5

I am using openssl example server and client with specific cipher in ubuntu 14.10 pc. The openssl version is 1.0.1.

When I use the RC4-SHA cipher in both sides, the connection is established successfully. However, when I use ECDH-RSA-AES128-SHA or some other elliptic curve cipher, I get the following error:

3074328252:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:762:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 163 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

Is there some specific reason why this happens?

Thanks!

9

That's because you are trying to use an ECDH cipher suite, and not and ECDHE cipher suite.

  • ECDHE-RSA: the server's certificate contains an RSA public key; the server generates on-the-fly a new elliptic curve Diffie-Hellman key pair, and signs the public part, that the server sends to the client.
  • ECDH-RSA: the server's certificate already contains an elliptic curve Diffie-Hellman public key; it is not generated on-the-fly; the Certificate Authority that issued (signed) the server's certificate used RSA.

Since your server's certificate contains a RSA key, you cannot use any "ECDH" cipher suite, only "ECHDE" cipher suites. (And that's fine ! ECDHE cipher suites actually provide Forward Secrecy, which is a good thing to have, and ECDH cipher suites don't do that.)

  • @Tom Leek do you know how to generate the certificate for the latter case (ECDH-RSA). Hours of search has not helped. To summarize, I want to generate the fixed DH certificate, where I can embed the DH public key into an RSA cert. Much thanks! – sandyp Jun 19 '15 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.