search

scandihealth / lpr3-docs

https://scandihealth.github.io/lpr3-docs/
MIT License
11 stars 7 forks source link

SoapResponse: The certificate that signed the security token is not trusted! #250

Closed Kashif-Ali-110 closed 5 years ago

Kashif-Ali-110 commented 5 years ago

Hi

I am try to accessing the LPR3 webservice. But it return back Soap with message:

soap:ServerThe certificate that signed the security token is not trusted!

EndPoint: https://lprws-test.sds.dsdn.dk/cda-ws/DocumentRepository_Service/PatientHealthcareValidateReportingService

Soap request: ProvideAndRegisterDocumentSetEnvelopeMYC29Nov.txt

Response received: ErrorResponse.txt

Although the firm certificate is valid and the right one. But I didn't know what is missing? May be we have not yet white-listed or...

Can anyone like to help?

Thanks in advance, Kashif @ MyClinic A/S.

jonigkeit commented 5 years ago

It looks like you're have requested the ID card to be signed by the STS service for production.

CN on the certificate yields SOSI Federation (funktionscertifikat)

When using the test environment the ID card needs to be signed by one of the STS services for test.

CN on the certificate should yield SOSI Test Federation (funktionscertifikat)

jonigkeit commented 5 years ago

@Kashif-Ali-110 if you have no further comments please close this issue.

Kashif-Ali-110 commented 5 years ago

Hi again,

I have tried two different calls,

The request and the response message are attached with each call. NetsDanID (Functional Certificate) ProvideAndRegisterDocumentSetEnvelopeNetsDanID.txt Response(NetsDanID).txt

What I guess/supposed is: This functional certificate is not white-listed or has not granted access to LPR3!

MyClinic (Functional Certificate) ProvideAndRegisterDocumentSetEnvelopeMyClinic.txt ResponseFromLPR3.txt

What I guess/supposed is: This functional certificate is production certificate? And can only be used over? https://lprws.sds.dsdn.dk/cda-ws/DocumentRepository_Service/PatientHealthcareValidateReportingService. But when i tried to called against above webservice endpoint, it did not get back response and times goes out.

From where we can get test functional certificate and permission to lpr3 external administration module.

Thanks in advance.

With best, Kashif @ MyClinic A/S.

jonigkeit commented 5 years ago

It is not your functional certificate that is the problem, but the sts instance you have requested the signed id-card from.

Kashif-Ali-110 commented 5 years ago

Thats what i am asking again.

When i called STS-Test server. http://test2-cnsp.ekstern-test.nspop.dk:8080/sts/services/SecurityTokenService and tried to SignIn with SealCard information. I get this error.

Error in SealUtilities.SignIn method: System.ServiceModel.FaultException: Authentication failed: Certificate invalid (Intermediate certificate not issued by OCES Test root certificate) at dk.nsi.seal.SealUtilities.SignIn(SealCard sc, String issuer, String endpointAdr)

SealCard Information is : STS_SignIn(MyClinicFunctionalCertif).txt

But, above SealCard works well with Production STS.

TueCN commented 5 years ago

I think you need a separate certificate issued by "OCES Test root", as described in the error message:

Certificate invalid (Intermediate certificate not issued by OCES Test root certificate)

The certificate that works with Production STS is probably not isseued by "OCES Test root". We in DXC have 2 seperate certificates (1 for test and 1 for prod).

Kashif-Ali-110 commented 5 years ago

Thanks a lot for a quick response/help.

Anyway, I have already posted a new question relating to same certificate issue. #282

I hope any one can reply to it.