Wednesday, December 22, 2010

Daily built binary packages for MapServer with OpenSSL support

SSL support has been added to the daily built binaries which provides the option to access a secure WMS/WFS server on Windows. Here are the key steps to configure this option in your Mapserver/Mapscript installation:

1. Configure the mapfile with one or more WMS/WFS client layer

This will require to configure a layer with 'CONNECTIONTYPE WMS' or 'CONNECTIONTYPE WFS' and set up your connection information according to the following fragment:

LAYER
    CONNECTION "https://www.secureservice.com/service?"
    CONNECTIONTYPE WMS
    METADATA
      "wms_srs"    "EPSG:4326"
      "wms_name"    "NAME"
      "wms_format"    "image/png"
      "wms_server_version"    "1.1.1"
      "wms_auth_username" "username"
      "wms_auth_password" "password"
  END
    TYPE RASTER
    ...
  END


2. Make sure to install all the required files in your deployment

For the SSL support you require to install libeay32.dll and ssleay32.dll along with libcurl.dll in the run-time configuration. Without having OpenSSL added to the builds you got the following error:

msHTTPExecuteRequests(): HTTP request error. HTTP: request failed with curl error code 1 (Protocol https not supported or disabled in libcurl)

3. Set up the cerificate bundle along with your installation.

In short it will require to set up the CURL_CA_BUNDLE environment variable to point to the location of the .crt file. You can find this file (curl-ca-bundle.crt) in the /bin/curl folder of the binary packages mentioned above. The file contains the most recent version of http://curl.haxx.se/ca/cacert.pem (at the time of the nightly build).

Note: CURL_CA_BUNDLE can be set up system wide (in My Computer->Properties), however you may prefer to apply this environment setting only for the process hosting the mapserver libraries so as not to cause side effects for other applications using libcurl and openSSL. The main issue here is that most of the libararies use getenv to retrieve the environment setting, which operates only on the data structures accessible to the run-time library (msvcrt) and not on the environment "segment" created for the process by the operating system. In this regard the libraries work only on a snapshot of the variables that have been set during the process startup. In this regard you may choose to set up the environment before the process has been started (by using a startup script) or use _putenv to set up the environment variable at run time. I will be trying to discuss this topic in more detail in a subsequent post.

You may check whether your WMS/WFS server is working with the standalone installation of curl.exe in the binary packages and open an SDK command prompt by using SDKShell.bat supported with the packages. In the command prompt you may use a valid url to your service, like:

 curl "https://username:password@www.secureservice.com/service?..."

At this point if you get valid data response you may omit the following step.

4. Extract the certificate entry from the server

In the previous step if you get the following error, your remote server probably use a self-signed SSL certificate and the server certificate is not included in your CA bundle file.

curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed


To get the remote server certificate you may use openssl.exe in the command prompt (also included in the daily buillt packages) according to the folowing example (you may probably use the default SSL port:443 in most cases):

  openssl s_client -connect www.secureservice.com:443

Copy all from "-----BEGIN CERTIFICATE-----" tag to "-----END CERTIFICATE-----" tag. Paste it at the end of the curl-ca-bundle.crt file, and repeat #3 to make sure the certificate data is now working.

13 comments:

  1. When running MapServer on IIS (from your build packages), the CURL_CA_BUNDLE is always empty even if this is set in the Windows environment properties (tried Windows 7, Win Server 2008R2, and 6.4 builds for MSVCR 2008 and 2013).

    I tried setting the fastCgi environmentVariables but these are also not picked up. Could this be related to what you wrote - "most of the libraries use getenv..which operates only on the data structures accessible to the run-time library (msvcrt) and not on the environment "segment"

    There are more details at http://lists.osgeo.org/pipermail/mapserver-users/2015-February/077419.html

    Has anyone successfully used environmentVariables and FastCGI on Windows?

    ReplyDelete
  2. Brilliant content is sometimes impossible to find! To protect you Galaxy Note 8 phone, you can use Samsung Galaxy Note 8 Cases.

    ReplyDelete
  3. It is a fantastic post – immense clear and easy to understand. I am also holding out for the sharks too that made me laugh. BinaryStrategy

    ReplyDelete
  4. It is a great website.. The Design looks very good.. Keep working like that!. recover money lost to binary options

    ReplyDelete
  5. It is even a good way for the fan to enjoy the Super Bowl 2020 Live Stream game even if you do not wish to opt for any contract cable. Not only Super Bowl live, but you can also enjoy the different sporting events on the television. You simply need a good connection along with the Sling Blue Package.

