I'm having problem establishing the connection between the client and the Server .I'm using my own signed certificate on client and on server. I'm using the SSL ciphers SSLCipherSuite ECDH-ECDSA-AES128-SHA and some suggested that I should use the prime256v1 elliptic curves(I do not know what exactly does this means ) .I ;m using an apache tomcat server.My httpd-ssl-virtual-host-conf looks like this
ssl read bytes sslv3 alert handshake_failure
Listen 4445 ## ## SSL Virtual Host Context ## Include "conf/httpd-jk.conf" <VirtualHost *:4445> #General setup for the virtual host DocumentRoot "htdocs" ServerName ocu1.totalsoft.ro ServerAdmin firstname.lastname@example.org ErrorLog "logs/error_log" TransferLog "logs/access_log" CustomLog logs/car2x.log combined #JKMount /car2x/* worker1 JKMount /BTS/* worker1 #<Location "/car2x/WEB-INF/"> <Location "/BTS/WEB-INF/"> deny from all </Location> JkMountCopy On <Directory "htdocs"> Options Indexes FollowSymLinks AllowOverride None Order allow,deny Allow from all </Directory> # SSL Engine Switch: # Enable/Disable SSL for this virtual host. SSLEngine on SSLProtocol -All +SSLv3 +TLSv1 # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. SSLCipherSuite ECDH-ECDSA-AES128-SHA #SSLCipherSuite RC4-SHA:AES128-SHA:ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+SSLv3:+TLSv1:+EXP:+eNULL # This is only for allowed ciphers specified within the core service communication document #SSLCipherSuite HIGH:+MEDIUM:+LOW:+SSLv3:+TLSv1:+ECDH-ECDSA-AES128-SHA:+ECDHE-ECDSA-AES256-SHA:+ECDH-ECDSA-AES128-SHA256 #SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; #SSLCipherSuite AES128-SHA #SSLCertificateFile "conf/server-cert.pem" #SSLCertificateFile "conf/resource/server-cert.pem" SSLCertificateFile "conf/resource/Bucharest4.pem" #SSLCertificateFile "conf/server-dsa.crt" #SSLCertificateKeyFile "conf/server-key.pem" #SSLCertificateKeyFile "conf/server-key.pem" SSLCertificateKeyFile "conf/resource/Bucharest4_key.pem" SSLCACertificateFile "conf/ca.pem" SSLVerifyClient optional_no_ca #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire SSLOptions +ExportCertData #<FilesMatch "\.(cgi|shtml|phtml|php)$"> # SSLOptions +StdEnvVars #</FilesMatch> <Directory "cgi-bin"> SSLOptions +StdEnvVars </Directory> I'm getting the followinq error on the client side D/https(1153): INFO TEXT: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
But when I'm trying to connect with
openssl s_client -ciphers ECDH-ECDSA-AES-SHA -connect ocu1.totalsoft.ro -k it works?
I can provide wireshark logs. In that logs I receive a lot of client hello but no server hello. Instead I receive
sslv3 alert with number 40 (hanshake_failure).