3

I am trying to setup Apache Trafficserver as a reverse proxy. (Debian Stretch, ATS 7.0.0 (also tried 7.1.2 from backports), openssl 1.1.0f)

Everything went fine so far, until I came accross configuring TLS. I added port 443 for SSL in records.config, set the cert-paths, created a local test-certificate, which I defined as default in ssl_multicert.config and also tried to fiddle with cipher_list.

But no matter which cipher_list I use (commented out with a #, default value from package, just one cipher, NULL for all ciphers), the trafficserver does not give a single cipher in the handshake response. Firefox gives a "no cipher overlap" as a consequence, sslscan gives the following output:

user@host:~$ sslscan https://testats.mycompany.com
Version: 1.11.5
OpenSSL 1.0.2l  25 May 2017

OpenSSL version does not support SSLv2
SSLv2 ciphers will not be detected

OpenSSL version does not support SSLv3
SSLv3 ciphers will not be detected
Testing SSL server testats.mycompany.com on port 443

  TLS renegotiation:
Session renegotiation not supported

  TLS Compression:
OpenSSL version does not support compression
Rebuild with zlib1g-dev package for zlib support

  Heartbleed:
TLS 1.2 not vulnerable to heartbleed
TLS 1.1 not vulnerable to heartbleed
TLS 1.0 not vulnerable to heartbleed

  Supported Server Cipher(s):
user@host:~$

A test with sslscan against the origin webserver, which ATS should remap to, is working fine.

Any ideas?

  • How did you apply the configuration changes to ATS? – symcbean Apr 13 '18 at 12:36
  • Via a "service trafficserver restart", since ATS is installed as a service automatically thru the debian-package. – chrikru Apr 16 '18 at 6:14
  • Did you find a solution to this? – Vicky Aug 23 '18 at 15:13
  • No, I gabe up on trying ATS due to lack of time to analyze the problem. maybe I messed something up with the test-certificates I created, but I can't say for sure. – chrikru Oct 31 '18 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.