Description of problem: openssl s_client -connect <hostname>:<port> command against an LDAP is giving the following error: Secure Renegotiation IS NOT supported. Version-Release number of selected component (if applicable): openssl-1.1.1-3.fc29.x86_64.rpm How reproducible: Every-time Steps to Reproduce: 1. Create a DS instance with the following command: #dscreate interactive Install Directory Server (interactive mode) =========================================== Enter system's hostname [server.example.com]: <hostname> Use strict hostname verification (set to "no" if using GSSAPI behind a load balancer) [yes]: Enter the instance name [server]: <any_instance_name> Enter port number [389]: Create self-signed certificate database [yes]: Enter secure port number [636]: Enter Directory Manager DN [cn=Directory Manager]: Enter the Directory Manager password: Confirm the Directory Manager Password: Enter the database suffix (or enter "none" to skip) [dc=server-rhel8,dc=example,dc=com]: Create sample entries in the suffix [no]: Are you ready to install? [no]: yes 2. Run: openssl s_client -connect localhost:636 < /dev/null | grep "Secure Renegotiation" Actual results: #openssl s_client -connect localhost:636 < /dev/null | grep "Secure Renegotiation" depth=1 C = AU, ST = Queensland, L = 389ds, O = testing, CN = ssca.389ds.example.com verify error:num=19:self signed certificate in certificate chain DONE Secure Renegotiation IS NOT supported Expected results: #openssl s_client -connect localhost:636 < /dev/null | grep "Secure Renegotiation" depth=1 C = AU, ST = Queensland, L = 389ds, O = testing, CN = ssca.389ds.example.com verify error:num=19:self signed certificate in certificate chain DONE Secure Renegotiation IS supported Additional info: Same use to work in the earlier version: openssl-1.1.0i-1.fc28.x86_64
That's because the TLS-1.3 connection is negotiated which does not support renegotiation at all. It does support rekeying but that is a different part of the protocol.
If you use openssl s_client -no_tls1_3 - it will work as before.