[erlang-questions] Different SSL behaviours, how to pick ciphers?

[André Cruz]

On 13 Jul 2016, at 17:02, Fred Hebert <mononcqc@REDACTED> wrote:
> 
> On 07/13, André Cruz wrote:
>> 
>> It's strange to change this default in a minor version upgrade. Is this something that can be configured? I've found that some SSL servers drop the connection immediately when SSL records are used.
>> 
> 
> The `versions' tuple should specify the versions in order if you have them configured for your socket. The `honor_cipher_order` thing lets the server force the order you gave as the order to honor for ciphers.

The problem was that since Erlang 18.3.2 the "signature_algorithms" extension is only sent if the supported ssl versions is just 'tlsv1.2'. Since the default is tls 1 though 1.2, this extension is not sent and some servers require it. It's strange that I'm the only one with this problem...

Anyway, the solution in this case was to specify {versions, ['tlsv1.2']}, but if you need to support other tls versions you may need to manually fill the "signature_algs" option.

Best regards,
André Cruz