Bug 1199966

Summary:	Connection to HP iLO with TLS1.0 fails
Product:	Red Hat Enterprise Linux 6	Reporter:	Marek Grac <mgrac>
Component:	gnutls	Assignee:	Nikos Mavrogiannopoulos <nmavrogi>
Status:	CLOSED NOTABUG	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	high	Docs Contact:
Priority:	high
Version:	6.7	CC:	jruemker, mgrac, nmavrogi, pvn
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-20 18:53:15 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1198554, 1199970, 1199971, 1214411

Description Marek Grac 2015-03-09 12:03:01 UTC

Device HP iLO2 can be accessed over https, for this purpose we use gnutls-cli

With new firmware 2.27, SSLv3 was disabled by default. And previous configuration does not work anymore. In RHEL7 (gnutls 3.4), it is possible to use

--priority "NORMAL:-VERS-TLS1.2:-VERS-TLS1.1:+VERS-TLS1.0:%LATEST_RECORD_VERSION"

with this argument everything works as expected (thanks to Nikos).

Attempt to try this argument in RHEL6 failed because %LATEST_RECORD_VERSION is not supported. Omitting this argument;executing without --priority at all or adding "-VERS-SSL3.0" ends with 'Peer has closed the GNUTLS connection'. 

I agree that main problem is broken implementation on iLO2 side but I would like you to consider adding required option.

Comment 19 Marek Grac 2015-03-20 18:53:15 UTC

@Nikos:

sorry for bothering you, I have found out that issue was on my side.

gnutls_opts = "--priority \"NORMAL:-VERS-TLS1.2:-VERS-TLS1.1:+VERS-TLS1.0:-VERS-SSL3.0\""

works for us.

Thanks a lot, closing as not a bug.