Technical troubleshooting

+ [1] iVEST™ Client / iVEST™ Biz Client
+ [2] iVEST™ Card Reader and Driver
- [3] Error prompted by Web Browser


+ [4] iVESTmail
+ [5] iVEST File 3.1

 

[3.1] ERROR/SYMPTOM: "Sorry, access denied. You need and iVEST card to login" appears when attempting to access iVEST smart card testing page and other iVESTed websites

CAUSE: Certificate in smart card has expired
SOLUTION: Renew certificate in smart card. Please refer to renewal process

[3.2] ERROR/SYMPTOM: "You are not authorised to view this page" appears when attempting to access iVEST smart card testing page and other iVESTed websites

CAUSE1: Certificate in card has expired
SOLUTION: Renew certificate in card

CAUSE2: Browser not configured
SOLUTION: Configure browser

[3.3] ERROR/SYMPTOM: "New site certificate. Click next, next, next, next and finish. No user certificate. Security Info. Sorry, you are not authorised to perform this operation" appears when attempting to access iVEST smart card testing page and other iVESTed websites

CAUSE: Certificate in card has expired
SOLUTION: Renew certificate in card

[3.4] ERROR/SYMPTOM: "New site cert. Click next, next, next, next & Finish. No user certificate. Security info. Click “Continue”. “Page cannot be displayed" appears while accessing iVEST smart card testing page and iVESTed websites
Browser: IE

CAUSE: Your IE has not been set properly
SOLUTION: Ensure to set your IE setting

Attachment: Installation Guide

[3.5] ERROR/SYMPTOM: "Page cannot be displayed" pops up after keying iVEST PIN at iVESTed websites

CAUSE1: Something is blocking the transaction
SOLUTION1-1:

Troubleshooting Tips
If you are using external proxy server, ensure the proxy server is a pass-through type proxy server. To determine your proxy server is a pass-through type:

  • Remove iProxy settings at browser (localhost and 5003) Remove the external proxy setting at iProxy setting Close and relaunch browser Go to http://www.ivest.com.my/smcardtesting to test your connection Click on the iVEST logo For Netscape, if the message, "No User Certificate. Forbidden” pops up, then your network configuration allows and supports SSL connection with user certificate. Hence, iVEST can be used in your LAN connection. For IE, if the message, ‘Client Authentication: Identification. The web site you want to view requests identification. Select the certificate to use when connecting. Click [More info] or [OK]" pops up, then your network configuration allows and supports SSL connection with user certificate. Hence iVEST can be used in your LAN connection.
  • If you do NOT see any of the above, your network does NOT support SSL connection with user certificate. You may use Dial Up or ADSL connection or refer to your System Administrator on how to allow your connection to go through iProxy.

Note: Microsoft Proxy Server 2.0 and Microsoft Internet Security and Acceleration (ISA) Server 2000 are not a pass-through type proxy server. They can only act as a pass thru type if the NT Challenge Response is set to OFF. Besides that, in order to use the two servers, Microsoft Proxy Client must be installed in each Client machine and do not have to set the external proxy server at iProxy.

SOLUTION1-2 :

  • Right click iProxy icon. Select " Connection Viewer "
  • Under the Sites column, look for the site that you are trying to access. State the connection status for the sites that you fail to access (e.g, done, connecting, handshake fail).

Analysis :

“Page cannot be displayed” with iProxy connection status as “done” : Refer to the application service provider if your smart card testing also fails “Page cannot be displayed” with iProxy connection status as “connecting”, (endlessly) : Refer to the organisations' system administrator if your smart card testing also fails

“Page cannot be displayed” with iProxy connection status as “handshake fail” : Refer to the application service provider if your smart card testing also fails

SOLUTION1-3:

  • Launch IE. Go to Tools/Internet Options/Advanced and select "Restore defaults".
  • Close and re-launch IE and re-try smart card testing

CAUSE2: You do not have the permission to access the system/site, due to:

  • You have yet to register to access the system You have just received your new smart card and have yet to re-register (some system requires users to re-register. Eg: Mimosnet)
  • Your certificate has expired

SOLUTION:

  • Ensure you have permission to access the system
  • Ensure your smart card is valid

CAUSE3: Your Firewall does not allow SSL connection (access sites with https://)
SOLUTION:

  • Determine the sites that you fail to establish SSL connection.
  • Ensure that system administrator open up port 443 and ensure that your browser is not blocked from accessing the required sites.

[3.6] ERROR/SYMPTOM: Client Authentication: Identification,” The web site you want to view requests identification. Select the certificate to use when connecting. ……” appears when accessing iVESTed websites
• If you select the first certificate (normally this certificate is Non-repudiation certificate), iVEST CSP PIN request box will pop up. “Page cannot be displayed” will appear after you key in the PIN.
• If you select the second certificate (normally this certificate is Authentication certificate), the transaction is successful but you might get a frequent request for PIN
Product: Client 3.0

CAUSE: That is the default message that you would receive if you attempt to access a secure site via iVEST CSP instead iProxy.

