Received certificate error message when returning to redirect URI in DocuSign API

Question

I am trying to test DocuSign eSignature API using Oracle Application Express. I am getting an Oracle error: ORA-29273: HTTP request failed ORA-06512: at "SYS.UTL_HTTP", line 1130 ORA-29024: Certificate validation failure

I had the Oracle DBA install 3 DocuSign certificates to Oracle Wallet based on developer environment endpoints for authentication and REST API based on what I found Tfrom the following DocuSign’s webpage:

https://developers.docusign.com/docs/esign-rest-api/how-to/ :

https://account-d.docusign.com (This redirects to https://appdemo.docusign.com/home as well so I included this as well https://demo.docusign.net/

But I get the error when returning to my application (Redirect URI).

Please provide the specific certificates or the full URL so I can download the certificates myself.

Robert

Answer 1

The usual issue is that you haven't added the root certificate to your document store. For DocuSign, that's the DigiCert Root cert. See the DocuSign cert list

Added

Root certs refer to themselves in the Issuer section. For DocuSign, it's this DigiCert cert: https://www.docusign.com/sites/default/files/digicerthighassuranceevrootca_2.crt

You can check that you have the right cert by dumping it in text format, see below.

Here is the important part of the text dump, showing that the cert is the root cert (it references itself):

Certificate:
    Data:
        ...
        Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, 
                CN = DigiCert High Assurance EV Root CA
        Subject: C = US, O = DigiCert Inc, OU = www.digicert.com, 
                 CN = DigiCert High Assurance EV Root CA

The complete cert dump

$ openssl x509 -in ~/Downloads/digicerthighassuranceevrootca_2.crt -text -noout -inform der
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
        Validity
            Not Before: Nov 10 00:00:00 2006 GMT
            Not After : Nov 10 00:00:00 2031 GMT
        Subject: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c6:cc:e5:73:e6:fb:d4:bb:e5:2d:2d:32:a6:df:
                    e5:81:3f:c9:cd:25:49:b6:71:2a:c3:d5:94:34:67:
                    a2:0a:1c:b0:5f:69:a6:40:b1:c4:b7:b2:8f:d0:98:
                    a4:a9:41:59:3a:d3:dc:94:d6:3c:db:74:38:a4:4a:
                    cc:4d:25:82:f7:4a:a5:53:12:38:ee:f3:49:6d:71:
                    91:7e:63:b6:ab:a6:5f:c3:a4:84:f8:4f:62:51:be:
                    f8:c5:ec:db:38:92:e3:06:e5:08:91:0c:c4:28:41:
                    55:fb:cb:5a:89:15:7e:71:e8:35:bf:4d:72:09:3d:
                    be:3a:38:50:5b:77:31:1b:8d:b3:c7:24:45:9a:a7:
                    ac:6d:00:14:5a:04:b7:ba:13:eb:51:0a:98:41:41:
                    22:4e:65:61:87:81:41:50:a6:79:5c:89:de:19:4a:
                    57:d5:2e:e6:5d:1c:53:2c:7e:98:cd:1a:06:16:a4:
                    68:73:d0:34:04:13:5c:a1:71:d3:5a:7c:55:db:5e:
                    64:e1:37:87:30:56:04:e5:11:b4:29:80:12:f1:79:
                    39:88:a2:02:11:7c:27:66:b7:88:b7:78:f2:ca:0a:
                    a8:38:ab:0a:64:c2:bf:66:5d:95:84:c1:a1:25:1e:
                    87:5d:1a:50:0b:20:12:cc:41:bb:6e:0b:51:38:b8:
                    4b:cb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                B1:3E:C3:69:03:F8:BF:47:01:D4:98:26:1A:08:02:EF:63:64:2B:C3
            X509v3 Authority Key Identifier: 
                keyid:B1:3E:C3:69:03:F8:BF:47:01:D4:98:26:1A:08:02:EF:63:64:2B:C3

    Signature Algorithm: sha1WithRSAEncryption
         1c:1a:06:97:dc:d7:9c:9f:3c:88:66:06:08:57:21:db:21:47:
         f8:2a:67:aa:bf:18:32:76:40:10:57:c1:8a:f3:7a:d9:11:65:
         8e:35:fa:9e:fc:45:b5:9e:d9:4c:31:4b:b8:91:e8:43:2c:8e:
         b3:78:ce:db:e3:53:79:71:d6:e5:21:94:01:da:55:87:9a:24:
         64:f6:8a:66:cc:de:9c:37:cd:a8:34:b1:69:9b:23:c8:9e:78:
         22:2b:70:43:e3:55:47:31:61:19:ef:58:c5:85:2f:4e:30:f6:
         a0:31:16:23:c8:e7:e2:65:16:33:cb:bf:1a:1b:a0:3d:f8:ca:
         5e:8b:31:8b:60:08:89:2d:0c:06:5c:52:b7:c4:f9:0a:98:d1:
         15:5f:9f:12:be:7c:36:63:38:bd:44:a4:7f:e4:26:2b:0a:c4:
         97:69:0d:e9:8c:e2:c0:10:57:b8:c8:76:12:91:55:f2:48:69:
         d8:bc:2a:02:5b:0f:44:d4:20:31:db:f4:ba:70:26:5d:90:60:
         9e:bc:4b:17:09:2f:b4:cb:1e:43:68:c9:07:27:c1:d2:5c:f7:
         ea:21:b9:68:12:9c:3c:9c:bf:9e:fc:80:5c:9b:63:cd:ec:47:
         aa:25:27:67:a0:37:f3:00:82:7d:54:d7:a9:f8:e9:2e:13:a3:
         77:e8:1f:4a

Added some more

You're still receiving a TLS-level Certificate validation failure from your framework... Some suggested next steps:

Inspect the actual TLS protocol between the client (your app) and the server (DocuSign). Do this by capturing a trace file and reading it with WireShark. The WireShark wiki includes instructions on how to obtain traces.

It could be a different type of cert issue such as supported ciphers not matching.

It could also be some level of misconfiguration. For example, is your app framework using TLS 1.2? DocuSign does not support TLS 1.0 (or 1.3). And TLS 1.1 is on the way out.

One common issue is that many frameworks don't provide good specifics when there is a problem at the TLS level.

If you're still stuck, open a support ticket with DocuSign's developer support group. (But their first request to you, given your investigation so far, will be to request a TLS-level trace.)