Self Signed certificates

[atoch]

Hello Eviews support and Eviews experts,

Our network security does deep packet inspection and because of that the WFopen command fails because the certificate using for our security uses a self signed certificate.

wfopen(type=txt) https://sdmx.oecd.org/public/rest/data/ ... at=csvfile custom=","

See attached screen capture for Eviews error.

Error screenshot

eviews wfopen.png (31.26 KiB) Viewed 395 times

When bypassing our security appliance, the same wfopen command works.

Could you please provide a way to specify a location for self-signed certificates or have eviews honor the windows certificate stores ?

Merci

Arnaud Atoch

[EViews Steve]

I'll create a new command to ignore all ssl certificate errors during that instance of EViews. This fix will be put into EViews 13 only.

Steve

[EViews Steve]

New undocumented commands have been created:

Code: Select all

IGNORECERTERROR
RESTORECERTERROR

IgnoreCertError tells EViews to ignore any SSL certificate errors encountered when getting data over the internet. This setting will remain on until EViews is restarted or the RESTORECERTERROR cmd is called.

RestoreCertError turns off the ignore and restores default processing of all SSL certificate errors.

I've also added code to make these SSL cert errors appear with better descriptions when they happen.

These changes will be released in the next EViews 13 patch, most likely early next week.

Steve

[atoch]

Thank you for your quick reaction. We'll test as soon as we can get our hands on the updated version of Eviews 13.
Can I ask why you choose to ignore SSL errors rather than adding a command to had a path to additional certificates which seems a more secure approach ?

[EViews Steve]

Simplicity.

And in fact, even if you have a self-signed certificate authorized in your local Windows store, it's Common Name will most likely not match the host name in your URL due to how your security appliance works (I'm guessing) -- so allowing the self-signed cert to be accepted still requires EViews to lower security. As a quick test, after the next patch, try your WFOPEN command again without calling the new Ignore cmd to see what error message you get.

As a precautionary measure, this new setting will not be the default. You'll have to call it whenever you restart EViews.