voms-proxy-init2 returns bad error message for expired AUP / certificate

[maarten-litmaath]

voms-proxy-init2 returns a bad error message for an expired AUP, which is handled OK by voms-proxy-init3.
Demo:

$ voms-proxy-init2 -voms alice [...]
Your identity: [...]
Creating temporary proxy [...] Done
Contacting  voms-alice-auth.cern.ch:443 [/DC=ch/DC=cern/OU=computers/CN=alice-auth.cern.ch] "alice" Failed

Error: Server Answer was incorrectly formatted.

[...]

Compare with the Java client:

$ voms-proxy-init3 -voms alice [...]
Contacting voms-alice-auth.cern.ch:443 [/DC=ch/DC=cern/OU=computers/CN=alice-auth.cern.ch] "alice"...
Remote VOMS server contacted succesfully.

VOMS server voms-alice-auth.cern.ch:443 returned the following errors:
User user.NNNN needs to sign AUP for this organization in order to proceed.

[...]

[belforte]

here's another user case where version 2.1.2 returns Error: Server Answer was incorrectly formatted. In this case an expired usercert:

belforte@lxplus805/.globus> voms-proxy-init --version
voms-proxy-init
Version: 2.1.2
Compiled: Mar 28 2025 05:56:16
belforte@lxplus805/.globus> voms-proxy-init -voms cms --cert ./terenacert.pem --key ./terenakey.pem 
Enter GRID pass phrase:
Your identity: NNN
Creating temporary proxy ............................................... Done
Contacting  voms-cms-auth.cern.ch:443 [/DC=ch/DC=cern/OU=computers/CN=cms-auth.cern.ch] "cms" Failed

Error: Server Answer was incorrectly formatted.

None of the contacted servers for cms were capable
of returning a valid AC for the user.
belforte@lxplus805/.globus> 

while with Java version

belforte@crab-dev-tw01/.globus> voms-proxy-init --version
voms-proxy-init v. 3.3.6 (voms-api-java/3.3.6 canl/2.8.3 bcprov/1.70.0 bcpkix/1.70.00.0)
belforte@crab-dev-tw01/.globus> voms-proxy-init -voms cms --cert ./terenacert.pem --key ./terenakey.pem 
Enter GRID pass phrase for this identity:
Certificate validation error: Certificate has expired on: Fri Apr 18 00:00:09 CEST 2025
Certificate validation error: CRL for an expired certificate was not resolved Cause: No CRLs found for issuer "cn=GEANT TCS Authentication RSA CA 4B,o=GEANT Vereniging,c=NL"
User credential is not valid!
belforte@crab-dev-tw01/.globus> 

[msalle]

Could this be related with the removal (effectively) of the error handling from OpenSSL 3.0? See issue #110

[belforte]

all I can say is that is started when we moved from old VOMS to IAM. Somehow IAM sends messages that the client does not know how to handle.

[msalle]

Ah that sounds like a different issue altogether. So my openssl remark is probably a red herring