JAVASERVER:
+ uses IAIK & Sun's implementation of SSL in Java
+ ciphersuite = "SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"
+ mutual authentication disabled
CCLIENT:
+ uses OpenSSL implementation of SSL in C
+ ciphersuite = SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA
+ verify all peers [trust is blind!]
Here is the stdout trace on the client side:
=
before/connect initialization
SSLv3 write client hello A
SSLv3 read server hello A
SSLv3 read server certificate A
SSL alert write:fatal
error in SSLv3 read server key exchange B
There is one difference between the C client and the Java client that
correctly speaks to the server; the former is NOT configured with
certificates, private-public key pairs, and CAs while the latter is.
QUESTION0:
Is there a cipher suite for OpenSSL TLSv1 [SSLv3.1] that permits anonymous
sessions?
QUESTION1:
What must I do to configure the C client correctly?
QUESTION2:
Is there a flag I can add to openssl\ms\ntdll.mak that will add debugging
information so when I run the client in the VC++ debugger, I can step into
the SSL library? My 1st attempt at this returned 'no matching symbolic
information found'.
Thanks,
Bishr
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
