I did have spaces after the commas in the host subject but after regenerating the certs and modifying the command I receive the same error.  I followed the steps to create the certs from the <a href="http://www.spice-space.org/page/SSLConnection">http://www.spice-space.org/page/SSLConnection</a> site.  Should those steps work?<br>
<br><div class="gmail_quote">On Fri, Mar 23, 2012 at 7:36 AM, David Jaša <span dir="ltr">&lt;<a href="mailto:djasa@redhat.com">djasa@redhat.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Anthony,<br>
<br>
I don&#39;t see anything clearly wrong in what you posted in your last two<br>
mails. Just one note: -spice addr=127.0.0.1 means that the host will<br>
only be accessible on the localhost - if you add &quot;&lt;listen type=&#39;address&#39;<br>
address=&#39;0.0.0.0&#39;/&gt;&quot; element to &quot;&lt;graphics&gt;&quot; element in domain xml, qemu<br>
will bind to all ipv4 addresses.<br>
<br>
I&#39;d just check the SSL/TLS stuff again - if your certs are OK, if you<br>
pass correct host subject (without space after comma!), if you pass<br>
correct CA file and so on...<br>
<br>
David<br>
<br>
Anthony James píše v Pá 23. 03. 2012 v 07:20 -0400:<br>
<div class="HOEnZb"><div class="h5">&gt; I just tried connecting using remote-viewer, here is the command:<br>
&gt;<br>
&gt;<br>
&gt; remote-viewer --spice-ca-file=ca-cert.pem<br>
&gt; --spice-host-subject=&quot;$HOSTSUBJECT&quot; spice://localhost/?port=<br>
&gt; $PORT&amp;tls-port=$SPORT<br>
&gt;<br>
&gt;<br>
&gt; It connects but using only the non-tls port.  When I remove port=$PORT<br>
&gt; to try and force it to use the tls-port the connection fails and I see<br>
&gt; this in the VM log:<br>
&gt;<br>
&gt;<br>
&gt; reds_handle_ssl_accept: SSL_accept failed, error=1<br>
&gt;<br>
&gt;<br>
&gt; The remote-viewer version is 0.5.2.<br>
&gt;<br>
&gt; On Fri, Mar 23, 2012 at 7:10 AM, Anthony James<br>
&gt; &lt;<a href="mailto:anthony.james@cintriq.com">anthony.james@cintriq.com</a>&gt; wrote:<br>
&gt;         I created and started the VM with virt-manager.  Here is what<br>
&gt;         looks like the qemu cmd from /var/log/libvirt/qemu/$VM.log<br>
&gt;<br>
&gt;<br>
&gt;         /usr/bin/qemu-kvm -S -M pc-0.15 -cpu core2duo,+lahf_lm,<br>
&gt;         +rdtscp,+popcnt,+sse4.2,+sse4.1,+pdcm,+xtpr,+cx16,+tm2,+est,<br>
&gt;         +smx,+vmx,+ds_cpl,+dtes64,+pbe,+tm,+ht,+ss,+acpi,+ds -enable<br>
&gt;         -kvm -m 2048 -smp 2,sockets=2,cores=1,threads=1 -name $VMNAME<br>
&gt;         -uuid 9046e3aa-81d5-028d-010f-2a755e20aa97 -nodefconfi<br>
&gt;         g -nodefaults -chardev<br>
&gt;         socket,id=charmonitor,path=/var/lib/libvirt/qemu/$VMNAME.monitor,server,nowait -mon chardev=c<br>
&gt;         harmonitor,id=monitor,mode=control -rtc base=localtime<br>
&gt;         -no-shutdown -device<br>
&gt;         virtio-serial-pci,id=virtio-serial0,bus=pci.<br>
&gt;         0,addr=0x5 -device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x8<br>
&gt;         -device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0<br>
&gt;         ,addr=0x9 -device<br>
&gt;         ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0xa<br>
&gt;         -device ich9-usb-uhci3,masterbus=usb.0,f<br>
&gt;         irstport=4,bus=pci.0,addr=0xb -drive<br>
&gt;         file=/vm/$VMNAME.img,if=none,id=drive-virtio-disk0,format=raw<br>
&gt;         -device virtio-bl<br>
&gt;         k-pci,scsi=off,bus=pci.0,addr=0x6,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -drive file=/iso/virtio-win-0.1-2<br>
&gt;         2.iso,if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw -device ide-drive,bus=ide.1,unit=0,drive=drive-ide0-1<br>
&gt;         -0,id=ide0-1-0 -netdev<br>
&gt;         tap,fd=26,id=hostnet0,vhost=on,vhostfd=27 -device<br>
&gt;         virtio-net-pci,netdev=hostnet0,id=net0,mac=52:5<br>
&gt;         4:00:43:e6:dd,bus=pci.0,addr=0x3 -chardev pty,id=charserial0<br>
&gt;         -device isa-serial,chardev=charserial0,id=serial0 -chardev<br>
&gt;         spicevmc,id=charchannel0,name=vdagent -device<br>
&gt;         virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,<br>
&gt;         name=com.redhat.spice.0 -device usb-tablet,id=input0 -spice<br>
&gt;         port=$PORT,tls-port=<br>
&gt;         $SPORT,addr=127.0.0.1,x509-dir=/etc/pki/lib<br>
&gt;         virt-spice -k en-us -vga qxl -global<br>
&gt;         qxl-vga.vram_size=67108864 -device<br>
