Bug 710090

Summary: SSL not work properly
Product: [Fedora] Fedora Reporter: Faber <faber73>
Component: nssAssignee: Elio Maldonado Batiz <emaldona>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 15CC: emaldona, kdudka, kengert, paul
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-08-07 16:10:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Faber 2011-06-02 12:40:56 UTC
Description of problem:

I think problem still in the SSL keys. But I'm not sure. In Ubuntu work properly.

Ex :

curl -v -S -k -3 https://areaclienti.tre.it

* About to connect() to areaclienti.tre.it port 443 (#0)
*   Trying 62.13.171.130... connected
* Connected to areaclienti.tre.it (62.13.171.130) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
* warning: ignoring unsupported value (1) of ssl.verifyhost
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12286
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error



Thank you in advance



Faber

Comment 1 Kamil Dudka 2011-06-02 13:23:14 UTC
(In reply to comment #0)
> * About to connect() to areaclienti.tre.it port 443 (#0)
> *   Trying 62.13.171.130... connected
> * Connected to areaclienti.tre.it (62.13.171.130) port 443 (#0)
> * Initializing NSS with certpath: /etc/pki/nssdb
> * warning: ignoring unsupported value (1) of ssl.verifyhost
> *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
>   CApath: none
> * NSS error -12286

Seek SSL_ERROR_NO_CYPHER_OVERLAP at http://www.mozilla.org/projects/security/pki/nss/ref/ssl/sslerr.html

> * Closing connection #0
> * SSL connect error
> curl: (35) SSL connect error

I am getting the same result with tstclnt so this problem does not seem to be related to curl:

/usr/lib64/nss/unsupported-tools/tstclnt -h areaclienti.tre.it -d sql:/etc/pki/nssdb
tstclnt: read from socket failed: Cannot communicate securely with peer: no common encryption algorithm(s).

I am re-assigning this bug to nss.

Comment 2 Faber 2011-06-17 07:28:29 UTC
Hello, nothing person work here ?


UP ! :-)

Comment 3 Elio Maldonado Batiz 2011-09-12 16:02:59 UTC
On Ubuntu libcurl seems to use gnutls by default it seems, though there seems to be an option to make it use openssl or nss. I'll look into that but more iportantly is fedora with nss's own tstclt client application.

The SSL_ERROR_NO_CYPHER_OVERLAP is surprising as using ssltap I was able to see that NSS is proposing the standard ssl3 cipher suites that I know the server supports. 

Using openssl the client hello gets a server hello response with openssl and tnh server picked SSL3 RSA WITH RC4 128 SHA and it displayed the page.

As an aside, with NSS with I tried /usr/lib64/nss/unsupported-tools/tstclnt -h reaclienti.tre.it -d sql:/etc/pki/nssdb -c n
(-c n <--->   SSL3 RSA WITH RC4 128 SHA) it went past the client hello to the server response but I got
tstclnt: read from socket failed: Peer's Certificate issuer is not recognized.

Need to consult with others on ssl and possibly file a bug upstream.

Comment 4 Fedora End Of Life 2012-08-07 16:10:54 UTC
This message is a notice that Fedora 15 is now at end of life. Fedora
has stopped maintaining and issuing updates for Fedora 15. It is
Fedora's policy to close all bug reports from releases that are no
longer maintained. At this time, all open bugs with a Fedora 'version'
of '15' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that
we were unable to fix it before Fedora 15 reached end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora, you are encouraged to click on
"Clone This Bug" (top right of this page) and open it against that
version of Fedora.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

The process we are following is described here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping