Re: Can Openssl still use a null cipher?

On Tue, Feb 25, 2025 at 08:12:57PM -0800, Bryan Henderson wrote:

> Thanks!  My problem is solved.  Adding @SECLEVEL=0 to the cipher string on 
> both sides made it work.
> 
> It's a pity the program/library couldn't warn me that the only cipher suite 
> I requested was incompatible with my security level (which I didn't even 
> know existed).

Experience is what you get when you don't get what you want...

> > You need to set a ceiling on the protocol version:
> > -max_protocol TLSv1.2
> 
> Apparently not.

Well, you generally do if the server supports TLS 1.3.  In some cases,
your's included, the server may be configured to do at most TLS 1.2,
and yes, in that case, the client-side ceiling is optional.

In particular, if you *do* set the protocol cap, *then* you get the
missing ciphers warning you wanted.

    $ openssl s_client -max_protocol TLSv1.2 -connect 127.0.0.1:25 -starttls smtp -cipher aNULL+kECDHE -brief
    Connecting to 127.0.0.1
    806BAB3BB57F0000:error:0A0000B5:SSL routines:ssl_cipher_list_to_bytes:no ciphers available:ssl/statem/statem_clnt.c:4156:No ciphers enabled for max supported SSL/TLS version

While, otherwise, you may get a TLS 1.3 connection:

    $ openssl s_client -connect 127.0.0.1:25 -starttls smtp -cipher aNULL+kECDHE -brief
    Connecting to 127.0.0.1
    Can't use SSL_get_servername
    depth=0 CN=...
    verify error:num=18:self-signed certificate
    CONNECTION ESTABLISHED
    Protocol version: TLSv1.3
    Ciphersuite: TLS_AES_256_GCM_SHA384
    Peer certificate: CN=...
    Hash used: UNDEF
    Signature type: mldsa65
    Verification error: self-signed certificate
    Negotiated TLS1.3 group: X25519MLKEM768
    250 CHUNKING
    quit
    221 2.0.0 Bye

-- 
    Viktor.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/Z76bZXeqW2ifWNz9%40chardros.imrryr.org.