5

I've got the following strange SSL connection error:

openssl s_client -ssl3 -connect host:443  -msg

CONNECTED(00000003)
>>> SSL 3.0 Handshake [length 0087], ClientHello
    01 00 00 83 03 00 53 70 cb 57 f8 66 46 4d ad 9f
    12 f9 03 32 11 b9 58 f8 82 d7 43 36 80 c9 39 68
    14 72 85 18 95 2b 00 00 5c c0 14 c0 0a 00 39 00
    38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0
    08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00
    33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00
    2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c c0 02 00
    05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00
    06 00 03 00 ff 01 00
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes

Sometimes connection works fine, and sometimes errors above occur with no known case, not even getting to certificate exchange state.

My system is a CentOS 6.5 OpenSSL 1.0.1e-fips 11 Feb 2013.

2
  • Probably unrelated, but you are using what appears to be a version of OpenSSL with a serious vulnerabilty that you should fix... heartbleed.com May 14, 2014 at 2:41
  • Thanks, in CentOS there are backporting policy, so the version stays the same but security patch got applied. Thats what i got: rpm -q openssl openssl-1.0.1e-16.el6_5.7.x86_64 quoting centos forum: f you run rpm -q openssl and it reports version 1.0.1e and less than 1.0.1e-16.el6_5.4.0.1 then you are currently vulnerable to this problem. If it reports 1.0.1e-16.el6_5.4.0.1.centos then you have the temporary version issued before Redhat issued their official fix. If you have 1.0.1e-16.el6_5.7 or higher then you have the official fixed version. May 14, 2014 at 8:26

1 Answer 1

6

Found that new AWS type of instances have MTU 9001 by default and this causes erros with SSL packets: sometimes they are delayed and sometimes dropped. Setting MTU to 1500 helped to solve this issue.

quotation from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html:

The maximum transmission unit (MTU) for an instance depends on its instance type. The following instance types provide 9001 MTU (jumbo frames): CC2, C3, R3, CG1, CR1, G2, HS1, HI1, I2, and M3. The other instance types provide 1500 MTU (Ethernet v2 frames).)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .