<div dir="ltr">Hi John,<div class="gmail_extra">
<br><div class="gmail_quote">On Thu, Jan 5, 2017 at 11:23 AM, John Cartwright <span dir="ltr"><<a href="mailto:john.c.cartwright@comcast.net" target="_blank">john.c.cartwright@comcast.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="word-wrap:break-word">Thanks. I used wireshark to trace the session and it appears that QGIS is attempting to make the connection with TLSv1 which I think is at least part of the problem.<div><br></div><div>Can either of you tell me what protocol and cipher suites you’re using? what OS you’re running on? Is there anyway to force QGIS to use a different protocol?</div></div></blockquote><div><br></div><div>In Options -> Authentication -> Manage Certificates -> Servers, which is where SSL Server configurations are listed after they are optionally created in the SSL Error dialog. In an SSL Server configuration, you can set the protocol, though I am unsure why you would *not* want to use TLSv1, since the SSLv2|3 protocols have known vulnerabilities.</div><div><br></div><div><a href="http://drive.dakotacarto.com/qgis/qgis2-ssl-protocols.png">http://drive.dakotacarto.com/qgis/qgis2-ssl-protocols.png</a></div><div><br></div><div>Cipher suites are a bit harder to manage. Although one could use QSslConfiguration::setCiphers(), this is not supported in QGIS's SSL server configurations [0]. I believe you would need to do this via OpenSSL configuration.</div><div><br></div><div>[0] <a href="http://doc.qt.io/qt-4.8/qsslconfiguration.html#setCiphers">http://doc.qt.io/qt-4.8/qsslconfiguration.html#setCiphers</a></div><div><br></div><div>Regards,</div><div><br></div><div>Larry Shaffer<br>Dakota Cartography<br>Black Hills, South Dakota<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="word-wrap:break-word"><div>Thanks!</div><span class="gmail-HOEnZb"><font color="#888888"><div><br></div><div>—john</div></font></span><div><div class="gmail-h5"><div><br><div><blockquote type="cite"><div>On Jan 4, 2017, at 1:59 AM, Pasquale Di Donato <<a href="mailto:pasquale.didonato@gmail.com" target="_blank">pasquale.didonato@gmail.com</a>> wrote:</div><br class="gmail-m_-3219483073013997470Apple-interchange-newline"><div><div dir="ltr">Hi John,<div><br></div><div>I can access your service too. Using QGIS 2.14.8.</div><div>Maybe you have an issue with a proxy?</div><div><br></div><div>Pasquale</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 4, 2017 at 12:57 AM, Jorge Gustavo Rocha <span dir="ltr"><<a href="mailto:jgr@di.uminho.pt" target="_blank">jgr@di.uminho.pt</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi John,<br>
<br>
I've added your WMS service and it works without any problem. I've just added the url and the connect works. The capabilities are displayed.<br>
<br>
You can check the print screen [1] with your https WMS layer.<br>
<br>
I'm using QGIS 2.18.2 on Ubuntu. Which OS are you using?<br>
<br>
Regards,<br>
<br>
Jorge Gustavo<br>
<br>
[1] <a href="http://webgis.di.uminho.pt/~jgr/wms%20with%20https.png" rel="noreferrer" target="_blank">http://webgis.di.uminho.pt/~jg<wbr>r/wms%20with%20https.png</a><span><br>
<br>
<br>
Às 17:42 de <a href="tel:03-01-2017" value="+3903012017" target="_blank">03-01-2017</a>, John Cartwright escreveu:<br>
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span>
Thanks for your reply Luigi! To be clear, the WMS service that I’m<br>
trying to connect to does not require a username/password but is only<br>
available via https. The server (<a href="https://maps.ngdc.noaa.gov/" rel="noreferrer" target="_blank">https://maps.ngdc.noaa.gov</a>) has a<br>
valid CA certificate. I tried adding a SSL Server Configuration<br>
(preferences -> authentication -> Manage Certificates -> Server) and<br>
while the entry appears to be valid, I still get the SSL Handshake error<br>
when trying add a WMS layer.<br>
<br>
Any further ideas? Here’s the actual URL I’m trying to add:<br>
<br>
<a href="https://maps.ngdc.noaa.gov/arcgis/services/gebco08_hillshade/MapServer/WMSServer?request=GetCapabilities&service=WMS" rel="noreferrer" target="_blank">https://maps.ngdc.noaa.gov/arc<wbr>gis/services/gebco08_hillshade<wbr>/MapServer/WMSServer?request=G<wbr>etCapabilities&service=WMS</a><br>
<br>
Thanks again for your help!<br>
<br>
—john<br>
<br>
<br>
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span>
On Jan 2, 2017, at 1:52 AM, Luigi Pirelli <<a href="mailto:luipir@gmail.com" target="_blank">luipir@gmail.com</a><br></span><div><div class="gmail-m_-3219483073013997470h5">
<mailto:<a href="mailto:luipir@gmail.com" target="_blank">luipir@gmail.com</a>>> wrote:<br>
<br>
Hi John<br>
<br>
SSL is managed storing credentials using the QGIS Authentication<br>
Manager that store credentials in the same way as Firefox, in a master<br>
pwd crypted store in your $home/.qgis2/qgis-auth.db.<br>
You should managed credentials using Settings->options->authenticat<wbr>ion.<br>
<br>
QGIS uses OpenSSL => and specifically can import different king of<br>
credential method (using plugins => can be expanded). De default auth<br>
method installed are listed in the documentation:<br>
<a href="https://docs.qgis.org/2.14/en/docs/user_manual/auth_system/auth_overview.html" rel="noreferrer" target="_blank">https://docs.qgis.org/2.14/en/<wbr>docs/user_manual/auth_system/a<wbr>uth_overview.html</a><br>
