On Monday 16 November 2009 12:29:31 am Tomas Mraz via RT wrote: > fails to get server hello message from the server. It's apparent that > the server is somehow broken but > gnutls-cli --protocols TLS1.0 --port 5223 dragonsdawn.net > gives a very similar client hello and it receives server hello fine. > > The only way to get established ssl handshake openssl s_client is to use > the -ssl3 option. In some cases such as:
This is the same situation in 0.9.8-stable branch, too. The only way to connect to the server is -ssl3 option. With -tls1, openssl cannot get hello message from the server. There is more than that. Here are my tests with 0.9.8-stable branch (today's checkout). == 0.9.8-stable cvs with apache 2.2.14 (self-signed cert, localhost) == [~]> openssl s_client -host localhost -port 443 CONNECTED(00000003) 4377:error:140920DF:SSL routines:SSL3_GET_SERVER_HELLO:parse tlsext:s3_clnt.c:869: However, when I pass -tls1 option, localhost just works fine.. Also, renegotiation is done. If I'm not wrong, 0.9.8-stable branch contains TLS extension for renegotiation issue. [~]> openssl s_client -host localhost -port 443 -tls1 CONNECTED(00000003) depth=0 /C=TR/ST=Turkey/L=Istanbul/O=localhost/CN=localhost/emailaddress=e...@localhost verify error:num=18:self signed certificate (...) I think, there are some problems with s_client, rather than implementation. As seen from this, -tls1 option works fine with newer openssl on both client and server. == 0.9.8-stable cvs with old(?) servers == [~]> openssl s_client -host twitter.com -port 443 -tls1 CONNECTED(00000003) 4385:error:140920DF:SSL routines:SSL3_GET_SERVER_HELLO:parse tlsext:s3_clnt.c:869: However, -ssl3 works fine with old servers. Additionally, it renegotiates well.. [~]> openssl s_client -host twitter.com -port 443 -ssl3 CONNECTED(00000003) depth=0 /C=US/O=twitter.com/OU=GT09721236/OU=See www.rapidssl.com/resources/cps (c)09/OU=Domain Control Validated - RapidSSL(R)/CN=twitter.com verify error:num=20:unable to get local issuer certificate (...) It seems that neither 1.0.0, nor 0.9.8-stable is stable enough due to the renegotiation issue. For this reason, I disabled all renegotiation in our openssl package. I'm looking forward to hearing suggestions from openssl team. Regards, Eren ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
