Putting CAPI2 logging to good use...
So there was a problem with a printer which you could connect to via SSL in order to print via IPP.
You go in and configure the printer via a web page like so:
Create New Self-Signed Certificate
Create a new self-signed certificate. Warning: This operation will overwrite the currently installed certificate with a new self-signed certificate.
Create Certificate Request
Create the Certificate Request that you will give to a Certificate Authority. The Certificate Request will be used to generate a certificate for you.
Import Certificate and Private Key
Import a certificate and private key to use as the Jetdirect certificate. (Note: This will overwrite the current Jetdirect certificate and private key.
Export Certificate
Export the Jetdirect certificate and private key.
The server was configured for “Create New Self-Signed Certificate “ However, Vista would fail to connect to the server. We would connect to https://10.10.10.34 and Vista fails with an error:
"Windows cannot connect to the printer. Make sure that you have typed the name correctly, and that the printer is connected to network."
BTW - you know you can ctrl+c when those popup boxes are there and capture the info in them right?
So – why did XP work OK but Vista failed..
Let’s start with some CAPI logging… which I discussed back on march 13 , ’07 -- https://blogs.msdn.com/spatdsg/archive/2007/03/13/troubleshooting-pki-problems-on-windows-vista.aspx
The first entry to take note of is this one – spoolsv.exe is the process which is doing a trust verification check
Log Name: Microsoft-Windows-CAPI2/Operational
Source: Microsoft-Windows-CAPI2
Date: 8/6/2007 6:40:34 PM
Event ID: 80
Task Category: Verify Trust
Level: Information
Keywords: Trust Verification
User: CRISCO1\administrator
Computer: VistaCrisco.crisco.com
Description:
<UserData>
<WinVerifyTrustStart>
<EventAuxInfo ProcessName="spoolsv.exe" />
<CorrelationAuxInfo TaskId="{D0BD64A0-244A-46F0-8AA0-E80EF5952D61}" SeqNumber="1" />
</WinVerifyTrustStart>
</UserData>
Then we can clearly see that the certificate is not trusted by the Vista machine we are trying to connect with.
Log Name: Microsoft-Windows-CAPI2/Operational
Source: Microsoft-Windows-CAPI2
Date: 8/6/2007 6:40:35 PM
Event ID: 11
Task Category: Build Chain
Level: Error
Keywords: Path Discovery,Path Validation
User: CRISCO1\administrator
Computer: VistaCrisco.crisco.com
Description:
For more details for this event, please refer to the "Details" section
Event Xml:
<CertGetCertificateChain>
<Certificate fileRef="F5287D67AE6D81E7F7D6C1582BC58DBD7715C870.cer" subjectName="HP Jetdirect 0AF8ACE8" />
<ValidationTime>2007-08-07T01:40:35.389Z</ValidationTime>
<AdditionalStore>
<Certificate fileRef="F5287D67AE6D81E7F7D6C1582BC58DBD7715C870.cer" subjectName="HP Jetdirect 0AF8ACE8" />
</AdditionalStore>
<ExtendedKeyUsage orMatch="true">
<Usage oid="1.3.6.1.5.5.7.3.1" name="Server Authentication" />
<Usage oid="1.3.6.1.4.1.311.10.3.3" />
<Usage oid="2.16.840.1.113730.4.1" />
</ExtendedKeyUsage>
<Flags value="0" />
<ChainEngineInfo context="user" />
<CertificateChain chainRef="{15DE00A4-2C51-42E0-A086-C85E1B51E30A}">
<TrustStatus>
<ErrorStatus value="20" CERT_TRUST_IS_UNTRUSTED_ROOT="true" />
<InfoStatus value="100" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />
</TrustStatus>
<ChainElement>
<Certificate fileRef="F5287D67AE6D81E7F7D6C1582BC58DBD7715C870.cer" subjectName="HP Jetdirect 0AF8ACE8" />
<TrustStatus>
<ErrorStatus value="20" CERT_TRUST_IS_UNTRUSTED_ROOT="true" />
<InfoStatus value="10C" CERT_TRUST_HAS_NAME_MATCH_ISSUER="true" CERT_TRUST_IS_SELF_SIGNED="true" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />
</TrustStatus>
<ApplicationUsage>
<Usage oid="1.3.6.1.5.5.7.3.1" name="Server Authentication" />
<Usage oid="1.3.6.1.5.5.7.3.2" name="Client Authentication" />
</ApplicationUsage>
<IssuanceUsage any="true" />
</ChainElement>
</CertificateChain>
<EventAuxInfo ProcessName="spoolsv.exe" impersonateToken="S-1-5-21-4227054899-3893708993-4289900008-500" />
<CorrelationAuxInfo TaskId="{0FBD18B4-EFAD-4CFE-B4E8-1DE60B22ED57}" SeqNumber="11" />
<Result value="800B0109">A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.</Result>
</CertGetCertificateChain>
There was an option to export the cert from the printer so we do that and import it into the Vista machine trusted root store.
