Technical Notes

Reflection for the Web Certificate, Token, and Security Errors
Technical Note 1958
Last Reviewed 11-Apr-2008
Applies To
Reflection for the Web 2008 (All Editions)
Reflection for the Web version 8.0 through 9.x
Summary

This technical note provides steps for troubleshooting the following common security-related Reflection session connection errors.

Follow the troubleshooting suggestions for the specific error you are encountering.

About Reflection for the Web and Security

Depending on how Reflection for the Web is configured, the authentication process may use any or all of the following security certificates: web server, Reflection management server, security proxy server, host, client, LDAP server, or metering server.

About Tokens

When sessions are configured to use the security proxy with client authorization enabled (the default), a client authorization token is required to launch a secure session. The authorization token assures that the client has been authorized for the session by the management server and is signed by the management server’s certificate.

For further information about Reflection and security certificates, see Technical Note 1600.

Troubleshooting Security Errors

The following sections describe common causes of these errors and explain how to resolve each issue. Follow the recommendations for the error you are seeing.

"The application's digital signature has an error"

Beginning on April 9, 2008, Reflection for the Web version 9.x users may experience the following error when running Reflection for the Web.

Cause

When the Sun Java plug-in loads the Reflection for the Web applet, it checks the code-signed certificate from Thawte, which expired on April 9, 2008.

Workaround

Although the digital certificate has expired, it is still valid. Reflection for the Web will continue to work if users click Run to bypass the error. Select the "Always trust content from this publisher" check box to stop the warning dialog from displaying each time you connect.

Attachmate is aware of this issue and is working to resolve it in an upcoming service pack. This technical note will be updated when a fix is available.

"Expired or invalid authorization token"

• The token has expired.

• The security proxy does not have the current certificate.

• The system clocks are out of synchronization.

"Missing authorization token"

This error can be caused by either of the following situations.

• The management server certificate has expired.

• The system clocks are out of synchronization.

"SSL server identity does not match the common name in the certificate"

This message indicates that the common name used in an SSL host certificate does not match the server name configured in the Reflection for the Web session.

To resolve this problem compare the common name in the certificate with the security proxy name or host SSL server name (if configured for direct SSL) with the Reflection for the Web session configuration.

To check the security proxy certificate, follow these steps:

1. Open the Security proxy wizard.
2. On the Security Proxy Certificates tab, view the common name field within the distinguished name details.
3. On the Advanced Settings tab, verify the name of the security proxy server shown at the bottom of the screen.

If necessary, modify the name to match the common name of the certificate, or delete the old certificate and create a new certificate to match the server name.

To check a host’s SSL certificate, follow these steps:

1. From your browser, establish an HTTPS connection to the host over the SSL port. Use the same name configured in the Reflection for the Web session.
2. If a dialog box opens warning that the name on the certificate does not match the name of the site, click View Certificate.

3. If the common names do not match, adjust the name used in the Reflection for the Web session to match the certificate or obtain a new certificate with the correct common name.

"Certificate found but it is not yet valid or has expired"

"TLS alert: Certificate expired"

These errors typically relate to the security proxy certificate, or a host’s SSL certificate if configured for direct SSL. Verify that the certificate has not expired and that the clocks on management server, security proxy, and client machines are set to the same time.

"Creation of master secret failed” followed by “Connection to host failed”

This error indicates that your java clients may not have the high encryption security pack installed.To alleviate this problem, choose one of the following solutions (steps below):

• Install the java high encryption security pack on each client, or
• Disable 256-bit AES on your host, or
• Disable 256-bit AES in the Reflection for the Web client session (version 7.01 or higher). 128-bit AES will not cause this error.

Install the java high encryption security pack on each client

By default, the Sun Java Plug-in does not support 256-bit AES. To enable your workstations to support 256-bit AES connections:

1. Download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files (5.0) from:

2. Install the JCE Unlimited Strength Jurisdiction Policy Files on each workstation that uses the Sun Java Plug-in and the Reflection for the Web clients.

For further details, see the readme.txt file that comes with the JCE Unlimited Strength Jurisdiction Policy Files.

Disable 256-bit AES on your host or security proxy

Refer to your host documentation for information about disabling 256-bit AES on your host. If using the security proxy, follow these steps to check the cipher suite on the security proxy certificate.

1. Start the Security Proxy Wizard.
2. On the Proxies tab, select the port and click Modify.
3. Under cipher suites and certificates, select the certificate and click Modify.
4. Under Cipher Suite properties, if the Cipher Suite is RSA or DSA with 256 AES, select a different option.
5. Click Save.