SOLUTION:

  • You are not encouraged to access using CSP for security reasons. To access using iProxy, configure the browser security accordingly
  • If you have to access using CSP for a certain reason, ensure to select Authentication certificate for verification purposes and select Non-Repudiation certificate for signing purposes.

Attachment: BrowserSetting.pdf

Troubleshooting Tips
Double confirm on the certificate to choose by viewing the certificate first:

  • On the “Client Authentication” screen, highlight your name and click “View Certificate”
  • Tab to “Certification Path”
  • It will state whether that certificate is Authentication or Non-repudiation

[3.7] ERROR/SYMPTOM: "You are not authorised to view this page. HTTP 403 (forbidden)"

Refer solution in 3.8

[3.8] ERROR/SYMPTOM: “The page requires a valid client certificate. HTTP 403.17 – Forbidden: Client certificate has expired or is not yet valid"

CAUSE: You do not have the permission to access the system/site, due to:

  • You have yet to register to access the system
  • You have just received your new smart card and have yet to re-register (some system requires users to re-register. Eg: Mimosnet)
  • Your certificate has expired

SOLUTION:

  • Ensure you have permission to access the system
  • Ensure your smart card is valid

[3.9] ERROR/SYMPTOM: "The page require a Client Certificate"

CAUSE: Your IE has not been set properly
SOLUTION: Ensure to set your IE setting

Attachment: Installation Guide

[3.10] ERROR/SYMPTOM: Security Information, “This page contains both secure and nonsecure items. Do you want to display the nonsecure items?
• Select ‘NO”, “Navigation cancelled” will appear
• Select “YES”, it should allow you to access the system

CAUSE: Why this “Security Information” prompted is due to the application is calling a page (e.g, that contains GUIs) from http:// and not https://. When a server certificate is applied to a domain name, the entire site is secured via SSL.

SOLUTION: Click “YES” to continue

Solution at application level by application developers:
If you insist to eliminate the security information message, remove any reference to http:// pages from your application, else user have to click “YES” every time the screen appears

[3.11] ERROR/SYMPTOM: “The page must be viewed with a high-security web browser” HTTP 403.5 – Forbidden: SSL 128 required
Browser: IE

CAUSE: Your IE Cipher strength does not comply with the application security level which is 128-bit
SOLUTION: Please upgrade your IE to 128-bit cipher strength

[3.12] ERROR/SYMPTOM : "Your Certificate is invalid and/or CRL not found" when accessing iVESTed websites

CAUSE: If access with all types of certificates shows similar result, the LDAP server at DIGICERT is not available and fail to retrieve CRL.

SOLUTION: Report to support@ivest.com.my and try again later

[3.13] ERROR/SYMPTOM: “Program not Found” pops up when you want to start iVEST™ Client for the first time
Browser: Netscape

CAUSE: Netscape is set as the default browser but it is not installed on the machine
SOLUTION: Either you install Netscape or you set IE as the default browser.

  • Launch IE 5.0
  • Go to Tools > Internet Options > Programs . Select Internet Explorer should check to see whether it is the default browser
  • Close and restart IE.
  • Click YES to IE as the default browser

[3.14] ERROR/SYMPTOM: Unable to set the browser security at Proxy Setting menu
Browser: IE

CAUSE: You have set the IE to use the same proxy for all protocols
SOLUTION: Reset the setting

  • Launch IE
  • Go to Tools > Internet Options > Connections > LAN settings or Tools > Internet Options > Connections > DialUp Settings and tick the Use a proxy server box
  • Click Advance button
  • Uncheck the use the same proxy server for all protocols box

[3.15] ERROR/SYMPTOM: Fail to connect to secure sites (https), with or without iProxy
Browser: IE6.0

CAUSE: Your IE setting is not in place
SOLUTION1: Launch IE. Ensure the browser setting is in placed
SOLUTION2: Go to Tools/Internet Options/Advanced and select "Restore defaults". Close and re-launch IE

[3.16] ERROR/SYMPTOM: Security Alert: Information you exchange with this site cannot be viewed or changed by others ……..
Browser: IE 5.0 and above

CAUSE: This alert or message is prompted by IE. A certificate is a statement that verifies the identity of a person or the security of a Web site. When you visit a secure Web site (https), the site automatically sends you its certificate. In this case, the browser finds out that the web site certificate has expired hence is alerting you on the risk

SOLUTION: Click “YES” to continue

[3.17] ERROR/SYMPTOM: "Error Code: -12227" when accessing iVESTed websites
Product: Client 3.0; Browser: IE6 and above

Refer solution in 3.18

[3.18] ERROR/SYMPTOM: "[website] has received an incorrect or unexpected message. Error Code: -12227"
Product : Client 3.0; Browser: Netscape 6 and above

CAUSE: Server does not detect the personal certificate. Server is expecting client side authentication or iVEST Gate is unable to read the smart card

SOLUTION: Ensure the smart card is functioning and use the web browser supported by iVEST Client

 
Copyright© 2008. All rights reserved, MIMOS BERHAD.