0

Server side :
I have created the secure SSL server using openssl command with no certificate to verify using cipher suite PSK-NULL-SHA256 with preshared key "AD" with dummy key and PSK identity as given below which results in server is created and waiting for client to connect with.

openssl.exe s_server -accept 4020 -cipher PSK-NULL-SHA256 -psk AD -psk_hint testing.domain.0106 -nocert tls1_2**
Using default temp DH parameters
ACCEPT

Client side :
Below command is given in client to connect with using same cipher and port mentioned in server but ends up with the error mentioned below .

openssl.exe s_client -connect 127.0.0.1:4020 -psk AD -psk_identity domain.0010 -tls1_2

Error in client side :

CONNECTED(00000004) <br/>
25769803792:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake <br/>failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40<br/>
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 246 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)<br/>
Secure Renegotiation IS NOT supported<br/>
Compression: NONE<br/>
Expansion: NONE<br/>
No ALPN negotiated<br/>
SSL-Session:<br/>
    Protocol  : TLSv1.2<br/>
    Cipher    : 0000<br/>
    Session-ID:<br/>
    Session-ID-ctx:<br/>
    Master-Key:<br/>
    PSK identity: None<br/>
    PSK identity hint: None<br/>
    SRP username: None<br/>
    Start Time: 1592417575<br/>
    Timeout   : 7200 (sec)<br/>
    Verify return code: 0 (ok)<br/>
    Extended master secret: no<br/>
---

Error in server side:

ERROR
25769803792:error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:ssl/statem/statem_srvr.c:2284:
shutting down SSL
CONNECTION CLOSED

Why is the connection being terminated with alert number 40? Can anyone please let me know the rationale behind it?

1
  • 1
    Have you googled "SSL alert number 40"? There are a bunch of solutions.
    – schroeder
    Jun 17, 2020 at 18:31

1 Answer 1

3

You can look up TLS magic numbers on the TLS parameter registry, including alerts. 40 is “handshake failure”, which doesn't tell you much.

The reason for the handshake failure is clearly indicated in the server output: “no shared cipher”.

Below command is given in client to connect with using same cipher and port mentioned in server

Well, no. You did not specify a cipher suite.

By default, OpenSSL does not allow insecure cipher suites such as cipher suites without encryption (…-NULL-…). See the ciphers man page (linked from the s_client and s_server man pages). You have to enable them explicitly with a -cipher option, e.g.

openssl.exe s_client -connect 127.0.0.1:4020 -psk AD -psk_identity domain.0010 -tls1_2 -cipher eNULL
2
  • I have tried to include -cipher eNULL in client side as you suggested but i end up in getting error - "NO CIPHERS AVAILABLE" . Error message is attached below 25769803792:error:141A90B5:SSL routines:ssl_cipher_list_to_bytes:no ciphers available:ssl/statem/statem_clnt.c:3795:No ciphers enabled for max supported SSL/TLS version --- no peer certificate available
    – danny
    Jun 18, 2020 at 2:23
  • 'SO-stop being - I could not able to make it even with "cipher eNULL" command . Does it worked for you
    – danny
    Jun 23, 2020 at 3:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .