AW: connecting client tlsv1.0 to apache proxy tlsv1.1/tlsv1.2 is missing TLS-alert on close

<michael.nguyen@xxxxxxxxxxxxxx> · Wed, 10 Jan 2018 08:33:01 +0000

Hi Yann,

I'm using Apache 2.4.29 and for openssl:

$ openssl version
OpenSSL 1.0.2l  25 May 2017

When I try to connect via tlsv1.0 it turns out like this

$ curl --tlsv1.0 --insecure https://dummy.localhost/
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to dummy.localhost:443

As for my curl:

$ curl --version
curl 7.55.1 (x86_64-w64-mingw32) libcurl/7.55.1 OpenSSL/1.0.2l zlib/1.2.11 libidn2/2.0.4 libssh2/1.8.0 nghttp2/1.23.1
Release-Date: 2017-08-14
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz TLS-SRP HTTP2 HTTPS-proxy Metalink

Could the OpenSSL version be the problem? 

Regards,
Michael

-----Ursprüngliche Nachricht-----
Von: Yann Ylavic [mailto:ylavic.dev@xxxxxxxxx] 
Gesendet: Dienstag, 9. Januar 2018 20:14
An: users@xxxxxxxxxxxxxxxx
Betreff: Re:  connecting client tlsv1.0 to apache proxy tlsv1.1/tlsv1.2 is missing TLS-alert on close

Hi Michael,

On Tue, Jan 9, 2018 at 6:02 PM,  <michael.nguyen@xxxxxxxxxxxxxx> wrote:
>
> When I try to connect to the apache via curl with something like this "curl
> --tlsv1.0 --insecure https://test.localhost"; and trace the network
> communication via wireshark you can see that the TLS-Alert is missing when
> the connection is closed. I added a screenshot in the attachements.

It works for me:

$ openssl version
OpenSSL 1.1.0f  25 May 2017

$ curl --tlsv1.0 --insecure https://localhost:8443
curl: (35) error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1
alert protocol version

Which httpd and openssl versions are you using?

Regards,
Yann.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx