While building a context through openssl, if I do not provide a certificate by using the function SSL_CTX_use_certificate, would all the connections from that context default to anonymous diffie-hellman? Or can there be another reason for that.

  • Not what you asked, but to be clear if you do want the server authenticated it must set both a private key and a matching cert or chain; the latter can be done with _use_certificate or several other API options. – dave_thompson_085 Mar 9 at 5:22

In order to use ADH (anonymous diffie-hellman) the relevant ciphers need to be enabled by both client and server. This is by default not the case for OpenSSL and for common clients (like browsers) and that's why ADH will not be used.

  • What if I do not set any certificate for the ctx, and let the cipher string be "ALL"? If the server and the client is to choose an AD which is not anonymous, how would the server verify its identity? – Haris Mar 8 at 16:37
  • @Haris: If both client and server have ADH enabled (which is included when using ciphers ALL on both sites providing that both sites use an OpenSSL stack) then no authentication is done at all and the connection is vulnerable to impersonation and active man in the middle attacks. That what the "anonymous" in "anonymous diffie hellman" means. – Steffen Ullrich Mar 8 at 16:54
  • Yes.. I think I wasnt clear with my question.. What I wanted to know is, even if both server and client has ALL as cipher string, they can still prefer to choose a AD with authentication. My query was, even if both server and client has ALL as cipher string, is there a reason for which the server might restrict to using only ADH? – Haris Mar 8 at 18:16
  • @Haris: I have no idea what "AD" stands for in your comment. If you mean anonymous diffie hellman than this is usually called ADH. But ADH does not have any authentication, because - like the name implies - it is anonymous (i.e. server does not proof its identity to the client). So there is no such thing like "ADH with authentication" – Steffen Ullrich Mar 8 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.