&gt;         intel-hda,id=sound0,bus=pci.0,addr=0x4 -device h<br>
&gt;         da-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -chardev<br>
&gt;         spicevmc,id=charredir0,name=usbredir -device<br>
&gt;         usb-redir,chardev=ch<br>
&gt;         arredir0,id=redir0 -device<br>
&gt;         virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x7<br>
&gt;<br>
&gt;<br>
&gt;         Also in the log I see the following messages for everytime I<br>
&gt;         try to connect using SSL:<br>
&gt;<br>
&gt;<br>
&gt;         reds_handle_ssl_accept: SSL_accept failed, error=1<br>
&gt;         reds_handle_ssl_accept: SSL_accept failed, error=1<br>
&gt;<br>
&gt;<br>
&gt;         Here are the package versions I&#39;m running:<br>
&gt;<br>
&gt;<br>
&gt;         spice-xpi-2.7-2.fc16.x86_64<br>
&gt;         spice-gtk3-0.11-4.fc16.x86_64<br>
&gt;         spice-gtk-tools-0.11-4.fc16.x86_64<br>
&gt;         spice-client-0.10.1-1.fc16.x86_64<br>
&gt;         spice-server-0.10.1-1.fc16.x86_64<br>
&gt;         spice-gtk-python-0.11-4.fc16.x86_64<br>
&gt;         spice-gtk-0.11-4.fc16.x86_64<br>
&gt;         spice-protocol-0.10.1-1.fc16.noarch<br>
&gt;         spice-glib-0.11-4.fc16.x86_64<br>
&gt;         libvirt-0.9.10-2.fc16.x86_64<br>
&gt;         libvirt-python-0.9.10-2.fc16.x86_64<br>
&gt;         libvirt-client-0.9.10-2.fc16.x86_64<br>
&gt;         qemu-system-x86-1.0-7.fc16.x86_64<br>
&gt;         gpxe-roms-qemu-1.0.1-4.fc16.noarch<br>
&gt;         qemu-common-1.0-7.fc16.x86_64<br>
&gt;         qemu-img-1.0-7.fc16.x86_64<br>
&gt;         virt-manager-common-0.9.1-2.fc16.noarch<br>
&gt;         virt-manager-0.9.1-2.fc16.noarch<br>
&gt;<br>
&gt;<br>
&gt;         The host is running Fedora 16 with the updates-testing<br>
&gt;         virt-preview repos enabled.<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;         On Fri, Mar 23, 2012 at 6:58 AM, David Jaša &lt;<a href="mailto:djasa@redhat.com">djasa@redhat.com</a>&gt;<br>
&gt;         wrote:<br>
&gt;                 Anthony James píše v Pá 23. 03. 2012 v 06:46 -0400:<br>
&gt;                 &gt; David,<br>
&gt;                 &gt;<br>
&gt;                 &gt;<br>
&gt;                 &gt; I just tried about 20 times in a row, same error.<br>
&gt;                  When you say it&#39;s a<br>
&gt;                 &gt; known bug in spicec when connecting manually, what<br>
&gt;                 is the alternative<br>
&gt;                 &gt; to connecting manually?  Is this bug present in<br>
&gt;                 spicy or<br>
&gt;                 &gt; remote-viewer?  Thanks in advance.<br>
&gt;<br>
&gt;<br>
&gt;                 I don&#39;t recall hitting it with remote-viewer. FTR,<br>
&gt;                 remote-viewer&#39;s<br>
&gt;                 invocation format differs from that of spicec and<br>
&gt;                 spicy:<br>
&gt;<br>
&gt;                 remote-viewer &lt;options&gt;<br>
&gt;                 spice://&lt;host&gt;/?port=&lt;port&gt;&amp;tls-port=&lt;sport&gt;<br>
&gt;<br>
&gt;                 you can get the complete list of of options with:<br>
&gt;<br>
&gt;                 remote-viewer --help-all<br>
&gt;<br>
&gt;                 Speaking about it, it might be also the libvirt/qemu<br>
&gt;                 bug that both fired<br>
&gt;                 up with main channel forced to SSL/TLS but without<br>
&gt;                 setting up tls-port<br>
&gt;                 on which would qemu actually listen. Could you post<br>
&gt;                 qemu command line<br>
&gt;                 here so we can rule it out?<br>
&gt;<br>
&gt;                 David<br>
&gt;                 &gt;<br>
&gt;                 &gt; On Fri, Mar 23, 2012 at 6:37 AM, David Jaša<br>
&gt;                 &lt;<a href="mailto:djasa@redhat.com">djasa@redhat.com</a>&gt; wrote:<br>
&gt;                 &gt;         Anthony James píše v Pá 23. 03. 2012 v 06:26<br>
&gt;                 -0400:<br>
&gt;                 &gt;         &gt; David,<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt; Thanks for the reply.  I&#39;ve tried adding<br>
&gt;                 --ca-file to the<br>
&gt;                 &gt;         spicec<br>
&gt;                 &gt;         &gt; command line but still receive the same<br>
&gt;                 error.  Here is the<br>
&gt;                 &gt;         command:<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt; spicec -h localhost -p $PORT -s $SPORT<br>
