Geek Answers Handbook

Connection error OpenSSL SSL23_GET_SERVER_HELLO, but the browser and curls

I am dealing with a problem where python cannot connect to a specific server via ssl due to openssl not being able to do a handshake. Curl and my browser are working. I tried a couple of different versions of openssl and solutions , but can't connect.

Here is what I tried on both platforms. The output of OpenSSL 1.0.1e prints a little differently, but it still has the same errors.

Mac OSX Yosemite - OpenSSL 0.9.8zg 14 July 2015 Debian GNU/Linux 7 (wheezy) - OpenSSL 1.0.1e 11 Feb 2013

Not indicating which version

 openssl s_client -connect www.uk-recruitment.net:443 openssl s_client -connect www.uk-recruitment.net:443 -cipher 'DEFAULT:!ECDH' openssl s_client -connect www.uk-recruitment.net:443 -CAfile cacert.pem openssl s_client -connect www.uk-recruitment.net:443 -CAfile cacert.pem -cipher 'DEFAULT:!ECDH' openssl s_client -connect www.uk-recruitment.net:443 -CAfile cacert.pem -cipher 'DEFAULT:!ECDH' -servername uk-recruitment.net

but i always get the same result

 CONNECTED(00000003) 66716:error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error:/SourceCache/OpenSSL098/OpenSSL098-52.40.1/src/ssl/s23_clnt.c:593:

If I add -tls1 , -tls1_1 or -tls1_2 with all the same options, I get a slightly different error:

 openssl s_client -connect www.uk-recruitment.net:443 -tls1 CONNECTED(00000003) 66750:error:14094438:SSL routines:SSL3_READ_BYTES:tlsv1 alert internal error:/SourceCache/OpenSSL098/OpenSSL098-52.40.1/src/ssl/s3_pkt.c:1145:SSL alert number 80 66750:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:/SourceCache/OpenSSL098/OpenSSL098-52.40.1/src/ssl/s3_pkt.c:566:
+7
ssl openssl
source share
1 answer

Sites require Server Names (SNIs) and SSL connections that do not use SNI will fail:

 $ openssl s_client -connect www.uk-recruitment.net:443 CONNECTED(00000003) 139999237719712:error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error:s23_clnt.c:770:

Instead, SNI looks much better:

 $ openssl s_client -connect www.uk-recruitment.net:443 -servername www.uk-recruitment.net CONNECTED(00000003) ... Cipher : ECDHE-ECDSA-AES128-GCM-SHA256

It is possible that the -servername option -servername not available in OpenSSL 0.9.8, but it should be with OpenSSL 1.0.1.

+10
source share

More articles:


All Articles