Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I don't know what is exactly going on but I noticed that curl couldn't get secure pages without adding extra switches.

~# curl -v https://api.dreamhost.com
* About to connect() to api.dreamhost.com port 443 (#0)
*   Trying 75.119.208.14...
* connected
* Connected to api.dreamhost.com (75.119.208.14) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
(hangs for a minute)
* Unknown SSL protocol error in connection to api.dreamhost.com:443
* Closing connection #0
curl: (35) Unknown SSL protocol error in connection to api.dreamhost.com:443

Now, when I add -1 (force tlsv1) or -3 (force sslv3) curl works flawlessly. The problem is that other programs seem to have similar issues, like python scripts.

When I try openssl it hangs like curl

openssl s_client  -connect api.dreamhost.com:443
CONNECTED(00000003)
(HANGS)

write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 320 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

The same happens if I use -tls1_2, but it works If I use -ssl3 switch

Additional Data:

OpenSSL> version
OpenSSL 1.0.1e 11 Feb 2013

Does anybody know how to fix this and make curl or openssl work with default settings? I have another machine with Debian lenny that can run both commands flawlessly without any switch.

Thanks!

-Rodrigo

share|improve this question
    
I have the same result as you with curl, wget works here though, what do you get with wget? –  EightBitTony Jul 7 '13 at 8:16
    
@EightBitTony wget seems to work well, but also I discovered that other hosts work. curl graph.facebook.com works well without any switched but curl to api.dreamhost.com will only work if I use curl -1 or -3 –  Rodrigo Jul 7 '13 at 17:53
    
I wonder if it's something in the auto-detection of which SSL version to use that wget gets right and curl gets wrong? Anyway, out of my league, good luck! –  EightBitTony Jul 7 '13 at 19:33

2 Answers 2

up vote 1 down vote accepted

If you run this site against SSLLabs test, you'll see it's intolerant to long handshakes, a problem that certainly affects your version of OpenSSL.

Reducing the cipher list size should help, for example:

openssl s_client -cipher RSA -connect api.dreamhost.com:443

(You can use the --ciphers option for curl.)

share|improve this answer

Make sure you have the ca-certificates package installed properly. If it is installed, you may have accidentally deleted its files and need to reinstall it.

sudo apt-get install --reinstall ca-certificates
share|improve this answer
    
Still the same :/ keeps working when I use -1/-3 switch on curl, or -ssl3 switch for openssl command. –  Rodrigo Jul 7 '13 at 5:27
    
The CA certificates are only used to verify the remote certificate. Unfortunately, there's no remote certificate presented here at all, so that wouldn't help ("no peer certificate available"). –  Bruno Jul 9 '13 at 14:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.