1

Is it possible to use openSSL without encryption nor certificate? To test something, I want to connect without any PSK/certificate. Maybe just DH. I tried this:

server:

openssl s_server -cipher ECDHE-RSA-NULL-SHA -accept 44330 -www -nocert

client:

openssl s_client -connect 10.10.1.87:44330 -cipher ECDHE-RSA-NULL-SHA

Output:

CONNECTED(00000003)
4561129068:error:14004410:SSL routines:CONNECT_CR_SRVR_HELLO:sslv3 alert handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-47.11.1/libressl-2.8/ssl/ssl_pkt.c:1200:SSL alert number 40
4561129068:error:140040E5:SSL routines:CONNECT_CR_SRVR_HELLO:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-47.11.1/libressl-2.8/ssl/ssl_pkt.c:585:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Start Time: 1582716971
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

So the handshake failed (SSL alert number 40). What am I missing here (if it's possible)?

1
  • 1
    (Pre-1.3) keyexchange ECDHE_RSA means ECDHE authenticated by RSA. Authenticated by RSA means using RSA key-and-cert. Of course that doesn't work without the required key-and-cert. Feb 27 '20 at 3:42
1

I changed the ciper to AECDH-NULL-SHA and now it's connecting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.