You are viewing limited content. For full access, please sign in.

Question

Question

Could not establish trust relationship for the SSL/TLS secure channel Error with Suspended Instances

Forms Version 11 Workflow
Updated March 12, 2024
asked on March 11, 2024

We updated our SSL/TLS certificates the other week and are occassionally getting the following error message on suspended Forms instances:

Error(s):
3/11/2024 11:20:33 AM An unexpected error has occurred. [LFF502-UnexpectedError]

Details:
URL: 
Error: UnexpectedError
Date: 3/11/2024 8:20:33 AM (US Mountain Standard Time)
HTTP Status Code: 500
Business Process ID: 8
Instance ID: 3026305
Business Process Name: XXX

Stack Trace:
Caught exception: Laserfiche.Forms.CommonUtils.Exceptions.LFFormsException
Message: An unexpected error has occurred. [LFF502-UnexpectedError]


Inner exception: System.Net.WebException
Message: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
   at System.Net.HttpWebRequest.GetResponse()
   at Laserfiche.Forms.Routing.WrapHttpWebRequest.GetResponse()
   at Laserfiche.Forms.Routing.LFWorkflowService.Execute(Int32 instanceId, IRoutingContext routingContext, RoutingInstanceStatus OriginalStatus, FormsHistoryContext& historyContext)
   at Laserfiche.Forms.Routing.ServiceTask.Execute(Int32 instanceId, IRoutingContext routingContext)

Inner exception: System.Security.Authentication.AuthenticationException
Message: The remote certificate is invalid according to the validation procedure.
   at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest, Boolean renegotiation)
   at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)
   at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)
   at System.Net.PooledStream.Write(Byte[] buffer, Int32 offset, Int32 size)
   at System.Net.ConnectStream.WriteHeaders(Boolean async)


3/11/2024 11:03:39 AM An unexpected error has occurred. [LFF502-UnexpectedError]

Details:
URL: 
Error: UnexpectedError
Date: 3/11/2024 8:03:39 AM (US Mountain Standard Time)
HTTP Status Code: 500
Business Process ID: 8
Instance ID: 3026305
Business Process Name: XXX

Stack Trace:
Caught exception: Laserfiche.Forms.CommonUtils.Exceptions.LFFormsException
Message: An unexpected error has occurred. [LFF502-UnexpectedError]


Inner exception: System.Net.WebException
Message: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
   at System.Net.HttpWebRequest.GetResponse()
   at Laserfiche.Forms.Routing.WrapHttpWebRequest.GetResponse()
   at Laserfiche.Forms.Routing.LFWorkflowService.Execute(Int32 instanceId, IRoutingContext routingContext, RoutingInstanceStatus OriginalStatus, FormsHistoryContext& historyContext)
   at Laserfiche.Forms.Routing.ServiceTask.Execute(Int32 instanceId, IRoutingContext routingContext)

Inner exception: System.Security.Authentication.AuthenticationException
Message: The remote certificate is invalid according to the validation procedure.
   at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest, Boolean renegotiation)
   at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)
   at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)
   at System.Net.PooledStream.Write(Byte[] buffer, Int32 offset, Int32 size)
   at System.Net.ConnectStream.WriteHeaders(Boolean async)

 

Which certificate is it saying is invalid? I have reviewed the certificates in IIS for Forms and Workflow, but they are showing as valid certificates.

We are using Forms 11.0.2311.50557 and Workflow 11.0.2306.898.

0 0

Replies

replied on March 11, 2024 • Show version history

This suggests it's the one used for the Workflow Web Service (/Workflow):

Inner exception: System.Net.WebException Message: The underlying connection was closed:

Could not establish trust relationship for the SSL/TLS secure channel.

at System.Net.HttpWebRequest.GetResponse()

at Laserfiche.Forms.Routing.WrapHttpWebRequest.GetResponse()

at Laserfiche.Forms.Routing.LFWorkflowService.Execute(Int32 instanceId, IRoutingContext routingContext, RoutingInstanceStatus OriginalStatus, FormsHistoryContext& historyContext)

at Laserfiche.Forms.Routing.ServiceTask.Execute(Int32 instanceId, IRoutingContext routingContext)

There are PowerShell commands/scripts you can run to get more details on remote certificate validation details.

It may, for example, be that the Forms server cannot reach the Certificate Revocation List (CRL) endpoint in order to check if the cert has been revoked. This most commonly happens when an application on a server in a network DMZ that has the internal CA root certificate trusted can connect to an internal HTTPS web endpoint (such as Workflow) and  validate the certificate chain, but not reach the CRL endpoint because it's an internal domain controller or such. You can manually inspect the CRL endpoint in the Workflow certificate properties, then validate if you can reach it from the Forms server throwing the errors.

0 0
replied on March 12, 2024

Thanks for the reply, Sam. I have verified the certificate on the Workflow server, and everything checks out. The Forms server is internal, but I will investigate further to see if for some reason it has an issue with the Workflow certificate.

0 0
replied on March 12, 2024

Intermittent errors suggests that verifying the certificate may have taken longer than usual and .Net/Windows gave up. So possible network glitch?

0 0
replied on March 12, 2024

You might find this PowerShell script useful for troubleshooting cert validation errors in general.

RemoteCertificateValidator.ps1.txt (1.61 KB)
Download
0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.

Details
Attachments
Related Posts
Loading ...