3

i looked around a lot of similar question but none of this fixing my issue. We are upgrading to TLS 1.2 and am getting the below error which i got from Windows event log

An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server.

lantronix xport pro(Supporting TLS 1.2) Device making a call to the .net service deployed in Windows server 2012.

Client/Server Handshake is failing but am not able to figure out why. issue happens in the below line

stream.AuthenticateAsServer(_serverCertificate, false, SslProtocols.Ssl3| SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12, true);

Used Wireshark and Windows server 2012 R2 have only TLs 1.1 and 1.2 enabled using IIS Crypto

Client send TLS 1.2 Request with below Cipher suites

Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 (0x0060)
Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (0x0064)
Cipher Suite: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003)

But server doesnt respond with Server Hello and finding the error message that none of the cipher supported by server.

I can see in IIS Crypto that AES_128_CBC_SHA in the crypto. But am not sure why it failing and almost stuck for days. Hope to get some clarity on what i can do further to troubleshoot this

Update::

I created a Client from Windows server 2012 and it is connected to the server and it is connecting TLS 1.2 with Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)

But when connecting lantronix xport pro(Supporting TLS 1.2) server says 'The client and server cannot communicate, because they do not possess a common algorithm' on both X86 and x64.

Does it mean 2012 server does not support any of this ciphers sent by client

Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 (0x0060) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (0x0064) Cipher Suite: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003)

Server creating TCL SSLStream and not using IIS

Any suggestion for this would be great

Thanks

|improve this question
  • Have you updated the firmware on the Xport Pro? That should be step 1. – Michael Hampton♦ Mar 31 '18 at 16:54
  • A client supporting EXPORT ciphers (which are considered insecure for ages) looks like a severely broken client to me and I doubt that this device has proper support for TLS 1.2. The specification only lists support for SSLv3 which sounds likely given the brokeness of the cipher suite. – Steffen Ullrich Mar 31 '18 at 16:59
  • @MichaelHampton yes i did update to the newest firmware. Is there any thing else i can do to confirm apart from the wireshark where am seeing TLS 1.2 request from client – Peru Mar 31 '18 at 19:44
  • @SteffenUllrich in Wireshark i can see TLS 1.2 and the listed ciphers as per my question from the device . Still this could be wrong and broken ? – Peru Mar 31 '18 at 19:46
  • @Tharun: hard to tell without seeing the actual pcap. Apart from that, are you sure that the windows server is using an RSA and not an ECDSA certificate? – Steffen Ullrich Mar 31 '18 at 20:33
2

Get the openssl client http://gnuwin32.sourceforge.net/packages/openssl.htm to see how the cyphres are being called.

The command is openssl s_client -connect website:port

Most likely you might have NTLM pre authentication on your app, I would look into the providers for IIS and disable it. In the HTTP_REQUEST headers you should see something like:

NTLM=

|improve this answer
  • Thanks for the update. am using SSL stream i just updated in the question as well. stream.AuthenticateAsServer is where am getting the exception – Peru Apr 4 '18 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.