On 28/04/2023 15:25, Samiya Khanum via openssl-users wrote:
//err2 = SSL_get_error(con, err);
printf("\r\nSSL_connect err = %s", ERR_error_string(err2, 0));
You are handling errors incorrectly.
SSL_get_error() returns a number of error codes as described on the man
page:
https://www.openssl.org/docs/man3.1/man3/SSL_get_error.html
This error code is not something you can pass directly to
ERR_error_string() - hence the error strings you are getting out are
nonsensical.
However I can see that they correspond to codes 1 and 5 which are
SSL_ERROR_SSL and SSL_ERROR_SYSCALL respectively.
For SSL_ERROR_SSL you need to inspect the OpenSSL error stack to get
human readable diagnostic information. For example:
ERR_print_errors_fp(stdout);
SYS_ERROR_SYSCALL means that OpenSSL got an error code back when trying
to read/write to the underlying socket. Inspect errno for further
information.
Your code does not set any SNI hostname information via
`SSL_set_tlsext_host_name` which some servers can be sensitive to and
could plausibly cause problems:
https://www.openssl.org/docs/man3.1/man3/SSL_set_tlsext_host_name.html
Matt
