In EAP-TLS method of authentication if a server sends Change Cipher Spec message to the client, I couldn't find references to SSL3_ST_CR_CHANGE_A. The enum is defined for SSL3_ST_CR_CHANGE_A in ssl3.h, but I looked at OpenSSL's source code: s3_clnt.c:ssl3_connect(), and I don't see any case that handles it.

The openssl version which I am using is openssl-1.0.1e, does any other version supports this.


The change_cipher_spec message is not a handshake message; it has its own special record type. It is handled in s3_pkt.c:ssl3_read_bytes().

OpenSSL handles the handshake as a state machine; the state variable contains the current status. Whenever a handshake message is received, the status changes. The change_cipher_spec message, being always small (its length is 1 byte, exactly), is handled on-the-fly just like an alert message. When received, it does not change the state variable, but instead sets the change_cipher_spec field to 1. When a change_cipher_spec is expected, the next message should be a Finished, and the code processing the Finished message checks the change_cipher_spec field.

  • Thanks for the response, Actually i did not get any log saying that it has processed the change spec thats took me confusion. – Anbazhakan Anbu Nov 11 '14 at 6:54
  • Once the expected finish processed i received another client_hello_requset in the same handshake as a encrypted message, and openssl able to decrypt it and it is wrting client_hello into the buffer, but i am getting zero bytes from BIO_read and getting error saying that "Failed to read possible Application Data error:00000000:lib(0):func(0):reason(0)" the ultimate issue which i am seeing is that once if it received finish then BIO_read simply return zero. what could be the issue ? – Anbazhakan Anbu Nov 11 '14 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.