<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-forward-container"><br>
<br>
-------- Original Message --------
<table class="moz-email-headers-table" border="0" cellpadding="0"
cellspacing="0">
<tbody>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Subject:
</th>
<td>Re: [erlang-bugs] Incomplete Elliptic Curve Cipher
Suites in R16B01 and R16B02</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Date: </th>
<td>Mon, 07 Oct 2013 08:37:56 +0200</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">From: </th>
<td>Ingela Anderton Andin <a class="moz-txt-link-rfc2396E" href="mailto:ingela@erix.ericsson.se"><ingela@erix.ericsson.se></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">To: </th>
<td>Andrew Thompson <a class="moz-txt-link-rfc2396E" href="mailto:andrew@hijacked.us"><andrew@hijacked.us></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<pre>On 10/04/2013 08:49 PM, Andrew Thompson wrote:
> I'm not sure openssl s_client supports TLS 1.2.
Not by default only if you configure it to! (-tls1_2)
Regards Ingela Erlang/OTP team - Ericsson AB
> If you look at the
> errors the s_client spits out (by removing the dev null redirection) I
> get:
>
> 139688779572880:error:1407742F:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1
> alert insufficient security:s23_clnt.c:741:
>
> exactly as many times as I get 'work not' from the output. As I
> understand it, this means the server is asking for a ciphersuites that
> the client does not support.
>
> Apparently gnutls-cli supports tls 1.2, although I can't get gnutls to
> connect to the erl_ssl_test server under R16B02, it only reports
>
> GnuTLS error: An illegal TLS extension was received.
>
> When I try to do:
>
> gnutls-cli -p 5555 localhost --x509cafile=priv/ssl/ca.crt
>
> This does work if I run the server under R15B02.
>
> I have gnutls 3.2.4, the latest stable release. If you run
> gnutls-cli-debug against the server, you get this:
>
> Checking for TLS 1.0 support... no
> Checking for TLS 1.1 support... no
> Checking fallback from TLS 1.1 to... failed
> Checking for TLS 1.2 support... no
> Checking whether we need to disable TLS 1.2... yes
> Checking whether we need to disable TLS 1.1... no
> Checking whether we need to disable TLS 1.0... no
> Checking for Safe renegotiation support... no
>
> So gnutls doesn't think R16B02 supports tlsv2.
>
> Same output when running under R15B02 (which is what I had handy):
>
> Checking for TLS 1.0 support... yes
> Checking for TLS 1.1 support... no
> Checking fallback from TLS 1.1 to... TLS 1.0
> Checking for TLS 1.2 support... no
> Checking whether we need to disable TLS 1.2... no
> Checking whether we need to disable TLS 1.1... no
> Checking whether we need to disable TLS 1.0... N/A
>
> Andrew
> _______________________________________________
> erlang-bugs mailing list
> <a class="moz-txt-link-abbreviated" href="mailto:erlang-bugs@erlang.org">erlang-bugs@erlang.org</a>
> <a class="moz-txt-link-freetext" href="http://erlang.org/mailman/listinfo/erlang-bugs">http://erlang.org/mailman/listinfo/erlang-bugs</a>
>
</pre>
<br>
</div>
<br>
</body>
</html>