August 19, 2012

P. Most P. Most
Lab Rat
8 posts

[Solved] Https page works in Windows but not in Linux

 

Hi everybody,

I wrote a small program under Linux which uses QWebView to display Web pages. When I tested this with HTTPS sites I stumbled upon a site (https://www.vertriebspartner.de.o2.com) which results in a blank page. I tried the exact same code under Windows and there everything works. The only difference I saw was that under Windows the onSslError() displays ‘The certificate has expired’ message which I didn’t see under Linux. Under Linux it doesn’t display any error message! The only other difference I noticed was that under Windows the OpenSSL ssleay32.dll version 0.9.8.14 is used but under Linux it’s libssl.so.1.0.0

I also tested another QtWebKit based browser (Arora 0.11.0) (but only under Linux) and it shows the same blank page and it gets stuck at 10%. But when I used the KDE rekonq browser or Googles Chrome, then the page gets loaded. So It seems to me it is not a WebKit problem, but they are obviously doing something differently then the plain QtWebKit based browsers. But I’m not an SSL expert, so I don’t know whether I’m supposed to do something different under Linux and I was not able to find out what rekonq is doing differently.

Out of sheer desperation I even build Qt5 and tested my program with it, just to see whether it might be a (fixed) bug in Qt, but it shows the same blank page.

I’m running out of ideas, so if somebody could give me a hint what I have to do, it would be greatly appreciated.

My environment is: – Kubuntu 12.04 (64-Bit) / Windows XP (32-Bit) – QtSdk 1.2.1 (Qt 4.8.1) (Windows and Linux)

Regards Peter

PS: I tried the solution from this thread http://qt-project.org/forums/viewthread/15949/ but this didnt’ help

mainwindow.h:

  1. #ifndef MAINWINDOW_H
  2. #define MAINWINDOW_H
  3.  
  4. #include <QtGui/QMainWindow>
  5. #include <QtNetwork/QNetworkReply>
  6.  
  7. class MainWindow : public QMainWindow
  8. {
  9.     Q_OBJECT
  10. public:
  11.     MainWindow(QWidget *parent = 0);
  12.  
  13. private slots:
  14.     void onSslErrors(QNetworkReply* reply, const QList<QSslError> &errors);
  15. };
  16.  
  17. #endif // MAINWINDOW_H

mainwindow.cpp:

  1. #include "mainwindow.h"
  2. #include <QDebug>
  3. #include <QtGui/QApplication>
  4. #include <QtWebKit/QWebView>
  5. #include <QtNetwork/QSslError>
  6. #include <QtNetwork/QSslConfiguration>
  7.  
  8. MainWindow::MainWindow(QWidget *parent)
  9.     : QMainWindow(parent)
  10. {
  11.     QWebView *view = new QWebView( this );
  12.  
  13.     connect(view->page()->networkAccessManager(), SIGNAL(sslErrors(QNetworkReply*, const QList<QSslError> & )),
  14.                 this, SLOT(onSslErrors(QNetworkReply*, const QList<QSslError> & )));
  15.  
  16.     view->load( QUrl( "https://www.vertriebspartner.de.o2.com"));
  17.  
  18.     view->show();
  19.     setCentralWidget( view );
  20. }
  21.  
  22.  
  23. void MainWindow::onSslErrors(QNetworkReply* reply, const QList<QSslError> &errors)
  24. {
  25.     qDebug() << "onSslErrors: ";
  26.     foreach (QSslError e, errors)
  27.         qDebug() << "ssl error: " << e;
  28.  
  29.     reply->ignoreSslErrors();
  30. }
  31.  
  32. int main(int argc, char *argv[])
  33. {
  34.     QApplication application(argc, argv);
  35.  
  36.     Q_ASSERT( QSslSocket::supportsSsl() );
  37.  
  38.     MainWindow w;
  39.     w.show();
  40.  
  41.     return application.exec();
  42. }

WebViewBrowser.pro:

  1. #-------------------------------------------------
  2. #
  3. # Project created by QtCreator 2012-08-18T12:25:22
  4. #
  5. #-------------------------------------------------
  6.  
  7. QT       += core gui webkit network
  8.  
  9. CONFIG += debug
  10.  
  11. TARGET = WebViewBrowser
  12. TEMPLATE = app
  13.  
  14. SOURCES += mainwindow.cpp
  15.  
  16. HEADERS  += mainwindow.h
–

12 replies

August 20, 2012

AcerExtensa AcerExtensa
Robot Herder
608 posts
  • Groupie L1

Have tested it right now with QT 4.7.4 & 4.8.3(own compilation) on my LFS 64-bit and Ubuntu 12.04 32-bit, works just fine…
Seems to be openssl problem on your linux distribution…

 Signature 

God is Real unless explicitly declared as Integer.

August 20, 2012

P. Most P. Most
Lab Rat
8 posts

Hi,

thank you for the test! Could you tell me what version of openssl is installed on your machines? This might help me in narrowing down the problem.

But what I don’t understand then is, if Chrome and rekonq are QtWebKit based and hence use openssl, why do they work?

Regards Peter

August 20, 2012

AcerExtensa AcerExtensa
Robot Herder
608 posts
  • Groupie L1

On LFS 64-bit it is:

  1. OpenSSL 1.0.0c 2 Dec 2010

On ubuntu 12.04 32-bit:

  1. OpenSSL 1.0.1c 10 May 2012

But like I said – I have compiled Qt by myself… That can be the reason too…

 Signature 

God is Real unless explicitly declared as Integer.

