BASIC SERVICE ACCESS TESTS SECTION:

Service visibility

– NSLOOKUP

nslookup psis.catcert.net

nslookup psisbeta.catcert.net

– TELNET

· HTTP service (validation)

telnet psis.catcert.net 80

telnet psisbeta.catcert.net 80

· https service (mab SSL validation and signature)

telnet psis.catcert.net 443

telnet psisbeta.catcert.net 443

– WGET (or web browser), from the machine with the failing application, to access the URLs:

wget http://psis.catcert.net/psis/dss

wget http://psisbeta.catcert.net/psis/catcert-test/dss

The answer, in the case of both addresses, is [PSIS vX.XX] where the version number may vary.

The IPs displayed by the command in the “NSLOOKUP” section should correspond to the table. The primary service IP is the one that appears in the “ Primary ” column.

Table: PSIS service IP

Domain

Environment

Primary

Secondary school

psis.catcert.net

productive

217.111.232.27

213.229.186.54

psisbeta.catcert.net

pre-production

217.111.232.28

213.229.186.62

TECHNICAL RECOMMENDATIONS SECTION:

DNS cache prevention

– In the JVM: Enable cache refresh in the JVM by adding the following attribute to the JAVA_OPT:

Dnetworkaddress.cache.ttl=1200

Attribute detail: Specified in java.security to indicate the caching policy for successful name lookups from the name service.. The value is specified as integer to indicate the number of seconds to cache the successful lookup.

A value of -1 indicates "cache forever". The default behavior is to cache forever when a security manager is installed, and to cache for an implementation specific period of time, when a security manager is not installed.

– In the operating system: Delete the entries psis.catcert.net and psisbeta.catcert.net from the “/etc/hosts” file for Linux/Unix and “C:WindowsSystem32driversetchosts” for Windows systems.

– Application servers: If the configuration of the first point in this section is not active, it will be necessary to restart the services that run on Jboss, Tomcat, Glassfish, etc.

Preventing connectivity errors:

– Proxy Servers: Force refresh of proxy cache services.

– Review of firewall rules to enable access to the IPs of the box through ports 80 and 433