1

When i use Openssl to connect to facebook.com I see 'ECDHE-ECDSA-AES128-GCM-SHA256' ciphersuite used.

openssl s_client -connect www.facebook.com:443

SSL handshake has read 3280 bytes and written 373 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES128-GCM-SHA256
Server public key is 256 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-ECDSA-AES128-GCM-SHA256
    Session-ID: 527DB47524E5CC01C398927C91F750E3AAF6BC94C87EFF97C37834B53F0C0BA9
    Session-ID-ctx:
    Master-Key: 044197ACB0895E7F6673C42BB6ADBD82EC9F63941F7AC063BE346B7B5CA33BFF1C49D91A254C008F66A95F46E947B303
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 172800 (seconds)

But when I use 'cipher' parameter of Openssl to use the same previous ciphersuite the SSL handshake fails. Why??

openssl s_client -cipher 'ECDHE-ECDSA-AES128-GCM-SHA256' -connect www.facebook.com:443
CONNECTED(00000003)
140375704602440:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:744:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 119 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---
  • 1
    Cutting and pasting your second command line, no changes, resulted in a working TLS connection for me. Maybe there are multiple load-balanced backends and they have differing cipher configurations? – gowenfawr Aug 26 at 13:24
  • Works for me with exactly the same command line you've specified. What version of OpenSSL are you using? – Steffen Ullrich Aug 26 at 16:27
  • @SteffenUllrich I tried the same command multiple times the output is same. openssl-1.0.1e-60.el7.x86_64 – Redhat Aug 27 at 4:30
  • 1
    @Redhat: It is likely a problem only with the old (and long unsupported version) of OpenSSL you are using. The version information should therefore better be part of your question which OpenSSL. – Steffen Ullrich Aug 27 at 4:36
  • @SteffenUllrich Both the working and nonworking scenario conditions are from same client.Its just that in the non working condition i am specifying the cipher suite manually. – Redhat Aug 27 at 4:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.