&gt;                 --secure-channels all<br>
&gt;                 &gt;         &gt; --host-subject &quot;$HOSTSUBJECT&quot; --ca-file<br>
&gt;                 ca-cert.pem -w<br>
&gt;                 &gt;         $PASSWD<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt; Same error:<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt; Error: failed to connect w/SSL, ssl_error<br>
&gt;                 &gt;         &gt; error:00000001:lib(0):func(0):reason(1)<br>
&gt;                 &gt;         &gt; 140613653984512:error:14090086:SSL<br>
&gt;                 &gt;         &gt;<br>
&gt;                 routines:SSL3_GET_SERVER_CERTIFICATE:certificate<br>
&gt;                 verify<br>
&gt;                 &gt;         &gt; failed:s3_clnt.c:1063:<br>
&gt;                 &gt;         &gt; Warning: SSL Error:<br>
&gt;                 &gt;<br>
&gt;                 &gt;<br>
&gt;                 &gt;         Hi Anthony,<br>
&gt;                 &gt;<br>
&gt;                 &gt;         try several times. It&#39;s a known bug in<br>
&gt;                 spicec that when you&#39;re<br>
&gt;                 &gt;         connecting manually, the connection fails<br>
&gt;                 several times before<br>
&gt;                 &gt;         it is<br>
&gt;                 &gt;         established. Actually it&#39;s more frequent if<br>
&gt;                 you specify<br>
&gt;                 &gt;         --secure<br>
&gt;                 &gt;         channels all or if you omit -p altogether<br>
&gt;                 (both have the same<br>
&gt;                 &gt;         effect).<br>
&gt;                 &gt;<br>
&gt;                 &gt;         David<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt; On Fri, Mar 23, 2012 at 6:06 AM, David<br>
&gt;                 Jaša<br>
&gt;                 &gt;         &lt;<a href="mailto:djasa@redhat.com">djasa@redhat.com</a>&gt; wrote:<br>
&gt;                 &gt;         &gt;         Hi Anthony,<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;         Anthony James píše v Čt 22. 03.<br>
&gt;                 2012 v 15:40 -0400:<br>
&gt;                 &gt;         &gt;         &gt; I&#39;m having problems connecting<br>
&gt;                 to a spice virtual<br>
&gt;                 &gt;         machine<br>
&gt;                 &gt;         &gt;         using SSL.<br>
&gt;                 &gt;         &gt;         &gt;  I use the following command to<br>
&gt;                 connect:<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt; spicec -h localhost -p $PORT -s<br>
&gt;                 $SPORT<br>
&gt;                 &gt;         --secure-channels all<br>
&gt;                 &gt;         &gt;         &gt; --host-subject &quot;$HOSTSUBJECT&quot; -w<br>
&gt;                 $PASSWD<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;         You&#39;re missing --ca-file<br>
&gt;                 $CA_CERTIFICATE_FILE in<br>
&gt;                 &gt;         your command<br>
&gt;                 &gt;         &gt;         line.<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;         David<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt; The error I receive is:<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt; Error: failed to connect w/SSL,<br>
&gt;                 ssl_error<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 error:00000001:lib(0):func(0):reason(1)<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 139699632096512:error:14090086:SSL<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 routines:SSL3_GET_SERVER_CERTIFICATE:certificate<br>
&gt;                 &gt;         verify<br>
&gt;                 &gt;         &gt;         &gt; failed:s3_clnt.c:1063:<br>
&gt;                 &gt;         &gt;         &gt; Warning: SSL Error:<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt; I have followed the instructions<br>
&gt;                 from the<br>
&gt;                 &gt;         following 2 sites<br>
&gt;                 &gt;         &gt;         to<br>
&gt;                 &gt;         &gt;         &gt; configure the SSL certs:<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 <a href="http://www.spice-space.org/page/SSLConnection" target="_blank">http://www.spice-space.org/page/SSLConnection</a><br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;<br>
