2

I am running the following command:

curl --tlsv1.2 -v --cacert ./mycert.crt --key ./key.pem --cert ./mycert.crt  https://thirdparty.url

I received the certificate from the third party I am working with after generating CSR and key files with openssl.

My server IP is whitelisted on the third party's firewall and they can see my requests coming in but the handshake always fails.

This is the response I receive:

*   Trying X.X.X.X...
* Connected to thirdparty.url (X.X.X.X) port 443 (#0)
* found 1 certificates in ./nonprod.crt
* found 596 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* gnutls_handshake() failed: Handshake failed
* Closing connection 0
curl: (35) gnutls_handshake() failed: Handshake failed

How can I debug this issue?

Some info: I am running curl 7.47.0 on Ubuntu 16.04.4

I try running this command:

openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt  -key key.pem

BUT I have to exclude the link URI to make it work. The response does include this however:

140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40
140593823835800:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:656:

But it also says:

SSL handshake has read 3378 bytes and written 1702 bytes

New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID:
    Session-ID-ctx:
    Master-Key: CE2294E9B415FB8B9850DB28F64FEF17390A46D5A38F12E62E31F614DA4199CF50C0AFA5F62401C4964105AFC4F1B095
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1528299660
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
Patrick Mevzek
  • 3,130
  • 2
  • 20
  • 30
Cris Ravazzano
  • 21
  • 1
  • 4
  • You can try with `openssl s_client` it should give you more debug information. Do not forger the `-servername` parameter to enable TLS SNI proper negotiation – Patrick Mevzek Jun 06 '18 at 15:26
  • I am able to connect using this command: openssl s_client -connect server.url:443 -tls1_2 -cert ./mycert.crt -key key.pem - but I have to exclude the URI to make it work – Cris Ravazzano Jun 06 '18 at 15:33
  • 1
    Yes, `openssl` is purely a TLS client, not an HTTP one. To mimick curl, try adding `-alpn http/1.1` . If it then fails it means an error server-side (not supporting ALPN). If it still works you can try a very simple HTTP request: `echo -n "GET / HTTP/1.1\nHost: thirdparty.url\n\n\n" | openssl s_client ....` or just type the request when `s_client` started and until the connection remains open. – Patrick Mevzek Jun 06 '18 at 15:41
  • The openssl response includes 140593823835800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1487:SSL alert number 40 – Cris Ravazzano Jun 06 '18 at 15:48
  • Besides giving the hostname you connect to to let others test too, you can either try to capture the TLS handshake to see what is happening and/or using online tools like https://www.ssllabs.com/ssltest/ – Patrick Mevzek Jul 05 '18 at 17:44
  • Try also from another client/box. Also add `-servername` to `openssl s_client` to activate SNI. – Patrick Mevzek Jul 05 '18 at 17:45
  • alert number 40 is SSL3_AD_HANDSHAKE_FAILURE so just by itself it does say much. Watching the server reply from the ClientHello by sniffing the network may give more clues. – Patrick Mevzek Jul 05 '18 at 18:45
  • 1
    With `openssl s_client` try without the `tls1_2` and try the other selector on versions. – Patrick Mevzek Jul 05 '18 at 18:46

0 Answers0