SSL_connect:error in SSLv3/TLS write client hello → write:errno=0

2019-04-12 Thread Harri T.
Hi! I'm trying to get LDAP STARTTLS working. What does "SSL_connect:error in SSLv3/TLS write client hello → write:errno=0" mean? Harri root@ldap2:~# echo | openssl s_client -connect ldap2.mydomain.com:389 -showcerts -state -CAfile /etc/ssl/certs/ldap2_cacert.pem CONNECTED(0003) SSL_connec

Re: How to disable tls 1.0 and tls 1.1

2019-04-12 Thread Matt Caswell
On 12/04/2019 15:50, Chethan Kumar wrote: > Thank to both Hubert Kario and Matt Caswell for your valuable information. > This group has helped a lot in gaining many insights on openssl for newbie > like me. > > I was wrong with my understanding. > But i executed below command to communicate w

RE: How to disable tls 1.0 and tls 1.1

2019-04-12 Thread Chethan Kumar
Thank to both Hubert Kario and Matt Caswell for your valuable information. This group has helped a lot in gaining many insights on openssl for newbie like me. I was wrong with my understanding. But i executed below command to communicate with TLS1.2 when only TLS1.0 and 1.1 was disabled, Even i

Re: How to disable tls 1.0 and tls 1.1

2019-04-12 Thread Matt Caswell
On 12/04/2019 14:37, Chethan Kumar wrote: >> Please note that curl developers have recently changed the meaning of those >> options, please check if they do what you expect them to do by inspecting >> the curl man page. > Thanks for the information. I understood it. > I also used openssl s_cli

Re: How to disable tls 1.0 and tls 1.1

2019-04-12 Thread Hubert Kario
On Friday, 12 April 2019 15:37:37 CEST Chethan Kumar wrote: > >Please note that curl developers have recently changed the meaning of those > >options, please check if they do what you expect them to do by inspecting > >the curl man page. > Thanks for the information. I understood it. > I also used

RE: How to disable tls 1.0 and tls 1.1

2019-04-12 Thread Chethan Kumar
>Please note that curl developers have recently changed the meaning of those >options, please check if they do what you expect them to do by inspecting the >curl man page. Thanks for the information. I understood it. I also used openssl s_client to communicate with server using below command. ope

Re: Tests fail on openssl 1.1.1b Windows 7 built with VS 2013

2019-04-12 Thread Matt Caswell
On 11/04/2019 17:43, John Unsworth wrote: > Attached. This is with the debug build. Hmmm, this seems to suggest failures in SHA3 and X448 code. Perhaps assembler issues? Try compiling with "no-asm" as a Configure option. That's not really a viable option for production code but it at least rul

Re: How to disable tls 1.0 and tls 1.1

2019-04-12 Thread Hubert Kario
On Friday, 12 April 2019 13:54:24 CEST Chethan Kumar wrote: > >what evidence you have that what you do is ineffective? > > I tried connecting to some host by executing curl command with --tlsv1.1 and > --tlsv1.0 options and am able to connect successfully. Please note that curl developers have re

RE: How to disable tls 1.0 and tls 1.1

2019-04-12 Thread Chethan Kumar
>what evidence you have that what you do is ineffective? I tried connecting to some host by executing curl command with --tlsv1.1 and --tlsv1.0 options and am able to connect successfully. >why you're not using? >./config no-tls1 no-tls1_1 I have used these options in Makefile but still communica

Re: How to disable tls 1.0 and tls 1.1

2019-04-12 Thread Hubert Kario
On Friday, 12 April 2019 06:47:54 CEST Chethan Kumar wrote: > > there is no "min" version in Client Hello, the version in record layer is > > irrelevant and used only for backwards compatibility *NOT* for > > negotiation > Thank you for the information. But have a doubt, then what is the importance