&gt;                 <a href="http://fedoraproject.org/w/index.php?title=QA:Testcase_Virtualization_Manually_set_spice_listening_port_with_TLS_port_set&amp;oldid=255162" target="_blank">http://fedoraproject.org/w/index.php?title=QA:Testcase_Virtualization_Manually_set_spice_listening_port_with_TLS_port_set&amp;oldid=255162</a><br>

&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt; Any help would be greatly<br>
&gt;                 appreciated, I&#39;m sure<br>
&gt;                 &gt;         I&#39;m missing<br>
&gt;                 &gt;         &gt;         something.<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt; Thanks,<br>
&gt;                 &gt;         &gt;         &gt; Tony<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 _______________________________________________<br>
&gt;                 &gt;         &gt;         &gt; Spice-devel mailing list<br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 <a href="mailto:Spice-devel@lists.freedesktop.org">Spice-devel@lists.freedesktop.org</a><br>
&gt;                 &gt;         &gt;         &gt;<br>
&gt;                 &gt;<br>
&gt;                 <a href="http://lists.freedesktop.org/mailman/listinfo/spice-devel" target="_blank">http://lists.freedesktop.org/mailman/listinfo/spice-devel</a><br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;         --<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;         David Jaša, RHCE<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;         SPICE QE based in Brno<br>
&gt;                 &gt;         &gt;         GPG Key:     22C33E24<br>
&gt;                 &gt;         &gt;         Fingerprint: 513A 060B D1B4 2A72<br>
&gt;                 7F0D 0278 B125 CD00<br>
&gt;                 &gt;         22C3 3E24<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;<br>
&gt;                 &gt;         &gt;<br>
&gt;                 _______________________________________________<br>
&gt;                 &gt;         &gt; Spice-devel mailing list<br>
&gt;                 &gt;         &gt; <a href="mailto:Spice-devel@lists.freedesktop.org">Spice-devel@lists.freedesktop.org</a><br>
&gt;                 &gt;         &gt;<br>
&gt;                 <a href="http://lists.freedesktop.org/mailman/listinfo/spice-devel" target="_blank">http://lists.freedesktop.org/mailman/listinfo/spice-devel</a><br>
&gt;                 &gt;<br>
&gt;                 &gt;         --<br>
&gt;                 &gt;<br>
&gt;                 &gt;         David Jaša, RHCE<br>
&gt;                 &gt;<br>
&gt;                 &gt;         SPICE QE based in Brno<br>
&gt;                 &gt;         GPG Key:     22C33E24<br>
&gt;                 &gt;         Fingerprint: 513A 060B D1B4 2A72 7F0D 0278<br>
&gt;                 B125 CD00 22C3 3E24<br>
&gt;                 &gt;<br>
&gt;                 &gt;<br>
&gt;                 &gt;<br>
&gt;                 &gt;<br>
&gt;                 &gt;<br>
&gt;                 &gt;<br>
&gt;                 &gt; _______________________________________________<br>
&gt;                 &gt; Spice-devel mailing list<br>
&gt;                 &gt; <a href="mailto:Spice-devel@lists.freedesktop.org">Spice-devel@lists.freedesktop.org</a><br>
&gt;                 &gt;<br>
&gt;                 <a href="http://lists.freedesktop.org/mailman/listinfo/spice-devel" target="_blank">http://lists.freedesktop.org/mailman/listinfo/spice-devel</a><br>
&gt;<br>
&gt;                 --<br>
&gt;<br>
&gt;                 David Jaša, RHCE<br>
&gt;<br>
&gt;                 SPICE QE based in Brno<br>
&gt;                 GPG Key:     22C33E24<br>
&gt;                 Fingerprint: 513A 060B D1B4 2A72 7F0D 0278 B125 CD00<br>
&gt;                 22C3 3E24<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; _______________________________________________<br>
&gt; Spice-devel mailing list<br>
&gt; <a href="mailto:Spice-devel@lists.freedesktop.org">Spice-devel@lists.freedesktop.org</a><br>
&gt; <a href="http://lists.freedesktop.org/mailman/listinfo/spice-devel" target="_blank">http://lists.freedesktop.org/mailman/listinfo/spice-devel</a><br>
<br>
--<br>
<br>
David Jaša, RHCE<br>
<br>
SPICE QE based in Brno<br>
GPG Key:     22C33E24<br>
Fingerprint: 513A 060B D1B4 2A72 7F0D 0278 B125 CD00 22C3 3E24<br>
<br>
<br>
<br>
</div></div></blockquote></div><br>