How to fallback from TLS to SSLV3?

2007-08-28 Thread ravi shankar
Hi, We have a SSL client and we are having issues while connecting to some oracle application servers which does not support TLS. By default, our client tries TLS and the server sends an alert message for the client hello instead of sending server hello. If we disable TLS and use SSLV3, the

Re: SSL_peek vs. SSL_pending...

2007-08-28 Thread Steffen DETTMER
Hi, this is an interesting topic. I hope it is OK to bother again even if off-topic. * Yves Rutschle wrote on Mon, Aug 27, 2007 at 16:10 +0200: On Sat, Aug 25, 2007 at 12:47:57AM -0700, David Schwartz wrote: Yes? If so, the above paragraph or something similar should be documented

Re: SSL_peek vs. SSL_pending...

2007-08-28 Thread Darryl Miles
Steffen DETTMER wrote: this is an interesting topic. I hope it is OK to bother again even if off-topic. This topic has been covered before on this list. I do not share David's beliefs on this matter, the select() readability and writability indicators are indeed sticky. That is they never

Re: SSL_peek vs. SSL_pending...

2007-08-28 Thread Marek Marcola
Hello, Steffen DETTMER wrote: this is an interesting topic. I hope it is OK to bother again even if off-topic. This topic has been covered before on this list. I do not share David's beliefs on this matter, the select() readability and writability indicators are indeed sticky. +1

Re: How to fallback from TLS to SSLV3?

2007-08-28 Thread ravi shankar
Hi Lutz, Yes. We use sslv23_method with SSL_OP_NO_SSLv2 in SSL_CTX_set_options. In this case, how do I specify that both SSLv3 and TLSv1 are valid in my client hello? Is it specified in the cipher list? I use the cipher setting as DEFAULT:@STRENGTH. Thanks, Ravi. On 8/28/07, Lutz Jaenicke

Re: How to fallback from TLS to SSLV3?

2007-08-28 Thread Lutz Jaenicke
ravi shankar wrote: We have a SSL client and we are having issues while connecting to some oracle application servers which does not support TLS. By default, our client tries TLS and the server sends an alert message for the client hello instead of sending server hello. If we disable TLS and

How to fallback from TLS to SSLV3?

2007-08-28 Thread ravi shankar
Hi, We have a SSL client and we are having issues while connecting to some oracle application servers which does not support TLS. By default, our client tries TLS and the server sends an alert message for the client hello instead of sending server hello. If we disable TLS and use SSLV3, the

Re: How to fallback from TLS to SSLV3?

2007-08-28 Thread Richard Koenning
ravi shankar wrote: We have a SSL client and we are having issues while connecting to some oracle application servers which does not support TLS. By default, our client tries TLS and the server sends an alert message for the client hello instead of sending server hello. If we disable TLS and

Re: How to fallback from TLS to SSLV3?

2007-08-28 Thread ravi shankar
To give more information on the issue, this is the code which we use . meth = SSLv23_method(); newRegID = SSL_CTX_new(meth) SSL_CTX_set_options(newRegID, SSL_OP_NO_SSLv2); My understanding was that the above code should tell that both SSLV3 and TLSV1 are supported and server

Re: How to fallback from TLS to SSLV3?

2007-08-28 Thread Dr. Stephen Henson
On Tue, Aug 28, 2007, ravi shankar wrote: Hi Lutz, Yes. We use sslv23_method with SSL_OP_NO_SSLv2 in SSL_CTX_set_options. In this case, how do I specify that both SSLv3 and TLSv1 are valid in my client hello? Is it specified in the cipher list? I use the cipher setting as

Re: SSL_peek vs. SSL_pending...

2007-08-28 Thread Thomas J. Hruska
Darryl Miles wrote: Steffen DETTMER wrote: this is an interesting topic. I hope it is OK to bother again even if off-topic. This topic has been covered before on this list. I do not share David's beliefs on this matter, the select() readability and writability indicators are indeed sticky.

RE: SSL_peek vs. SSL_pending...

2007-08-28 Thread David Schwartz
This topic has been covered before on this list. I do not share David's beliefs on this matter, the select() readability and writability indicators are indeed sticky. That is they never disappear unless the application permits them too. That is not only not implemented by any known

RE: SSL_peek vs. SSL_pending...

2007-08-28 Thread David Schwartz
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Steffen DETTMER Sent: Tuesday, August 28, 2007 2:11 AM To: openssl-users@openssl.org Subject: Re: SSL_peek vs. SSL_pending... I think it is important to note that a blocking read usually should

Re: SSL_peek vs. SSL_pending...

2007-08-28 Thread Darryl Miles
David Schwartz wrote: That is not only not implemented by any known implementation but quite literally impossible. Please tell me what implementation guarantees that a TCP 'write' after a 'select' hit for writability will not block. This is no use, your asking me for references and I'm asking

RE: SSL_peek vs. SSL_pending...

2007-08-28 Thread David Schwartz
David Schwartz wrote: That is not only not implemented by any known implementation but quite literally impossible. Please tell me what implementation guarantees that a TCP 'write' after a 'select' hit for writability will not block. This is no use, your asking me for references and I'm

how to avoid No client certificate CA names sent with s_server?

2007-08-28 Thread Ralf Hauser
Hi, both with openssl, I am trying to have a server and client that perform client certificate authentication. So, I start the server as follows: openssl s_server -www -key /dir/server-key.pem -cert /dir/server-cert.pem -CAfile /dir/cacert.pem -state and as per the previous posts on the