After a bit more investigation, I found that I could start up s_server and
the Netscape client could negotiate a common cipher, but with Apache built
with the exact same openssl installation it could not.
For example, running s_server with : s_server -accept 81 -debug -state
When I connect to https://servername:81 I get (on the server side)
(edited for important messages)
SSL_accept:before/accept initialization
SSL_accept:SSLv3 read client hello A
SSL_accept:SSLv3 write server hello A
SSL_accept:SSLv3 write certificate A
SSL_accept:SSLv3 write server done A
SSL_accept:SSLv3 flush data
SSL_accept:SSLv3 read client key exchange A
SSL_accept:SSLv3 read finished A
SSL_accept:SSLv3 write change cipher spec A
SSL_accept:SSLv3 write finished A
SSL_accept:SSLv3 flush data
-----BEGIN SSL SESSION PARAMETERS-----
MHUCAQECAgMABAIAAwQgwE/vjbeasTMGk4G04hyXD5/5L7R8U+dnMRl8oyz9ekUE
MBnIH9FHNvEftV804jp3z6XqEGgUZi5Pz4cVerwmyfiQdmFLG2g0Xuz18son7/Y5
naEGAgQ3Z7WOogQCAgEspAYEBAEAAAA=
-----END SSL SESSION PARAMETERS-----
Shared ciphers:EXP-RC4-MD5:EXP-RC2-CBC-MD5
CIPHER is EXP-RC4-MD5
Which works fine.
When I use s_client to connect to the apache server enforcing this sasme
cipher I get (and I'll give it all)
OpenSSL> s_client -connect localhost:443 -debug -state -cipher EXP-RC4-MD5
CONNECTED(00000003)
SSL_connect:before/connect initialization
write to 40038200 [14003AAC0] (52 bytes => 52 (0x34))
0000 - 80 32 01 03 01 00 09 00-00 00 20 00 00 03 08 00 .2........ .....
0010 - 80 02 00 80 bb c5 92 a8-e2 49 8e ce c0 23 f4 e0 .........I...#..
0020 - d5 5b f0 fa 5f c5 c3 e5-a3 7f 3f b5 2f 09 65 66 .[.._.....?./.ef
0030 - a3 f0 cf 53 ...S
SSL_connect:SSLv2/v3 write client hello A
read from 40038200 [140040020] (7 bytes => 7 (0x7))
0000 - 15 03 01 00 02 02 28 ......(
SSL3 alert read:fatal:handshake failure
SSL_connect:error in SSLv2/v3 read server hello A
21116:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert
handshake failure:s23_clnt.c:445:
Any ideas?
Jeff
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
