Following my troubleshooting of making a TLS connection (See: Testing TLS with openssl), it looks like there might be an active firewall in place.
The connection on that port works with nc on both sides (
nc -l -p 8883on the server,
nc server.com 8883on the client)
It even works if I manually send the binary preamble for making a TLS connection, but leave off the last byte (again, captured with
nc -l -p 8883 | xxd). I think I see a delay...
Just incase I also checked if the connection is just being forced closed at 289 bytes, so I sent a lot of random text and it went through fine.
Sending the full TLS preamble results in nothing received at the server, and the connection closed. I tried adding some delay before the last byte, it goes through and the connection stays open!
What the heck is this and how do I phrase my request to the company IT to allow it? (we have a special APN set up with AT&T and I think that's where it is)
Trouble shooting details:
I used nc -l -p 8883 to capture the TLS preamble from a successful connection attempt to the server from elsewhere (289 bytes)
0000000: 1603 0101 1c01 0001 1803 03f4 f363 0180 0000010: 3ce4 957f ee17 8b7f d8ef 9ce0 e608 1cac 0000020: d328 798d 8b10 cc7b b521 0.... ... 0000120: 01
Then here's the client command to reproduce it:
(head TLS1.hex -n18 | xxd -r; sleep 0.3; echo 0: 01 | xxd -r ) | nc server.com 8883 -q 1
- < 0.3s, fails
- = 0.3s fails intermittently
- > 0.3s, succeeds