On Tue, Dec 17, 2013, Porter, Andrew wrote: > That server response (15 03 03 00 02 02 50) has byte 0 = SSL3_RT_ALERT and > byte 5 = SSL3_AL_FATAL so that means it hated the s_client TLS 1.2 > ClientHello, ja? >
Yes though the "internal error" alert suggests it might not be OpenSSL's fault. > > When I add -no_tls1 to the s_client command line so that it uses an SSL3 > ClientHello the connection succeeds. > [snip] > > I've run out of things to try. Since I can create the problem using the 1.0.1e > s_client I don't see any point in hacking about with our own code, surely > disabling TLS can't be the right thing to do... > Well try disabling just TLS 1.2 with -no_tls1_2. You could also try restricting the size of the ClientHello by (for example) cutting down the number of ciphers sent. Something like -cipher 'DEFAULT:!ECDH' for example. Steve, -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
