Re: stunnel-users Digest, Vol 183, Issue 4
Brent Kimberley <[email protected]> Sat, 26 Oct 2019 10:43:49 +0000 (UTC)
| Newsgroups | gmane.network.stunnel.user |
|---|---|
| Message-ID | <[email protected]> |
--===============3434988991093307397== Content-Type: multipart/alternative; boundary="----=_Part_825779_1920763278.1572086629535" ------=_Part_825779_1920763278.1572086629535 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Chris.Does this help?=C2=A0=C2=A0https://stackoverflow.com/questions/40454= 338/no-shared-cipher-at-ssl-accept-why If you can rule out libraries like OpenSSL, then look at your config + init= ial setup=C2=A0exchange. Date: Fri, 25 Oct 2019 11:11:54 -0400 From: Christopher Schultz <[email protected]> Subject: Re: [stunnel-users] Strange connection failure in one environmentO= n 10/25/19 10:09, Christopher Schultz wrote: > All, >=20 > I've been using stunnel in two environments (dev, prod) for a long time > without any problems. Recently, my dev environment started acting funny > and I can't connect to it from outside the box. >=20 > Can someone take a look and let me know if you have any suggestions for > where to look for a problem? >=20 > Both environments have the following things in common: >=20 > 1. Hosted in Amazon EC2, no load-balancer in the way > 2. Configuration requires client-certificate to connect > 3. All certificates are valid, self-signed, and properly-trusted by both > sides > 4. TLS configuration has been locked-down to TLSv1.2, selected cipher > suites, FIPS mode=3Doff > 5. All versions are the same: stunnel 4.56 w/OpenSSL 1.0.2k-fips >=20 > The production (working) environment happens to be i686 and the > development environment happens to be x86-86, but I don't believe that > is relevant. >=20 > When I use e.g. "openssl s_client" to connect to the production > environment and I *do not* provide a client certificate, I am able to > perform the initial TLS handshake, get a cipher suite negotiated, etc. > and then the connection fails because I didn't provide the client > certificate, of course. I *can* see in the handshake the list of allowed > client certificates. >=20 > When I do the same in development, I get a handshake failure. No allowed > client certificates are shown. No nothing. >=20 > If I connect on localhost to the dev server, I get what I'm expecting: > allowed client certificates are listed, connection is closed because I'm > not using the client certificate. Connecting from another host gets my a > handshake failure. >=20 > Again, there are no load-balancers or anything between the outside and > the EC2 instance. I'm connecting as directly as it's possible to > connect. The box definitely allows incoming connections on the port I'm > trying to use; the AWS security group is configured correctly. >=20 > I have tried dropping ALL security configuration on the dev server's > stunnel.conf such as client-cert requirements, TLS protocols, cipher > suites, etc. and I get the same behavior every time. I'm starting to > think that it has nothing to do with my stunnel.conf configuration at > all, but I'm at a loss as to where to look, next. >=20 > Any ideas? Some more information: 0. The error I get on the client is "handshake failure" and the stunnel server drops this log message: SSL_accept: 1408A0C1: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher Note that I have disabled all but TLSv1.2 on the server. Removing this restriction does not change the behavior. 1. I have multiple stunnel configuration files on this server. Actually, I have 4 of them. Connections to ports defined in 2 of these files are not connecting successfully. Connections to ports defined in the OTHER two files *are* connecting successfully. The configurations seem to follow a pattern: those using RSA certificates as the server-certificate are working as expected, while those with EC server-certificate are failing. When I say "working" versus "failing", I mean that this command will give me a cipher suite and master key, but still drop the connection because I'm not providing a client-certificate for these tests: $ openssl s_client -connect host:port 2. I have a Java-based service that *is* able to connect through this stunnel instance just fine. It's running on a recent version of Java 8. My CLI client (not OpenSSL) is also running the same version. My CLI client cannot connect. *weird* In both cases, I am using EC client certificates, but the certificates are different from each other. Both of these certificates are trusted by the server. 