1

Is it possible to use openSSL without encryption nor certificate? To test something, I want to connect without any PSK/certificate. Maybe just DH. I tried this:

server:

openssl s_server -cipher ECDHE-RSA-NULL-SHA -accept 44330 -www -nocert

client:

openssl s_client -connect 10.10.1.87:44330 -cipher ECDHE-RSA-NULL-SHA

Output:

CONNECTED(00000003)
4561129068:error:14004410:SSL routines:CONNECT_CR_SRVR_HELLO:sslv3 alert handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-47.11.1/libressl-2.8/ssl/ssl_pkt.c:1200:SSL alert number 40
4561129068:error:140040E5:SSL routines:CONNECT_CR_SRVR_HELLO:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-47.11.1/libressl-2.8/ssl/ssl_pkt.c:585:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Start Time: 1582716971
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

So the handshake failed (SSL alert number 40). What am I missing here (if it's possible)?

1
  • 1
    (Pre-1.3) keyexchange ECDHE_RSA means ECDHE authenticated by RSA. Authenticated by RSA means using RSA key-and-cert. Of course that doesn't work without the required key-and-cert. Feb 27, 2020 at 3:42

1 Answer 1

1

I changed the ciper to AECDH-NULL-SHA and now it's connecting.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .