-editor

View, create, edit, modify frameworks using an easy to use, embeddable iframe.
https://cassproject.github.io/cass-editor/
Apache License 2.0
3 stars 11 forks source link

Encountering ERR_CERT_COMMON_NAME_INVALID on production #786

Closed mparsons-ce closed 3 years ago

mparsons-ce commented 3 years ago

@woodkri I was seeing the certificate errors earlier this week. I exported the current certificate initially using the same name as before. I kept the same password. I restarted Tomcat and all seemed fine. Yesterday I saw that the new CaSS instance was failing. Old CaSS would continue to work, even though the ERR_COMMON_NAME_INVALID was also present. Today, just in case, I exported the certificate again and used a new name (CASS.CREDENTIALENGINE.ORG_202102.ofx). I updated and restarted Tomcat. The following error is still showing, and new CaSS fails.

image

woodkri commented 3 years ago

The new editor is still working for me but I'm seeing the same message in the console as the websocket can't connect. @lomilar Have you seen this error before?

mparsons-ce commented 3 years ago

@woodkri @Lomilar Scarlett reported an issue for a user trying to edit the framework: Horizontal Industry Framework https://apps.credentialengine.org/publisher/competencyframework/1279/Horizontal_Industry_Framework

There are already several competencies, but she cannot add any new ones. Scarlett logged in as the user. In the console we can see the above ERR_CERT_COMMON name errors as well as some 502 errors. I can view the framework from the old CaSS editor, but cannot edit it. It took a few tries, but I was able to export it. Using new CaSS I could not search for the latter - I get a 502 error. I tried a blind search, then data was returned from the search. I then again tried a specific search for Horizontal Industry Framework. This time it was found. There were many errors in the console, but this time no ERR_CERT_COMMON errors? However, I cannot edit the framework either.

woodkri commented 3 years ago

I don't know what's causing the 502s or the certificate error, but the template fields (CE owner, publisherName, creator, etc.) are not present which is why you aren't able to edit it. Do you know how the framework was created/imported?

woodkri commented 3 years ago

On a previous issue when we were having problems with 502s, there's a comment saying it was due to IIS issues. Is it possible there's an IIS issue causing both the 502s and the certificate errors?

mparsons-ce commented 3 years ago

As another symptom, I had noted that I could eventually export the competency framework, but I get an error (Failed - Server problem) if I try to save the file. I wanted to export and then re-import the file to check the state after the import.

woodkri commented 3 years ago

Have any changes been made to certificates or IIS settings on production in the last few weeks? It sounds like that certificate error is most often caused by a mismatch in domain names somewhere.

mparsons-ce commented 3 years ago

I re-exported the certificate, and have not seen any more errors.