1

I have a requirement to use the cipher suite: DHE-RSA-AES256-GCM-SHA384 I configured to use the required cipher suite on both server and client. During tests, I noticed that the handshake is failing between server and client.

On server I reset the configuration to accept any cipher suite, but on the client I retained the cipher suite string as per the requirement. Even now the handshake fails.

I took tcpdump and analyzed using wireshark. I noticed that client is sending the cipher suite string, but server is not accepting and hence handshake fails and connection is not established.

As per openssl documentation for the cipher suite: DHE-RSA-AES256-GCM-SHA384, Kx is DH and Au is RSA. Hence for authentication purposes I created a certificate with RSA key (AES encryption and SHA2 hashing)

What am I missing here. Could you please help.

I followed the steps mentioned in this link OpenSSL generate different types of self signed certificate In this case the certificate itself is not read. In logs I see the following errors SSL routines:SSL_SET_CERT:unknown certificate type. SSL server certificate not found, or password is wrong - SSL ports will not be opened

I am trying to establish secure connection between two splunk instances. Both are installed on linux.

Could you please let me know where am i going wrong and what is the right way to get the DH key exchange with the certificates.

Thanks Strive

6
  • >>I created a certificate with RSA key (AES encryption and SHA2 hashing)<< AES? Are you talking about the private key? May 7, 2015 at 20:38
  • Yes.. Private key..
    – Strive
    May 8, 2015 at 3:52
  • Test 1: Did not create any dhparam. Just created certificates and configured splunk servers to use the certificate and ciphersuite string DHE-RSA-AES256-GCM-SHA384 Test 1 result fails: Client log says handshake failure. Server log says no shared cipher.
    – Strive
    May 8, 2015 at 4:10
  • Test 2: Created dhparam. Created CSR. Forced dhparam key while creating certificate as mentioned in the link security.stackexchange.com/questions/44251/… Test 2 result fails with following errors during server start Error: SSL_SET_CERT:unknown certificate type. Error: SSL server certificate not found, or password is wrong - SSL ports will not be opened
    – Strive
    May 8, 2015 at 4:11
  • 1
    For DHE-RSA OpenSSL server needs an RSA privatekey and cert for it (with chain if applicable), and also temp DH parameters not in any cert. Although with PEM format, you can put all or several of them in the same file, which Apache does to confuse matters, but Apache also defaults temp-DH, so you wouldn't even have asked the question. Whatever you are using, it should call, or you should configure it to call, SSL_[CTX_]set_tmp_dh[_callback] to set the DH params statically or dynamically as you wish. May 8, 2015 at 5:57

0

Browse other questions tagged .