DISCLAIMER : As I am a sysadmin with very limited knowledge of Zennoposter for now, please forgive any Zennoposter approximative words in this post.
During a Freelance mission for a customer that uses Zennoposter I experienced a strange behaviour from Zennoposter (the action part).
I was migrating web apps to new servers and when testing json values retrieval on the new web stack , the Zennoposter browser was retrieving the json value correctly, and the Zennoposter corresponding Action was not.
It appeared that Zennoposter Action didn't handled ECDSA ciphers at all during TLS handshake and retrieved nothing. Zennoposter Actions only succeded with RSA ciphers suite.
The problem has been solved by configuring the new web server to allow RSA-based TLS cipher suites and by re-issueing a ECDSA+RSA certificate .
Of course I had been able to solve the issue by adapting our new server to this Zennoposter limitation, but what if one needs to perform Zennoposter Action on external webservers that don't allow RSA ciphers suite ?
ECDSA TLS ciphers suite support for Zennoposter actions would be a great enhancement since default TLS ciphers suite installation seems to provide only ECDSA.
Troubleshooting story
This problem was quite difficult to troubleshoot as tests with curl, firefox, and Zennoposter browser were OK. The Zennoposter browser always handled the ECDSA ciphers because it uses Chromium browser (or some parts of it) as backend which handles a very large suite of ciphers.
Once I made some packet tracing with Wireshark, I realized there were a TLS Handshake failure each time I was performing a Zennoposter Action
Then I compared SSL parameters from the old web server
and the new one
and realized ciphers were not matching at all, hence I allowed RSA ciphers-suite the new web server and reissued a ECDSA+RSA SSL certificate and it was all good !
During a Freelance mission for a customer that uses Zennoposter I experienced a strange behaviour from Zennoposter (the action part).
I was migrating web apps to new servers and when testing json values retrieval on the new web stack , the Zennoposter browser was retrieving the json value correctly, and the Zennoposter corresponding Action was not.
It appeared that Zennoposter Action didn't handled ECDSA ciphers at all during TLS handshake and retrieved nothing. Zennoposter Actions only succeded with RSA ciphers suite.
The problem has been solved by configuring the new web server to allow RSA-based TLS cipher suites and by re-issueing a ECDSA+RSA certificate .
Of course I had been able to solve the issue by adapting our new server to this Zennoposter limitation, but what if one needs to perform Zennoposter Action on external webservers that don't allow RSA ciphers suite ?
ECDSA TLS ciphers suite support for Zennoposter actions would be a great enhancement since default TLS ciphers suite installation seems to provide only ECDSA.
Troubleshooting story
This problem was quite difficult to troubleshoot as tests with curl, firefox, and Zennoposter browser were OK. The Zennoposter browser always handled the ECDSA ciphers because it uses Chromium browser (or some parts of it) as backend which handles a very large suite of ciphers.
Once I made some packet tracing with Wireshark, I realized there were a TLS Handshake failure each time I was performing a Zennoposter Action
Then I compared SSL parameters from the old web server
and the new one
and realized ciphers were not matching at all, hence I allowed RSA ciphers-suite the new web server and reissued a ECDSA+RSA SSL certificate and it was all good !