<br>
what is you auth method? can you explain the workflow you followed to<br>
store and use your credentials?<br>
<br>
regards<br>
Luigi Pirelli<br>
<br>
******************************<wbr>******************************<wbr>******************************<wbr>********<br>
* Boundless QGIS Support/Development: lpirelli AT boundlessgeo DOT com<br>
* LinkedIn: <a href="https://www.linkedin.com/in/luigipirelli" rel="noreferrer" target="_blank">https://www.linkedin.com/in/lu<wbr>igipirelli</a><br>
* Stackexchange: <a href="http://gis.stackexchange.com/users/19667/luigi-pirelli" rel="noreferrer" target="_blank">http://gis.stackexchange.com/u<wbr>sers/19667/luigi-pirelli</a><br>
* GitHub: <a href="https://github.com/luipir" rel="noreferrer" target="_blank">https://github.com/luipir</a><br>
* Mastering QGIS 2nd Edition:<br>
*<br>
<a href="https://www.packtpub.com/big-data-and-business-intelligence/mastering-qgis-second-edition" rel="noreferrer" target="_blank">https://www.packtpub.com/big-d<wbr>ata-and-business-intelligence/<wbr>mastering-qgis-second-edition</a><br>
******************************<wbr>******************************<wbr>******************************<wbr>********<br>
<br>
<br>
On 29 December 2016 at 22:38, John Cartwright<br>
<<a href="mailto:john.c.cartwright@comcast.net" target="_blank">john.c.cartwright@comcast.net</a><wbr>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Hello All,<br>
<br>
I’m trying to use a WMS service over https and get the following<br>
error when trying to connect:<br>
<br>
Failed to download capabilities:<br>
Download of capabilities failed: SSL handshake failed<br>
<br>
The URL works fine in a browser though. I’m guessing that QGIS and<br>
the server are not able to agree on a cipher suite. Can anyone tell<br>
me what ciphers QGIS supports or any way to get more insight into the<br>
underlying problem?<br>
<br>
QGIS is version 2.18.2.<br>
<br>
Thanks!<br>
<br>
—john<br>
<br>
______________________________<wbr>_________________<br>
Qgis-user mailing list<br>
<a href="mailto:Qgis-user@lists.osgeo.org" target="_blank">Qgis-user@lists.osgeo.org</a><br>
List info: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-user" rel="noreferrer" target="_blank">http://lists.osgeo.org/mailman<wbr>/listinfo/qgis-user</a><br>
Unsubscribe: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-user" rel="noreferrer" target="_blank">http://lists.osgeo.org/mailman<wbr>/listinfo/qgis-user</a><br>
</blockquote></div></div></blockquote><div><div class="gmail-m_-3219483073013997470h5">
<br>
<br>
<br>
______________________________<wbr>_________________<br>
Qgis-user mailing list<br>
<a href="mailto:Qgis-user@lists.osgeo.org" target="_blank">Qgis-user@lists.osgeo.org</a><br>
List info: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-user" rel="noreferrer" target="_blank">http://lists.osgeo.org/mailman<wbr>/listinfo/qgis-user</a><br>
Unsubscribe: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-user" rel="noreferrer" target="_blank">http://lists.osgeo.org/mailman<wbr>/listinfo/qgis-user</a><br>
<br>
</div></div></blockquote>
<br>
J. Gustavo<span class="gmail-m_-3219483073013997470HOEnZb"><font color="#888888"><br>
-- <br>
Jorge Gustavo Rocha<br>
Departamento de Informática<br>
Universidade do Minho<br>
4710-057 Braga<br>
Tel: <a href="tel:%2B351%20253604480" value="+351253604480" target="_blank">+351 253604480</a><br>
Fax: <a href="tel:%2B351%20253604471" value="+351253604471" target="_blank">+351 253604471</a><br>
Móvel: <a href="tel:%2B351%20910333888" value="+351910333888" target="_blank">+351 910333888</a><br>
skype: nabocudnosor</font></span><div class="gmail-m_-3219483073013997470HOEnZb"><div class="gmail-m_-3219483073013997470h5"><br>
<br>
______________________________<wbr>_________________<br>
Qgis-user mailing list<br>
<a href="mailto:Qgis-user@lists.osgeo.org" target="_blank">Qgis-user@lists.osgeo.org</a><br>
List info: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-user" rel="noreferrer" target="_blank">http://lists.osgeo.org/mailman<wbr>/listinfo/qgis-user</a><br>
Unsubscribe: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-user" rel="noreferrer" target="_blank">http://lists.osgeo.org/mailman<wbr>/listinfo/qgis-user</a></div></div></blockquote></div><br></div>
______________________________<wbr>_________________<br>Qgis-user mailing list<br><a href="mailto:Qgis-user@lists.osgeo.org" target="_blank">Qgis-user@lists.osgeo.org</a><br>List info: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-user" target="_blank">http://lists.osgeo.org/<wbr>mailman/listinfo/qgis-user</a><br>Unsubscribe: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-user" target="_blank">http://lists.osgeo.org/<wbr>mailman/listinfo/qgis-user</a></div></blockquote></div><br></div></div></div></div><br>______________________________<wbr>_________________<br>
Qgis-user mailing list<br>
<a href="mailto:Qgis-user@lists.osgeo.org">Qgis-user@lists.osgeo.org</a><br>
List info: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-user" rel="noreferrer" target="_blank">http://lists.osgeo.org/<wbr>mailman/listinfo/qgis-user</a><br>
Unsubscribe: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-user" rel="noreferrer" target="_blank">http://lists.osgeo.org/<wbr>mailman/listinfo/qgis-user</a><br></blockquote></div><br></div></div>