Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 11 replies
  • Subscribers 1 subscriber
  • Views 21044 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Client not getting certificate via RMS "Caught CORBA system exception"

asester

Hey all,

I've got multiple clients that are getting this error in the router log.....and I used the same install package that some of my other clients are using and ARE reporting to the SEC via the message relay.  I am able to telnet to the message relay from the client using 8192 (which returns the IOR with a sequence of numbers) and 8194 (returns a blank screen with a cursor).  I am aware that the Auto Update and RMS services run separate, but I thought I should mention that all of the clients update just fine from the message relay.

I have been reading multiple cases but haven't really seen any concrete resolutions to this issue...and since my problem is sporatic I'm making a new thread.  The 'netstat -n' command I ran on the message relay shows the 8192 ports with the client IP's that I'm having issues with in TIME_WAIT status.

Here is an insert from the router log on the client I'm having issues with.

16.07.2013 15:29:13 050C I Successfully validated parent router's IOR
16.07.2013 15:29:13 050C I Accessing parent
16.07.2013 15:29:18 09A4 I Logged on Agent for certification
16.07.2013 15:29:18 0A30 I Routing to parent: id=03E5AD1E, origin=Router$rv20009056:27138.Agent, dest=CM, type=Certification.CertRequest
16.07.2013 15:30:58 050C E ParentLogon::RegisterParent: Caught CORBA system exception, ID 'IDL:omg.org/CORBA/TRANSIENT:1.0'
OMG minor code (2), described as '*unknown description*', completed = NO
 
16.07.2013 15:31:28 050C I Getting parent router IOR from 165.201.22.33:8192
16.07.2013 15:31:28 050C I Received parent router's IOR: (number way too long to paste...and shouldn't matter since it matches)

16.07.2013 15:31:28 050C I Successfully validated parent router's IOR
16.07.2013 15:31:28 050C I Accessing parent
16.07.2013 15:31:50 050C E ParentLogon::RegisterParent: Caught CORBA system exception, ID 'IDL:omg.org/CORBA/TRANSIENT:1.0'
OMG minor code (2), described as '*unknown description*', completed = NO

etc etc....The log repeats those steps and never obtains the certification request.

Any suggestions?

Thanks,

Adam

:41705


This thread was automatically locked due to age.
Parents
  • 0

    HI,

    Something is going wrong when accessing the parent on 8194.  A couple of things I would be interested in seeing would be:

    1. If the certificate can be obtained reliably from 8194 from the client.  

    I would try conecting up to 10 times to see the responsiveness of the data coming back with an SSL client such as:

    http://slproweb.com/products/Win32OpenSSL.html

    Win32 OpenSSL v1.0.1e Light and Visual C++ 2008 Redistributables should be all you need.

    The in a command prompt switch to:

    C:\OpenSSL-Win32\bin\

    and run:

    openssl.exe s_client -connect parentaddress:8194

    Does it error or show the certificate?

    2. Trace logging on the client router might help to see what error message is returned after accessing parent.

    Under:

    HKEY_LOCAL_MACHINE\SOFTWARE\[Wow6432Node]\Sophos\Messaging System\Router

    create a DWORD value called LogLevel and set it to 2.

    Under:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Message Router

    Edit the image path from:

    "C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\RouterNT.exe" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194

    to read:

    "C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\RouterNT.exe" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194 -ORBDebug -ORBDebugLevel 10 -ORBVerboseLogging 2

    More details here:

    http://www.dre.vanderbilt.edu/~schmidt/DOC_ROOT/TAO/docs/Options.html

    Restart the router, wait a few seconds to give it a chance to start, what does it say in the logs after "Accessing parent".  Next 25 lines for example?

    3. A Wireshark capture of the router starting and communicating with the parent router.

    4. Consider the MTU along the path, it may be that the client is not receiving back from the path a request to fragment the data.

    Regards,

    Jak

    :41707
Reply
  • 0

    HI,

    Something is going wrong when accessing the parent on 8194.  A couple of things I would be interested in seeing would be:

    1. If the certificate can be obtained reliably from 8194 from the client.  

    I would try conecting up to 10 times to see the responsiveness of the data coming back with an SSL client such as:

    http://slproweb.com/products/Win32OpenSSL.html

    Win32 OpenSSL v1.0.1e Light and Visual C++ 2008 Redistributables should be all you need.

    The in a command prompt switch to:

    C:\OpenSSL-Win32\bin\

    and run:

    openssl.exe s_client -connect parentaddress:8194

    Does it error or show the certificate?

    2. Trace logging on the client router might help to see what error message is returned after accessing parent.

    Under:

    HKEY_LOCAL_MACHINE\SOFTWARE\[Wow6432Node]\Sophos\Messaging System\Router

    create a DWORD value called LogLevel and set it to 2.

    Under:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Message Router

    Edit the image path from:

    "C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\RouterNT.exe" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194

    to read:

    "C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\RouterNT.exe" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194 -ORBDebug -ORBDebugLevel 10 -ORBVerboseLogging 2

    More details here:

    http://www.dre.vanderbilt.edu/~schmidt/DOC_ROOT/TAO/docs/Options.html

    Restart the router, wait a few seconds to give it a chance to start, what does it say in the logs after "Accessing parent".  Next 25 lines for example?

    3. A Wireshark capture of the router starting and communicating with the parent router.

    4. Consider the MTU along the path, it may be that the client is not receiving back from the path a request to fragment the data.

    Regards,

    Jak

    :41707
Children
No Data