| Summary: | SSL not work properly | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Faber <faber73> |
| Component: | nss | Assignee: | Elio Maldonado Batiz <emaldona> |
| Status: | CLOSED WONTFIX | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 15 | CC: | emaldona, kdudka, kengert, paul |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-08-07 16:10:52 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Faber
2011-06-02 12:40:56 UTC
(In reply to comment #0) > * About to connect() to areaclienti.tre.it port 443 (#0) > * Trying 62.13.171.130... connected > * Connected to areaclienti.tre.it (62.13.171.130) port 443 (#0) > * Initializing NSS with certpath: /etc/pki/nssdb > * warning: ignoring unsupported value (1) of ssl.verifyhost > * CAfile: /etc/pki/tls/certs/ca-bundle.crt > CApath: none > * NSS error -12286 Seek SSL_ERROR_NO_CYPHER_OVERLAP at http://www.mozilla.org/projects/security/pki/nss/ref/ssl/sslerr.html > * Closing connection #0 > * SSL connect error > curl: (35) SSL connect error I am getting the same result with tstclnt so this problem does not seem to be related to curl: /usr/lib64/nss/unsupported-tools/tstclnt -h areaclienti.tre.it -d sql:/etc/pki/nssdb tstclnt: read from socket failed: Cannot communicate securely with peer: no common encryption algorithm(s). I am re-assigning this bug to nss. Hello, nothing person work here ? UP ! :-) On Ubuntu libcurl seems to use gnutls by default it seems, though there seems to be an option to make it use openssl or nss. I'll look into that but more iportantly is fedora with nss's own tstclt client application. The SSL_ERROR_NO_CYPHER_OVERLAP is surprising as using ssltap I was able to see that NSS is proposing the standard ssl3 cipher suites that I know the server supports. Using openssl the client hello gets a server hello response with openssl and tnh server picked SSL3 RSA WITH RC4 128 SHA and it displayed the page. As an aside, with NSS with I tried /usr/lib64/nss/unsupported-tools/tstclnt -h reaclienti.tre.it -d sql:/etc/pki/nssdb -c n (-c n <---> SSL3 RSA WITH RC4 128 SHA) it went past the client hello to the server response but I got tstclnt: read from socket failed: Peer's Certificate issuer is not recognized. Need to consult with others on ssl and possibly file a bug upstream. This message is a notice that Fedora 15 is now at end of life. Fedora has stopped maintaining and issuing updates for Fedora 15. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At this time, all open bugs with a Fedora 'version' of '15' have been closed as WONTFIX. (Please note: Our normal process is to give advanced warning of this occurring, but we forgot to do that. A thousand apologies.) Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, feel free to reopen this bug and simply change the 'version' to a later Fedora version. Bug Reporter: Thank you for reporting this issue and we are sorry that we were unable to fix it before Fedora 15 reached end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged to click on "Clone This Bug" (top right of this page) and open it against that version of Fedora. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping |