Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I apologize in advance if this question is a little confusing, my knowledge of SSL certificates is limited.

Basically there are 2 third party servers that I would make a call to over TLS. This worked fine until the servers had their certificates changed. I was assured the servers were setup identically and the certificates were exactly the same, however the calls to the first server still worked while the second server would not. The second server would timeout with the .NET exception

{System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Received an unexpected EOF or 0 bytes from the transport stream.

Google says the error indicates an issue with the security protocol and this question says that a server can use TLS, SSL3 or both. So I changed the connection to use SSL3 before making the call and now bother servers work properly.

So the setup wouldn't be identical if the first server was setup to use TLS/SSL3 and the second server was only using SSL3. Is there any way for me to check, keeping in mind that I don't have logon access to the machine itself?

If not, what could I tell the people who maintain the servers to check?

share|improve this question
    
Set a test for both methods, if the first fails, try the second? –  NickW Mar 1 '13 at 15:36
    
@NickW, sorry, to clarify, I'm not looking to handle this case through the application logic, but to have them fix their servers so that they act identically. If TLS is enabled on one server but not the other, then it needs to be disabled. But how would I know it's enabled aside from calling it in code and failing? Is there a property on the certificate I can view in the browser or something? –  Brandon Mar 1 '13 at 15:38
1  
I was suggesting using application logic to point it out to the administrators. The methods seem to be a fairly comprehensive test for the existence of a protocol, no? –  NickW Mar 1 '13 at 15:48
    
@NickW, you're probably right. I'll give that a shot, I was just hoping there might have been something simple for them to check themselves. Thanks. –  Brandon Mar 1 '13 at 16:07
2  
You can use the openssl s_client command to test and provide more detail on the SSL/TLS setup, e.g. openssl s_client -tls1 -state -showcerts -CApath /etc/ssl/certs -connect hostname:port. –  mgorven Mar 1 '13 at 17:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.