<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hi!<br>
<br>
On 10/04/2013 09:55 PM, Andrew Thompson wrote:<br>
</div>
<blockquote cite="mid:20131004195539.GH9818@hijacked.us" type="cite">
<pre wrap="">If I use
gnutls-serv -p 5555 --x509keyfile=priv/ssl/server.key
--x509certfile=priv/ssl/server.crt --x509cafile=priv/ssl/ca.crt
and connect with:
gnutls-cli -VVVVV -p 5555 localhost --x509cafile=priv/ssl/ca.crt
I'm able to successfully negotiate a TLS 1.2 connection. Wireshark shows
significant differences in the Server Hello that Erlang sends vs the one
gnutls sends. I am able to get chrome to do a 1.2 handshake with the
gnutls server using ---http to make gnutls-serv run as a https server.
The main differences that I see in what erlang is doing vs gnutls:
Erlang sends the elliptic_curves extension as part of the server hello,
gnutls does not. The gnutls *client* does send this extension, however.
According to RFC 4492:
<a class="moz-txt-link-freetext" href="http://tools.ietf.org/html/rfc4492#section-5.1">http://tools.ietf.org/html/rfc4492#section-5.1</a>
The elliptic_curves extension is a *client* hello extension and the RFC
doesn't seem to mention the server sending it.
</pre>
</blockquote>
Section 5.2<br>
<pre class="newpage"> "This section specifies a TLS extension that can be included with the
ServerHello message as described in [<a href="http://tools.ietf.org/html/rfc4492#ref-4" title=""Transport Layer Security (TLS) Extensions"">4</a>], the Supported Point Formats
Extension.
When this extension is sent:
The Supported Point Formats Extension is included in a ServerHello
message in response to a ClientHello message containing the Supported
Point Formats Extension when negotiating an ECC cipher suite."</pre>
<br>
Regards Ingela Erlang/OTP team Ericsson AB<br>
</body>
</html>