On 24/04/2012 20:19, Carmel wrote:
On Tue, 24 Apr 2012 19:46:40 +0100 plot.lost articulated:Having problems making TLS connections to an instance of apache. The server version is: Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/0.9.8t The ssl config includes: SSLProtocol TLSv1 SSLv3 SSLCipherSuite RC4-SHA:AES256-SHA:ALL:!ADH:!MD5:!EXP:!LOW:!NULL SSLHonorCipherOrder on # See http://journal.paul.querna.org/articles/2010/07/10/overclocking-mod_ssl/ SSLVerifyClient none #SSLInsecureRenegotiation on If I try and connect using Firefox with only TLS enabled, the connection fails (get the message 'The connection to the server was reset while the page was loading'). With SSLv3 enabled in Firefox, the connection works fine. Trying using openssl command line: openssl s_client -connect 127.0.0.1:443 -tls1 gets CONNECTED(00000003) 15265:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:284: When trying with openssl s_client -connect 127.0.0.1:443 -sslv3 the connection works New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : DHE-RSA-AES256-SHA Session-ID: F86A80F46AF9AD0626B1051223C184553FC25B92AF1763E6728CAEF984C4CB58 Session-ID-ctx: Master-Key: E0BE122F6671905DB5BBC40F874157F1A4625FC32A19AE1D67EC2255DC05DC7723A69A26A942E874C8CC219A28BB4936 Key-Arg : None Start Time: 1335292940 Timeout : 7200 (sec) Any clues as to why the TLS connection is not working - is there some config value I am missing or have wrong?What version of SSL are you using? There was a problem with the update of "openssl-1.0.1a" that caused problems with Postfix with certain domains. Try this for starters: openssl s_client -connect 127.0.0.1:443 -tls1_2 openssl s_client -connect 127.0.0.1:443 -tls1_1 openssl s_client -connect 127.0.0.1:443 -tls1 openssl s_client -connect 127.0.0.1:443 -ssl3 Post the connect or fail results back here.
Command line openssl version is: OpenSSL 0.9.8t 18 Jan 2012 (Library: OpenSSL 0.9.8k 25 Mar 2009) -tls1_1 and -tls1_2 are not recognised options -tls1 fails -ssl3 connects fine.The apache httpd has been compiled against the same openssl (and is running on the same box, ubuntu 10.04 LTS)
Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/0.9.8t --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|