After making these changes, you must export the new certificate and settings to the management server.

Disable 256-bit AES in the Reflection for the Web client session (7.01 or higher)

To disable 256-bit AES in version 7.01 or higher of the Reflection for the Web client session, follow the steps below.

Note: It is not necessary to disable 128 bit AES.

1. Open the Administrative WebStation and click Session Manager.
2. Click the session name to open the session configuration page.
3. Click Applet Parameters.
4. In the Custom parameters section, enter these values:

5. Click Add to add this parameter and value to the Current Parameters list.
6. Click Continue, and then click Save Settings.

"Certificate is not trusted" followed by "Connection to host failed"

This error indicates that the security proxy or host SSL (if the host is configured for SSL) certificate has not been imported into the Reflection management server.

To verify that the certificate is listed in the Administrative WebStation:

1. In the Administrative WebStation, click Security Setup.
2. On the Certificates tab, under Administer Terminal Emulator Applet Trusted Certificate List, click View or modify certificates trusted by the terminal emulator applet.

If you are using static, unprotected sessions (sessions that are not listed in the Links List) that are configured to go through the security proxy, this error occurs because the trustedps.pfx file is not downloaded to the client. The trustedps.pfx file contains the security proxy certificate. To correct the problem, add the following parameter to the .html for the session, which results in an automatic download of the trustedps.pfx file:

Security Alert Pop-Up

Users get a browser Security Alert pop-up when attempting an HTTPS connection to the web server. These alerts are not fatal. If the client accepts the certificate, the connection is successful.

Three Security Alert pop-ups could occur, depending on the condition. Follow these suggestions to resolve these issues:

• The web server’s certificate is not from a trusted source.

To resolve this issue, purchase a CA signed certificate for the web server or install the certificate into the client browser’s trusted certificate store. To install the certificate, click View Certificate in the alert pop-up dialog box, and the select Install Certificate.

• The web server’s certificate is expired or not yet valid.

• The name on the certificate is invalid or does not match the web site’s name.

Browser Security Warning Pop-Up

Users are getting a Warning – Security pop-up about the Reflection for the Web applet. This warning is a security feature, notifying the client that a signed applet is being downloaded. The applet is signed by a CA (Thawte or Verisign, depending on the version of Reflection for the Web), which is a trusted company.

If the Reflection for the Web software is older than version 7.0, the security certificate may have expired. Because it is not feasible for Attachmate to resign and reissue older product certificates, there is no solution for an expired product certificate.

To work around this issue, either upgrade to the current version of Reflection for the Web, or click Yes each time this warning is displayed. Click Always to eliminate future warnings about this certificate.

Further Troubleshooting

If you encounter an error message that is not resolved by the suggestions provided in this technical note contact Attachmate Technical Support. Note: To receive support, your organization's Reflection for the Web maintenance agreement must be current.

For contact information, see http://support.attachmate.com/contact/.

When you contact support, please have the following information available:

• A Java console that captures the error condition (for details on obtaining a java console, see Technical Note 1433.
• A screen shot or the exact wording of error message(s).
• A debug log file.

Follow the steps below to create a debug log file specific to your issue.

For security proxy related issues, enable debugging:

1. Open the Security Proxy Wizard.
2. On the Logging tab, select all of the filters.
3. Click Save.
4. Recreate the problem.
5. Locate the log file in the \ReflectionServer\Securityproxy\logs folder.
6. Make a copy of the log file and be prepared to forward it to Attachmate Technical Support.

For access control and Administrative WebStation access issues, enable debugging:

1. Open \ReflectionServer\ReflectionData\properties\log.properties.
2. Change the line that reads:

3. Save the file.
4. Restart the Reflection Server. For Microsoft Windows, stop and restart the server from Windows Services. On other platforms, stop and restart the servlet runner, typically Tomcat.
5. Recreate the problem.
6. Locate the trace.log file in the \ReflectionServer\ReflectionData\log\ folder.
7. Make a copy of the logfile and be prepared to forward it to Attachmate Technical Support.

For emulation and display issues, obtain an event trace:

1. Launch the session with Advanced or Administrative menu level set, or launch it from Session Manager inside the Administrative WebStation.
2. Go to Help > Start Trace and provide a name for the trace file.
3. Recreate the problem.
4. Go to Help > Stop Trace.
5. Make a copy of the resulting .evt file and be prepared to forward it to Attachmate Technical Support.

Related Technical Notes

1600	Using Certificates with Reflection for the Web
1956	Error Message: "Invalid or missing authorization token"
2114	Reflection for the Web Session Fails to Launch
2115	Reflection for the Web Sessions Fail to Connect