3. When using OpenSSL 1.0.2t, I *can* connect, get the list of acceptable client certificates, etc. even without providing a client certificate. When using OpenSSL 1.1.1d, I can *not* connect. So perhaps the inside/outside networking thing I was thinking the problem might be is incorrect. AFAIK, both versions of OpenSSL should be able to use EC certificates and cipher suites. Thanks, -chris =20 ------=_Part_825779_1920763278.1572086629535 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <html><head></head><body><div class=3D"ydpa467bdbdyahoo-style-wrap" style= =3D"font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px= ;"><div></div> <div dir=3D"ltr" data-setdir=3D"false">Chris.</div><div dir=3D"ltr"= data-setdir=3D"false">Does this help? </div><div dir=3D"ltr" da= ta-setdir=3D"false"><span><a href=3D"https://stackoverflow.com/questions/40= 454338/no-shared-cipher-at-ssl-accept-why" rel=3D"nofollow" target=3D"_blan= k" class=3D"">https://stackoverflow.com/questions/40454338/no-shared-cipher= -at-ssl-accept-why</a></span><div><br></div><div dir=3D"ltr" data-setdir=3D= "false"><span><span style=3D"color: rgb(0, 0, 0); font-family: Helvetica Ne= ue, Helvetica, Arial, sans-serif; font-size: 16px;">If you can rule out lib= raries like OpenSSL, then look at your config + initial setup <span><s= pan style=3D"color: rgb(0, 0, 0); font-family: Helvetica Neue, Helvetica, A= rial, sans-serif; font-size: 16px;">exchange</span></span>.</span></span><b= r></div><div><br></div></div></div><div id=3D"ydp95ea77b3yahoo_quoted_25467= 40161" class=3D"ydp95ea77b3yahoo_quoted"><div style=3D"font-family:'Helveti= ca Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;"><div>= <div dir=3D"ltr">Date: Fri, 25 Oct 2019 11:11:54 -0400<br></div><div dir=3D= "ltr">From: Christopher Schultz <<a href=3D"mailto:chris@christopherschu= ltz.net" rel=3D"nofollow" target=3D"_blank">[email protected]</a= >><br></div><div dir=3D"ltr">Subject: Re: [stunnel-users] Strange connec= tion failure in one environment</div><div dir=3D"ltr">On 10/25/19 10:09, Ch= ristopher Schultz wrote:<br></div><div dir=3D"ltr">> All,<br></div><div = dir=3D"ltr">> <br></div><div dir=3D"ltr">> I've been using stunnel in= two environments (dev, prod) for a long time<br></div><div dir=3D"ltr">>= ; without any problems. Recently, my dev environment started acting funny<b= r></div><div dir=3D"ltr">> and I can't connect to it from outside the bo= x.<br></div><div dir=3D"ltr">> <br></div><div dir=3D"ltr">> Can someo= ne take a look and let me know if you have any suggestions for<br></div><di= v dir=3D"ltr">> where to look for a problem?<br></div><div dir=3D"ltr">&= gt; <br></div><div dir=3D"ltr">> Both environments have the following th= ings in common:<br></div><div dir=3D"ltr">> <br></div><div dir=3D"ltr">&= gt; 1. Hosted in Amazon EC2, no load-balancer in the way<br></div><div dir= =3D"ltr">> 2. Configuration requires client-certificate to connect<br></= div><div dir=3D"ltr">> 3. All certificates are valid, self-signed, and p= roperly-trusted by both<br></div><div dir=3D"ltr">> sides<br></div><div = dir=3D"ltr">> 4. TLS configuration has been locked-down to TLSv1.2, sele= cted cipher<br></div><div dir=3D"ltr">> suites, FIPS mode=3Doff<br></div= ><div dir=3D"ltr">> 5. All versions are the same: stunnel 4.56 w/OpenSSL= 1.0.2k-fips<br></div><div dir=3D"ltr">> <br></div><div dir=3D"ltr">>= The production (working) environment happens to be i686 and the<br></div><= div dir=3D"ltr">> development environment happens to be x86-86, but I do= n't believe that<br></div><div dir=3D"ltr">> is relevant.<br></div><div = dir=3D"ltr">> <br></div><div dir=3D"ltr">> When I use e.g. "openssl s= _client" to connect to the production<br></div><div dir=3D"ltr">> enviro= nment and I *do not* provide a client certificate, I am able to<br></div><d= iv dir=3D"ltr">> perform the initial TLS handshake, get a cipher suite n= egotiated, etc.<br></div><div dir=3D"ltr">> and then the connection fail= s because I didn't provide the client<br></div><div dir=3D"ltr">> certif= icate, of course. I *can* see in the handshake the list of allowed<br></div= ><div dir=3D"ltr">> client certificates.<br></div><div dir=3D"ltr">> = <br></div><div dir=3D"ltr">> When I do the same in development, I get a = handshake failure. No allowed<br></div><div dir=3D"ltr">> client certifi= cates are shown. No nothing.<br></div><div dir=3D"ltr">> <br></div><div = dir=3D"ltr">> If I connect on localhost to the dev server, I get what I'= m expecting:<br></div><div dir=3D"ltr">> allowed client certificates are= listed, connection is closed because I'm<br></div><div dir=3D"ltr">> no= t using the client certificate. Connecting from another host gets my a<br><= /div><div dir=3D"ltr">> handshake failure.