Long handshake intolerance (SSL/TLS) - Command Line

Question

How can one check Long handshake intolerance on terminal for a remote website?

If anyone knows a openssl command or without use of openssl please suggest!

Please do not suggest use of ssllabs.com.

Answer 1

Long handshake intolerance means that the server cannot handle ClientHello with more than 255 bytes (or in case of F5: more than 255 and less than 513 bytes). You can simulate such handshakes for example with openssl s_client by specifying an as much ciphers as needed as to reach this size. For example I get

$ openssl s_client -connect google.com:443 -servername google.com -cipher ALL -debug
CONNECTED(00000003)
write to 0xe1b9c0 [0xe1ba40] (354 bytes => 354 (0x162))
...

This means that the initial SSL record (i.e. the ClientHello) had a size of 354 bytes since lots of ciphers are included. This is clearly more than 255 bytes and if you get a successful connection to the server with this then long handshake intolerance is not a problem. If the connection fails it might be due to long handshake intolerance but might also have different reasons. In case of F5 the symptom was that the connection simply hung, i.e. no response from server but also no immediate close of the TCP connection.

Note that the actual size of the ClientHello differs depending on the server name (-servername argument) and the ciphers available in your version of OpenSSL and maybe some added extensions.