Bug 1661310 - Secure Renegotiation IS NOT supported
Summary: Secure Renegotiation IS NOT supported
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: openssl
Version: 29
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Tomas Mraz
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-12-20 19:16 UTC by Akshay Adhikari
Modified: 2018-12-21 07:34 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2018-12-21 07:33:06 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Akshay Adhikari 2018-12-20 19:16:47 UTC
Description of problem:

openssl s_client -connect <hostname>:<port> command against an LDAP is giving the following error: Secure Renegotiation IS NOT supported.

Version-Release number of selected component (if applicable):

openssl-1.1.1-3.fc29.x86_64.rpm

How reproducible:

Every-time

Steps to Reproduce:

1. Create a DS instance with the following command:

#dscreate interactive
Install Directory Server (interactive mode)
===========================================

Enter system's hostname [server.example.com]: <hostname>

Use strict hostname verification (set to "no" if using GSSAPI behind a load balancer) [yes]: 

Enter the instance name [server]: <any_instance_name>

Enter port number [389]: 

Create self-signed certificate database [yes]: 

Enter secure port number [636]: 

Enter Directory Manager DN [cn=Directory Manager]: 

Enter the Directory Manager password: 
Confirm the Directory Manager Password: 

Enter the database suffix (or enter "none" to skip) [dc=server-rhel8,dc=example,dc=com]: 

Create sample entries in the suffix [no]: 

Are you ready to install? [no]: yes


2. Run: openssl s_client -connect localhost:636 < /dev/null | grep "Secure Renegotiation"


Actual results:

#openssl s_client -connect localhost:636 < /dev/null | grep "Secure Renegotiation"
depth=1 C = AU, ST = Queensland, L = 389ds, O = testing, CN = ssca.389ds.example.com
verify error:num=19:self signed certificate in certificate chain
DONE
Secure Renegotiation IS NOT supported


Expected results:

#openssl s_client -connect localhost:636 < /dev/null | grep "Secure Renegotiation"
depth=1 C = AU, ST = Queensland, L = 389ds, O = testing, CN = ssca.389ds.example.com
verify error:num=19:self signed certificate in certificate chain
DONE
Secure Renegotiation IS supported


Additional info:
Same use to work in the earlier version: openssl-1.1.0i-1.fc28.x86_64

Comment 2 Tomas Mraz 2018-12-21 07:33:06 UTC
That's because the TLS-1.3 connection is negotiated which does not support renegotiation at all. It does support rekeying but that is a different part of the protocol.

Comment 3 Tomas Mraz 2018-12-21 07:34:05 UTC
If you use openssl s_client -no_tls1_3 - it will work as before.


Note You need to log in before you can comment on or make changes to this bug.