Try again…. Ahh a new error – Ill just paste the relevant section from the CAPI2 logs.
<UserData>
<WinVerifyTrust>
<ActionID>{573E31F8-AABA-11D0-8CCB-00C04FC295EE}</ActionID>
<UIChoice value="2">WTD_UI_NONE</UIChoice>
<RevocationCheck value="0" />
<StateAction value="0">WTD_STATEACTION_IGNORE</StateAction>
<Flags value="80000000" CPD_USE_NT5_CHAIN_FLAG="true" />
<CertificateInfo displayName="10.10.10.34" />
<RegPolicySetting value="23C00" WTPF_OFFLINEOK_IND="true" WTPF_OFFLINEOK_COM="true" WTPF_OFFLINEOKNBU_IND="true" WTPF_OFFLINEOKNBU_COM="true" WTPF_IGNOREREVOCATIONONTS="true" />
<CertificateChain chainRef="{963B980F-686F-4510-B7BA-4E400027465B}" />
<EventAuxInfo ProcessName="spoolsv.exe" impersonateToken="S-1-5-21-4227054899-3893708993-4289900008-500" />
<CorrelationAuxInfo TaskId="{4A74C3A9-C2A6-4C10-A05C-5452578D2010}" SeqNumber="6" />
<Result value="800B010F">The certificate's CN name does not match the passed value.</Result>
</WinVerifyTrust>
</UserData>
</Event>
Hrmm this one is a little more difficult.
The printer automatically creates a name like:
Subject:
OU=J7961G
OU=00110AF8ACE8
O=Hewlett-Packard Co.
CN=HP Jetdirect 0AF8ACE8
And we don’t like the name? The error is : The certificate's CN name does not match the passed value.
What does that mean?
It means that the passed value https://10.10.10.34 did not match the CN….
It does a check in crypt32.dll for the “server name” ( 10.10.10.34 ) against the CN (HP Jetdirect 0AF8ACE8 ) and fails if they are not the same.
We cannot simply connect to https://HP Jetdirect 0AF8ACE8 as it is not a proper FQDN.
So now we know we can’t get around this and change these check. How to configure this then?
The easiest way to workaround it is to generate a self signed cert which does have the proper names we can connect to.
Per the printer config page we could submit a request to a CA – but if we don’t have one then the procedure outlined below is the next best option..
Get a copy of makecert.exe ( its in the free download Platform SDK )
· Run it like so in order to create a self signed cert which has an exportable key and the proper subject.
makecert.exe -r -pe -n "CN=10.10.10.34" -b 07/01/2007 -e 07/01/2010 -eku 1.3.6.1.5.5.7.3.1 -ss My printer.cer
· The switches to make this work are the:
· –pe switch ( allow the keys to be exportable )
· -r self signed
· -eku – specify Server Auth OID
· You will see a new file called printer.cer
C:\Program Files\Microsoft SDKs\Windows\v6.0\Bin>dir prin*
Volume in drive C has no label.
Volume Serial Number is 108D-3591
Directory of C:\Program Files\Microsoft SDKs\Windows\v6.0\Bin
07/31/2007 10:16 AM 542 printer.cer
1 File(s) 542 bytes
0 Dir(s) 3,574,562,816 bytes free
· Now looking in your personal store via certmgr.msc you should see a cert in there with the Issued by field as “CN = 10.10.10.34”
· Right click on this cert, and export this and include the private keys.
· Now, go to the printer management web page and import the .PFX file you just exported.
· Also take the file called printer.cer – and import it to the trusted root store on the Vista machine.
You should now be able to connect OK.
Takeaways:
CAPI2 logging is very very helpful – check it out before you jump to conclusions – it may be more helpful than you realize.
Spatdsg