<br></div><div dir=3D"ltr">>= ; <br></div><div dir=3D"ltr">> Again, there are no load-balancers or any= thing between the outside and<br></div><div dir=3D"ltr">> the EC2 instan= ce. I'm connecting as directly as it's possible to<br></div><div dir=3D"ltr= ">> connect. The box definitely allows incoming connections on the port = I'm<br></div><div dir=3D"ltr">> trying to use; the AWS security group is= configured correctly.<br></div><div dir=3D"ltr">> <br></div><div dir=3D= "ltr">> I have tried dropping ALL security configuration on the dev serv= er's<br></div><div dir=3D"ltr">> stunnel.conf such as client-cert requir= ements, TLS protocols, cipher<br></div><div dir=3D"ltr">> suites, etc. a= nd I get the same behavior every time. I'm starting to<br></div><div dir=3D= "ltr">> think that it has nothing to do with my stunnel.conf configurati= on at<br></div><div dir=3D"ltr">> all, but I'm at a loss as to where to = look, next.<br></div><div dir=3D"ltr">> <br></div><div dir=3D"ltr">> = Any ideas?<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">Some more i= nformation:<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">0. The err= or I get on the client is "handshake failure" and the stunnel<br></div><div= dir=3D"ltr">server drops this log message:<br></div><div dir=3D"ltr"><br><= /div><div dir=3D"ltr">SSL_accept: 1408A0C1: error:1408A0C1:SSL<br></div><di= v dir=3D"ltr">routines:ssl3_get_client_hello:no shared cipher<br></div><div= dir=3D"ltr"><br></div><div dir=3D"ltr">Note that I have disabled all but T= LSv1.2 on the server. Removing this<br></div><div dir=3D"ltr">restriction d= oes not change the behavior.<br></div><div dir=3D"ltr"><br></div><div dir= =3D"ltr">1. I have multiple stunnel configuration files on this server. Act= ually,<br></div><div dir=3D"ltr">I have 4 of them. Connections to ports def= ined in 2 of these files are<br></div><div dir=3D"ltr">not connecting succe= ssfully. Connections to ports defined in the OTHER<br></div><div dir=3D"ltr= ">two files *are* connecting successfully.<br></div><div dir=3D"ltr"><br></= div><div dir=3D"ltr">The configurations seem to follow a pattern: those usi= ng RSA<br></div><div dir=3D"ltr">certificates as the server-certificate are= working as expected, while<br></div><div dir=3D"ltr">those with EC server-= certificate are failing.<br></div><div dir=3D"ltr"><br></div><div dir=3D"lt= r">When I say "working" versus "failing", I mean that this command will<br>= </div><div dir=3D"ltr">give me a cipher suite and master key, but still dro= p the connection<br></div><div dir=3D"ltr">because I'm not providing a clie= nt-certificate for these tests:<br></div><div dir=3D"ltr"><br></div><div di= r=3D"ltr">$ openssl s_client -connect host:port<br></div><div dir=3D"ltr"><= br></div><div dir=3D"ltr">2. I have a Java-based service that *is* able to = connect through this<br></div><div dir=3D"ltr">stunnel instance just fine. = It's running on a recent version of Java 8.<br></div><div dir=3D"ltr">My CL= I client (not OpenSSL) is also running the same version. My CLI<br></div><d= iv dir=3D"ltr">client cannot connect. *weird* In both cases, I am using EC = client<br></div><div dir=3D"ltr">certificates, but the certificates are dif= ferent from each other. Both<br></div><div dir=3D"ltr">of these certificate= s are trusted by the server.<br></div><div dir=3D"ltr"><br></div><div dir= =3D"ltr">3. When using OpenSSL 1.0.2t, I *can* connect, get the list of<br>= </div><div dir=3D"ltr">acceptable client certificates, etc. even without pr= oviding a client<br></div><div dir=3D"ltr">certificate.<br></div><div dir= =3D"ltr"><br></div><div dir=3D"ltr">When using OpenSSL 1.1.1d, I can *not* = connect.<br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr">So perhaps th= e inside/outside networking thing I was thinking the<br></div><div dir=3D"l= tr">problem might be is incorrect.<br></div><div dir=3D"ltr"><br></div><div= dir=3D"ltr">AFAIK, both versions of OpenSSL should be able to use EC certi= ficates<br></div><div dir=3D"ltr">and cipher suites.<br></div><div dir=3D"l= tr"><br></div><div dir=3D"ltr">Thanks,<br></div><div dir=3D"ltr">-chris<br>= </div><div dir=3D"ltr"><br></div></div> </div> </div></body></html> ------=_Part_825779_1920763278.1572086629535-- --===============3434988991093307397== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ stunnel-users mailing list [email protected] https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users --===============3434988991093307397==--