    ReplyDelete
  6. Ingatlah ini dalam pikiran Anda saat merancang keputusan ini pasti terakhir. Kartu slot online terbaru debit hanyalah kartu yang akan diterbitkan oleh bank yang memungkinkan situs slot online siapa pun untuk mengelola dana dan memasukkannya ke banyak catatan lain secara elektronik. Mengenai debit akses situs slot online yang prabayar sebenarnya fungsinya sama.

    ReplyDelete
  7. King88bet adalah situs judi bola online terpercaya

    Tidak dapat dipungkiri dengan adanya situs daftar judi bola online terpercaya KING88BET di Indonesia yang sudah dilangsungkan Situs Judi Slot selama lebih dari puluhan tahun. Kehadiran agen SBOBET atau bandar judi King88Bet yang ada, mempunyai feedback yang positif dan pasti ada yang negatif. KING88BET muncul di tahun 2010 sebagai situs agen bola terpercaya atau agen judi bola online yang mempunyai lisensi resmi asia mempunyai nama mesin slot terpercaya First Cagayan Leisure dan PAGCOR yang Situs Judi Slot sedang di Filipina dan Isle of man, pasti disambut hendak Deposit Pulsa Tanpa Potongan sekali oleh masyarakat.

    Kunjungi situs King88bet dan alternatifnya berikut ini :

    mesin slot online terpercaya ,
    deposit pulsa tanpa potongan ,
    situs slot qq online ,
    agen slot online terpercaya ,
    situs judi slot ,
    agen bola online terpercaya ,
    sabung ayam online terpercaya ,
    agen casino online terpercaya ,
    slot tembak ikan online ,
    slot game online terpercaya ,
    slot qq online terpercaya ,

    Kami kesatu muncul melalui telemarketing, grup facebook, dan SMS serta komunitas-komunitas pemain judi bola 88. Seiring berkembangnya teknologi kami membina daftar situs judi bola resmi dan terpercaya dan sejumlah link pilihan SBOBET88 supaya dapat Situs Judi Slot diakses dengan gampang oleh semua pemain kami mesin slot terpercaya dimanapun dan kapanpun. Tidak asing lagi bahwa KING88BET ialah situs judi bola terpercaya di Indonesia. Dibangun dari teknologi perjudian agen bola terpercaya dengan memusatkan pada permainan judi bola online yang bisa diakses dengan gampang oleh semua masyarakat. Sebagai agen King88Bet di Indonesia dengan akun lebih dari jutaan pemain, situs judi online24 jam ini pun mempunyai ijin yang mencakup lisensi agen bola SBOBET resmi, judi online, live casino online, dan sebagainya.

    ReplyDelete
  8. QuickBooks is the accounting tool and there is other tool quicken and the difference is the quicken is small hand made accounting tool as quickbooks is hardcore bug accounting tool in comparison of quicken mileage tracker

    ReplyDelete
  9. They can disrobe before you. If you need to recruit them for joy by blending with prominent Call Girls in Chanakyapuri, you can appreciate the night with a solitary call or WhatsApp message. On the off chance that you are frugal yet need to appreciate pleasurable closeness proceed to visit the spot while our agency furnish you with respectable and proficient Call Girls in Chanakyapuri to excite your remain. Our escort agency, Chanakyapuri Call Girls have connections to Call Girls in Chanakyapuri with the most blazing, sizzling and enchanting highlights. At long last, we know about some deceitful demonstrations submitted by most Call Girls in Chanakyapuri. You are really supposed to go for Call Girls in Chanakyapuri if you really want to have the best escort. You will surely be astonished to explore their natural beauty and looks. The Call Girls in Chanakyapuri always thinks of their clients.

    ReplyDelete
  10. We have actual scenarios that cause your purpose to double or treble. An escort maidservant is your partner for every action you want to do with them, similar to the Escorts Service in Chanakyapuri do. For your convenience, Eager for any of this young lady’s room, then you will be meeting with an independent, and clever young Escorts Service in Chanakyapuri committed to suit you an incredible social and suggestive experienceThe availability of Top Escorts Service in Chanakyapuri and other forms of Escorts, such as those associated with VIPs, makes it a popular choice amongst those who cannot afford their companion. Escorts Service in Chanakyapuri For Booking of Escorts Service in Chanakyapuri Delhi. Each and every detail that I have narrated here about my bodily assets is fully authentic and reliable We attempt the best Prostitutes in Chanakyapuri to be capable it give you the best assistance from our Escorts Service in Chanakyapuri. We have each sort of the young lady that can give you harmony and body love when you will invest enough energy with that young lady. But at the end of the day, human behavior is unpredictable and often goes against the tenets of probity and established norms. In this article, we will be delving a bit deep into the world of Escorts Service in Chanakyapuri

    ReplyDelete