On 3/14/23 13:20, Eberhard wrote:
Actually I think the SSLv3 in the log is a lie–as this is also in the log just before the below:
TLS state (connect): before/connect initialization
TLS state (connect): SSLv3 write client hello A
TLS state (connect): SSLv3 read server hello A
So I am thinking the elipticcurve stuff is more likely the issue?
It's common to see an SSLv3 "hello" to be as compatible as possible. It's possible that common code paths that existed back to SSLv3 still log that way even when being used in a TLSvx.y handshake.
https://www.ssllabs.com/ssltest/analyze.html?d=ws.fedex.com
They only support a small set of cipher suites, which is good.
Qualys says you should be able to connect with TLSv1.2 with cipher suite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 which is supported by OpenSSL 1.0.2.
Are you able to connect with:
$ openssl s_client -connect ws.fedex.com:443
You may be required to provide a client-cert in order to connect. See the usage information for "s_client" to see how to do that.
-chris
*From:*Eberhard flash@vicsmba.com *Sent:*Tuesday, March 14, 2023 9:15 AM *To:*'stunnel-users@stunnel.org' stunnel-users@stunnel.org *Subject:*Help with disabling SSLv3 *Importance:*High
I am suddenly getting errors from Fedex:
TLS state (connect): SSLv3 read server certificate A
error queue: 1408D010: error:1408D010:SSL routines:ssl3_get_key_exchange:EC lib
error queue: 100AE081: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group
error queue: 100AF003: error:100AF003:elliptic curve routines:EC_GROUP_NEW_FROM_DATA:BN lib
SSL_connect: 3078072: error:03078072:bignum routines:BN_EXPAND_INTERNAL:bignum too long
My .conf file says:
output = /tmp/fedex.log
debug = 7
RNDfile = /visanet/ssl/stunnel.rnd
RNDoverwrite = yes
client = yes
connect = ws.fedex.com:443
;connect = gateway.fedex.com:443
;connect = wssha1ends12172016.fedex.com:443
sslVersion = TLSv1.2
options = NO_SSLv3
sslVersionMin = TLSv1.2
CAfile = /usr/local/ssl/certs/cacert.pem
It is a very old version of stunnel but I cannot upgrade as this is a 15 year old AIX (IBM) computer
stunnel 5.44 on powerpc-ibm-aix4.3.3.0 platform
Compiled/running with OpenSSL 1.0.2 22 Jan 2015
Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI
Invalid configuration file name "--version"
realpath: No such file or directory (2)
Yet the log implies I am still trying SSLv3.
Any ideas? Thanks in advance.
Eric
VICS, LLC
Eric S Eberhard
2933 W Middle Verde Rd
Camp Verde, AZ 86322
928-567-3727 (land line)
928-301-7537 (cell phone)
___http://www.vicsmba.com_http://www.vicsmba.com/
___https://www.facebook.com/groups/286143052248115_https://www.facebook.com/groups/286143052248115
stunnel-users mailing list -- stunnel-users@stunnel.org To unsubscribe send an email to stunnel-users-leave@stunnel.org