0

I'm facing a "Alert: handshake failure (40)" error when trying to establish a TLS connection. The error only happens when I run the same application on cloud, it works when I run the application on HPG8 server. OS is the same Redhat 7. By checking into the traces, I found that the cipher suite in "client hello" is much less in the error case than the worked case, and the cipher suite that TLS server supported is just missed in the "client hello" of the error case. I want to know what will impact the cipher suite that contains in the "client hello"?

The openssl version is the same (1.1.1d) for both cases, Redhat version has small difference. TLS1.2 is used. The key file and cert file are also the same.

In the code, I'm using SSL_set_cipher_list to set the cipher string as "ALL:!DH:!EXP:!RC4:@STRENGTH".

SSL_set_cipher_list(ssl, "ALL:!DH:!EXP:!RC4:@STRENGTH");

I also checked the source code of openssl, but didn't find much clue.

Cipher suite in the failure case:

Cipher Suites (25 suites)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 (0xc0af)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CCM (0xc0ad)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 (0xc05d)
    Cipher Suite: TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 (0xc061)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
    Cipher Suite: TLS_RSA_WITH_AES_256_CCM_8 (0xc0a1)
    Cipher Suite: TLS_RSA_WITH_AES_256_CCM (0xc09d)
    Cipher Suite: TLS_RSA_WITH_ARIA_256_GCM_SHA384 (0xc051)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x0084)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (0xc0ae)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CCM (0xc0ac)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 (0xc05c)
    Cipher Suite: TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 (0xc060)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
    Cipher Suite: TLS_RSA_WITH_AES_128_CCM_8 (0xc0a0)
    Cipher Suite: TLS_RSA_WITH_AES_128_CCM (0xc09c)
    Cipher Suite: TLS_RSA_WITH_ARIA_128_GCM_SHA256 (0xc050)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x0041)
    Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)

Cipher suite for successful case (0xc02f is the suite that server returned in "server hello"):

Cipher Suites (45 suites)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 (0xc0af)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CCM (0xc0ad)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 (0xc05d)
    Cipher Suite: TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 (0xc061)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 (0xc073)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 (0xc077)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
    Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
    Cipher Suite: TLS_RSA_WITH_AES_256_CCM_8 (0xc0a1)
    Cipher Suite: TLS_RSA_WITH_AES_256_CCM (0xc09d)
    Cipher Suite: TLS_RSA_WITH_ARIA_256_GCM_SHA384 (0xc051)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 (0x00c0)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x0084)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
    Cipher Suite: **TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256** (0xc02f)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (0xc0ae)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CCM (0xc0ac)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 (0xc05c)
    Cipher Suite: TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 (0xc060)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 (0xc072)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (0xc076)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
    Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
    Cipher Suite: TLS_RSA_WITH_AES_128_CCM_8 (0xc0a0)
    Cipher Suite: TLS_RSA_WITH_AES_128_CCM (0xc09c)
    Cipher Suite: TLS_RSA_WITH_ARIA_128_GCM_SHA256 (0xc050)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 (0x00ba)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
    Cipher Suite: TLS_RSA_WITH_SEED_CBC_SHA (0x0096)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x0041)
    Cipher Suite: TLS_RSA_WITH_IDEA_CBC_SHA (0x0007)
    Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)
5
  • 1
    So, that seems to indicate that the available suites on the client are different. – schroeder Apr 28 '20 at 7:48
  • Thanks. By "available suites", do you mean the suites listed by "openssl ciphers". Actually the result is the same on both platforms. – HarryH Apr 28 '20 at 8:46
  • Do you get different results running openssl ciphers with 'ALL:!DH:!EXP:!RC4:@STRENGTH' argument? Did you try openssl s_client instead of your program? Did you compare openssl.cnf? Does your openssl on the cloud use an engine, or some other way to customize it? Is the cloud server special in some way (e.g. ARM chip, crypto accelerator, etc)? Did you ask the cloud vendor's support? AES _CCM present, ARIA_GCM present, AES_GCM absent is weird. I would suspect someone patched openssl in a buggy way. – Z.T. Apr 28 '20 at 11:27
  • 1
    RHEL7 should have openssl 1.0.2, not openssl 1.1.1. I think you have openssl from a third party repo or even compiled on the machine. Verify your openssl (the libraries loaded by dynamic linker, not just the command line tool) is really from red hat. – Z.T. Apr 28 '20 at 11:31
0

This is expected behavior.

The TLS connection begins with a ClientHello, in which the client advertises to the server which cipher suites it supports. The server must then reply with a ServerHello, in which the server picks one of these cipher suites.

The server can either honor the priorities of the client and pick the cipher the client prioritizes the most, or the server can select the cipher that the server prioritizes the most. There are different schools of thought as to whether or not a server should honor a client's preference.

Supporters of the client cipher order state that the client knows best which ciphers will work well on their platform (e.g. which ciphers have efficient hardware implementations) and which ciphers don't work so well.

Supporters of the server cipher order state that clients should generally not be trusted, and clients would pick TLS_NULL_WITH_NULL_NULL for the great performance it offers.

5
  • Thanks. I know this is expected behavior. But I'm not clear that how the cipher suite is determined on different hardware? With all the other factors same. Is there any configuration file for that? From openssl, the available cipher suites are the same. – HarryH Apr 28 '20 at 8:30
  • The SSL/TLS library used on both platforms is configured differently, even if the underlying OS is the same. – MechMK1 Apr 28 '20 at 8:33
  • Do you mean the configuration of openssl? The product I'm working on is a big application and it is put in a archive zip and deployed on different hardware, so almost all the configuration is the same. Do you have any suggestion that what configuration I can check? Thanks. – HarryH Apr 28 '20 at 8:44
  • @HarryH That's a tricky question, depends on the exact library being used, etc.. I would recommend writing a MCVE and posting it on Stack Overflow – MechMK1 Apr 28 '20 at 8:46
  • Thanks, I will try to write a MCVE and test that. – HarryH Apr 28 '20 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.