August 20, 2012

P. Most P. Most
Lab Rat
8 posts

I’ve compiled Qt5 myself and it didn’t work, so I don’t think that is the problem. I’m not (yet) an SSL expert and I hoped I can avoid becoming one ;-) , but my current guess is that is has something to do with the certificates installed on my machine.

The biggest problem is that I’m not getting any error message what so ever, which would give me a hint to what is wrong.

Regards Peter

August 20, 2012

AcerExtensa AcerExtensa
Robot Herder
608 posts
  • Groupie L1

So, your onSslErrors function didn’t even get fired?
Can you try to download website certificate and test it with QSslCertificate [qt-project.org] ?
And maybe playing with QSslConfiguration [qt-project.org] can help you…

 Signature 

God is Real unless explicitly declared as Integer.

August 20, 2012

P. Most P. Most
Lab Rat
8 posts
So, your onSslErrors function didn’t even get fired?

No, not in Linux. But on windows (as i wrote ;-) ) I did get ‘The certificate has expired’.

Can you try to download website certificate and test it with QSslCertificate [qt-project.org] ?

Well, that’s why I said I’m not an SSL expert ;-) Could you give me some pointers on how to do this and what I have to look for?

Thank you for your help.

Regards Peter

August 20, 2012

AcerExtensa AcerExtensa
Robot Herder
608 posts
  • Groupie L1

Ok, i have started fresh Ubuntu 12.04 under VirutalBox and can see the same problem.
The problem is in the openssl. You can test it by yourself.(in console)

  1. openssl s_client -showcerts -connect www.vertriebspartner.de.o2.com:443

It will stack right after connection is established. SSL certificate from website uses TLSv1 , no idea why original openssl from Ubuntu can’t just switch right to TLSv1 protocol….

Using following option works just fine:

  1. openssl s_client -showcerts -tls1 -connect www.vertriebspartner.de.o2.com:443

So, try to set following ssl configuration for QNetworkAccessManager of your WebPage:

  1. QSslConfiguration config = sslSocket.sslConfiguration();
  2. config.setProtocol(QSsl::TlsV1);

 Signature 

God is Real unless explicitly declared as Integer.

August 20, 2012

P. Most P. Most
Lab Rat
8 posts

OK, so I modified main() like this:

  1. int main(int argc, char *argv[])
  2. {
  3.  QApplication application(argc, argv);
  4.  
  5.  Q_ASSERT( QSslSocket::supportsSsl() );
  6.  
  7.  QSslConfiguration sslConfig = QSslConfiguration::defaultConfiguration();
  8.  sslConfig.setProtocol( QSsl::TlsV1 );
  9.  QSslConfiguration::setDefaultConfiguration( sslConfig );
  10.  Q_ASSERT(QSslConfiguration::defaultConfiguration().protocol() == QSsl::TlsV1);
  11.  
  12.  MainWindow w;
  13.  w.show();
  14.  
  15.  return application.exec();
  16. }

which I hope is correct because I couldn’t figure out how I get the ‘sslSocket’ from the QNetworkAccessManager. But it didn’t change anything :-(
One think I noted though was when I ran one of the openssl commands you gave me, I get:
‘Verify return code: 20 (unable to get local issuer certificate)’
and then it just hangs.

August 21, 2012

AcerExtensa AcerExtensa
Robot Herder
608 posts
  • Groupie L1

It is known BUG in Ubuntu, where is a lot BUGs around this problem with openssl. For example: Bug #965371 [bugs.launchpad.net]

I have tested it too with QSslConfiguration::setDefaultConfiguration and with QNetworkAccessManager(subclassing QNAM and overriding createRequest function), it just doesn’t work…

Looks like Qt BUG, because sslConfig.setProtocol( QSsl::TlsV1 ); should work, and work in openssl client and in Python using openssl too.

Maybe you can try to rebuild openssl for your Ubuntu…

 Signature 

God is Real unless explicitly declared as Integer.

August 21, 2012

P. Most P. Most
Lab Rat
8 posts
Maybe you can try to rebuild openssl for your Ubuntu…

I will try that and update this thread with the result.

Thank you for your time and effort!

Regards Peter

August 21, 2012

P. Most P. Most
Lab Rat
8 posts

So I build the OpenSSL version 1.0.1c and made sure the newly build shared libraries are picked up from my test application:

  1. lsof -p 9052 | grep ssl
  2. WebViewBr 9052 peter  mem    REG                8,1   470813  9569610 /usr/local/ssl/lib/libssl.so.1.0.0
  3. WebViewBr 9052 peter  mem    REG                8,1  2194319  9569606 /usr/local/ssl/lib/libcrypto.so.1.0.0

but nothing changed. To be honest, I didn’t think it could be an openssl bug because if it were then the questions remains why are Chrome and rekonq working?

So the only option which remains is to wade through the rekonq and KDE Network source and try to find out what it does different :-(

If anybody has another idea or hint, please let me know.

Regards Peter

August 21, 2012

P. Most P. Most
Lab Rat
8 posts

Finally I got it to work! :-) I don’t quite understand it completely yet, but I do understand that openssl on 12.04 seems to be really messy after all the bug reports I’ve read. But anyway, I simply had to replace:

  1. sslConfig.setProtocol( QSsl::TlsV1 );

with

  1. sslConfig.setProtocol( QSsl::SslV3 );

then at least for this specific site it works and for now this is good enough for me.

Thanks again AcerExtensa!

Regards Peter

 
  ‹‹ Setting QObject ownship for QWebFrame javascript      Qt5 Webkit build issue ››

You must log in to post a reply. Not a member yet? Register here!

 
Selected by the fine Qt Content Robot based on tags and ratings.

Possibly related content

Forum posts and FAQ