0

What is the response from the server below?

# openssl s_client -msg -connect [REDACTED].mariadb.database.azure.com:3306
CONNECTED(00000003)
>>> ??? [length 0005]
    16 03 01 00 ab
>>> TLS 1.2Handshake [length 00ab], ClientHello
    01 00 00 a7 03 03 d5 ad 08 ff bb 5d be 2e 74 f1
    a9 84 1f 2c 2e a3 76 20 48 d7 a7 9f 97 05 90 d8
    65 3c 5b cc 9a df 00 00 38 c0 2c c0 30 00 9f cc
    a9 cc a8 cc aa c0 2b c0 2f 00 9e c0 24 c0 28 00
    6b c0 23 c0 27 00 67 c0 0a c0 14 00 39 c0 09 c0
    13 00 33 00 9d 00 9c 00 3d 00 3c 00 35 00 2f 00
    ff 01 00 00 46 00 0b 00 04 03 00 01 02 00 0a 00
    0a 00 08 00 1d 00 17 00 19 00 18 00 23 00 00 00
    16 00 00 00 17 00 00 00 0d 00 20 00 1e 06 01 06
    02 06 03 05 01 05 02 05 03 04 01 04 02 04 03 03
    01 03 02 03 03 02 01 02 02 02 03
<<< ??? [length 0005]
    4c 00 00 00 0a
140683495883200:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:252:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 176 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1556977235
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

Based on the first byte (the content byte) of this response, it is not any valid record type:

0x14    20  ChangeCipherSpec
0x15    21  Alert
0x16    22  Handshake
0x17    23  Application
0x18    24  Heartbeat 

Oddly, when I connect to this database via MySQL Workbench, it works, but connecting through DBeaver or OpenSSL fails as seen below.

I have checked if this is normal by using a different endpoint entirely, and these five-byte items appear, one for each record, but they all follow the expected content type codes.

5

It looks like you are trying to use TLS against a mysql/mariadb database by directly starting with the TLS handshake. Only, the mysql application protocol does not work this way. There is first some protocol exchange and only if this exchange shows that TLS is supported it will be used. This is similar to SMTP+STARTTLS, FTP+AUTH_TLS etc ... Thus, what you see as response from the server is not TLS but the mysql application protocol.

For details of this protocol see the documentation of the protocol.

  • You're brilliant! I looked through the documentation, and I found a sample of a handshake that starts with 36 00 00 00 0a. It looks very similar, though now I am confused at what that first byte means for the MariaDB protocol, because it looks like it is supposed to be 0A (protocol version 10) from what I read in the documentation. Anyway, thank you! – Jonathan Wilbur May 4 at 16:47
  • Oh, nevermind, I just figured it out shortly after commenting! – Jonathan Wilbur May 4 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.