Re: [openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-08-11 Thread Jakob Bohm
On 10/08/2015 20:12, Salz, Rich wrote: Specifically, a number of decisions have the feel of a project that has been co-opted or taken over by someone eager to make sweeping changes for little apparent reason, someone with lots of idle lawyers on hand, like Microsoft, various corporate partners,

Re: [openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-08-10 Thread Salz, Rich
Specifically, a number of decisions have the feel of a project that has been co-opted or taken over by someone eager to make sweeping changes for little apparent reason, someone with lots of idle lawyers on hand, like Microsoft, various corporate partners, the CII, and/or the SFLC (using a

Re: [openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-08-10 Thread Jakob Bohm
On 01/08/2015 08:00, Viktor Dukhovni wrote: The Windows 2003 TLS stack became unsupported for most (but /not all/) users less than 20 days ago. Treating it as marginal and not as something that any core networking library needs to be compatible (even *tested* with) out of the box is another

Re: [openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-08-01 Thread Viktor Dukhovni
On Sat, Aug 01, 2015 at 06:56:16AM +0200, Jakob Bohm wrote: Or configure a cipherlist more compatible with a long obsolete and no longer supported Windows 2003 TLS stack. Note, I am suggesting compatibility. Yes while the obsolescence is long-standing, I was aware that the support status

Re: [openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-08-01 Thread Viktor Dukhovni
On Sat, Aug 01, 2015 at 04:23:54PM +0200, Kurt Roeckx wrote: The old team would have gone out of their way to make sure the standard OpenSSL code would generate backward compatible hello records by default So it's my understanding that you suggest the default OpenSSL client should: -

Re: [openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-08-01 Thread Kurt Roeckx
On Sat, Aug 01, 2015 at 06:56:16AM +0200, Jakob Bohm wrote: The old team would have gone out of their way to make sure the standard OpenSSL code would generate backward compatible hello records by default So it's my understanding that you suggest the default OpenSSL client should: - Only

Re: [openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-07-31 Thread Jakob Bohm
On 31-07-2015 23:06, Viktor Dukhovni wrote: On Fri, Jul 31, 2015 at 08:47:45PM +, Felix Almeida wrote: I've tested other OpenSSL versions and everything goes well up to version 1.0.1o, starting from 1.0.2 I see this handshake error. It seems you're posting follow-ups without checking

[openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-07-31 Thread Felix Almeida
Hello, I was trying to establish a secure connection from an old Linux box to an internal AD server (via LDAPS) but it was failing during the handshake. The AD server accepts SSL2, SSL3 and TLS1. See below the output: $ openssl s_client -connect myserver.rogers.com:636 -CAfile

Re: [openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-07-31 Thread Viktor Dukhovni
On Fri, Jul 31, 2015 at 06:43:18PM +, Felix Almeida wrote: I was trying to establish a secure connection from an old Linux box to an internal AD server (via LDAPS) but it was failing during the handshake. The AD server accepts SSL2, SSL3 and TLS1. Is it Windows server 2003? It likely

Re: [openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-07-31 Thread Felix Almeida
I've tested other OpenSSL versions and everything goes well up to version 1.0.1o, starting from 1.0.2 I see this handshake error. I also tried to disable TLS on 1.0.2d by passing no-tls to the config script, but this broke the building process (make stopped with an error). So I believe I will

Re: [openssl-users] [openssl-1.0.2d] default SSL handshake fails

2015-07-31 Thread Viktor Dukhovni
On Fri, Jul 31, 2015 at 08:47:45PM +, Felix Almeida wrote: I've tested other OpenSSL versions and everything goes well up to version 1.0.1o, starting from 1.0.2 I see this handshake error. It seems you're posting follow-ups without checking whether your original post was answered. I also