OpenSSL force client to use specific protocol

Posted by Ex Umbris on Super User See other posts from Super User or by Ex Umbris
Published on 2012-06-07T21:25:17Z Indexed on 2012/06/07 22:43 UTC
Read the original article Hit count: 221

Filed under:

When subversion attempts to connect to an https URL, the underlying protocol library (openssl) attempts to start the secure protocol negotiation at the most basic level, plain SSL.

Unfortunately, I have to connect to a server that requires SSL3 or TLS1, and refuses to respond to SSL or SSL2.

I’ve done some troubleshooting using s_client and confirmed that if I let s_client start with the default protocol the server never responds to the CLIENT HELLO:

$ openssl s_client -connect server.domain.com:443
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 320 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

Watching this in Wireshark I see:

Client                Server
    -------syn---------->
    <------ack-----------
    ---CLIENT HELLO----->
    <------ack-----------
      [60 second pause]
    <------rst-----------

If I tell s_client to use ssl2 the server immediately closes the connection. Only ssl3 and tls1 work.

Is there any way to configure openssl to skip SSL and SSL2, and start the negotiation with TLS or SSL3? I've found the OpenSSL config file, but that seems to control only certificate generation.

© Super User or respective owner

Related posts about openssl