1

Since I limited my Ciphers to ECDHE because of the Logjam vulnerabilities, I am not able to do a curl from a Centos machine anymore. (works from Ubuntu)

$ curl -v https://mysite.mydomain.com
 * Initializing NSS with certpath: sql:/etc/pki/nssdb
 *   CAfile: /etc/pki/tls/certs/ca-bundle.crt   CApath: none
 * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
 * Cannot communicate securely with peer: no common encryption algorithm(s).

Opening with openssl works:

$ openssl s_client -connect mysite.mydomain.com:443 
   SSL-Session:
     Protocol  : TLSv1.2
     Cipher    : ECDHE-RSA-AES256-GCM-SHA384

I tried with explicit cipher, --insecure and --tlsv1.2, no luck

$ curl --ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 -v https://mysite.mydomain.com
curl: (59) Unknown cipher in list: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Edit: tried with correct NSS cipher name, and less than 384 bit:

curl --ciphers ecdhe_rsa_aes_128_sha_256 https://mysite.mydomain.com
* Connected to xxx (xxx) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* Unknown cipher in list: ecdhe_rsa_aes_128_sha_256
* Closing connection 0
curl: (59) Unknown cipher in list: ecdhe_rsa_aes_128_sha_256

Found this bug https://bugzilla.redhat.com/show_bug.cgi?id=1185708 but doesn't help me to get pass that.

SSLLabs report those ciphers as supported:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH 256 bits (eq. 3072 bits RSA)   FS 256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH 256 bits (eq. 3072 bits RSA)   FS 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)   ECDH 256 bits (eq. 3072 bits RSA)   FS 256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)   ECDH 256 bits (eq. 3072 bits RSA)   FS 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)   ECDH 256 bits (eq. 3072 bits RSA)   FS    256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)   ECDH 256 bits (eq. 3072 bits RSA)   FS    128

1 Answer 1

5

RHEL/CentOS does not enable ECC by default in NSS. You have to explicitly specify which ciphers you want, e.g.

curl --ciphers ecdhe_rsa_aes_128_gcm_sha_256  ....

or whatever cipher is supported by your server and also supported by your version of curl/NSS.

See https://stackoverflow.com/a/31108631/3081018 for more details.

I tried with explicit cipher, --insecure and --tlsv1.2, no luck

This problem is not related to certificate validation, so --insecure will not help.

curl --ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

The cipher names with NSS and OpenSSL are different and since your are using curl with NSS backend you must use the NSS syntax. See https://git.fedorahosted.org/cgit/mod_nss.git/plain/docs/mod_nss.html#Directives for how the ciphers need to be specified.

Also, support for ECC with NSS is only available since curl 7.36.

6
  • I already tried with --ciphers ecdhe_rsa_aes_256_gcm_sha_384, I still get Unknown cipher. SSLLabs report this cipher as accepted : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    – Bastien974
    Jul 3, 2015 at 20:15
  • @Bastien974: I think NSS does not have support for ciphers using SHA384. Please look at the cipher list at the link I've provided. Jul 3, 2015 at 20:16
  • Just saw that, --ciphers ecdhe_rsa_aes_128_gcm_sha_256 does not work either. nss : 3.19.1-3.el7 / curl : 7.29.0-19.el7
    – Bastien974
    Jul 3, 2015 at 20:19
  • @Bastien974: I have no idea how you configured your server. Either you provide the URL or add the list of all ciphers supported by your server to the question. Then we could see if their is a matching NSS cipher. Jul 3, 2015 at 20:20
  • 1
    @Bastien974: according to the changelog support for ECC with NSS was only added in curl 7.36. You are using 7.29 so you need to upgrade. Jul 3, 2015 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .