Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to use OpenSSL to connect to an SSL server.

When I run:

openssl s_client -connect myhost.com:443

The following SSL client configurations work just fine:

  • Windows (OpenSSL 0.9.83e 23 Feb 2007)
  • Linux (OpenSSL 0.9.8o 01 Jun 2010)
  • Linux (OpenSSL 1.0.0-fips 29 Mar 2010)

Output from any successful connection looks like this:

New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DES-CBC3-SHA
    Session-ID: (hidden)
    Session-ID-ctx:
    Master-Key: (hidden)
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1337266099
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

However, when I use client with my Ubuntu 12.04 (w/ OpenSSL 1.0.1 14 Mar 2012) I get error:

CONNECTED(00000003)
...:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:

How can I proceed on solving this?

All tips are much appreciated!

share|improve this question
    
What protocol and cipher are used when it connects from Windows? –  Shane Madden May 15 '12 at 22:30
    
It says: New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA. I wish I understood what this all means! :) –  Jaakko May 16 '12 at 5:37
    
DES? That's an odd cipher to have highest priority. What kind of server are you connecting to? –  Shane Madden May 16 '12 at 5:51
1  
Maybe the defaults on the newer openssl are by default restricting older ssl protocol versions? There would be some reasons to do so given the recent BEAST mess... –  rackandboneman May 17 '12 at 13:41
1  
D'oh, understood. You're testing the clients against your site. –  brent May 17 '12 at 15:07
show 5 more comments

2 Answers

up vote 10 down vote accepted
+100

This looks to be a known issue with Ubuntu's 1.0.1 OpenSSL: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/965371

It doesn't look like a fix is available. If possible you could downgrade to 1.0.0.

Try openssl s_client -tls1 -connect myhost.com:443

share|improve this answer
    
THANKS A LOT MAN!!! I consider this problem closed. –  Jaakko May 17 '12 at 15:12
    
More details of the problem on the Debian ticket: bugs.debian.org/cgi-bin/bugreport.cgi?bug=665452 –  brent May 17 '12 at 15:12
    
P.S. I will give you the bounty when it expires (19 hours) –  Jaakko May 17 '12 at 15:14
1  
Sounds good :) Final piece of info, upstream ticket with OpenSSL that seems to be the root cause of the issue: rt.openssl.org/Ticket/… –  brent May 17 '12 at 15:16
add comment

If you get this issue with a Java HTTPS server running on OpenJDK, try editing /etc/java-7-openjdk/security/java.security and commenting out the line

security.provider.10=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.cfg

as discovered by Christoph W.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.