I'm using the RSA BSAFE Crypto-J 6.2 JCE provider in Java as SSL/TLS server (in FIPS 140 Compliant Mode for SunJSSE).
It seems like at least Chrome and Firefox cannot establish a connection if
0xc02b) is used.
The error in Firefox when connecting to the server is: "
With the error message as hint I looked into the handshake (using Wireshark). In the "Client Hello" I see 3 curves:
Elliptic curve: secp256r1 (0x0017) Elliptic curve: secp384r1 (0x0018) Elliptic curve: secp521r1 (0x0019)
In the corresponding "Server Hello" message I see the named curve value
Named Curve: Unknown (0xffff)
As a result the browser terminates the connection with the above mentioned error message.
If I use standard Java on the server side (no BSAFE Crypto-J provider) the named curve in the "Server Hello" is:
Named Curve: secp256r1 (0x0017)
... and the handshake finishes successfully.
- The question now is, what is the meaning if
0xffff? Does it mean that the server does not understand the set of curves suggested by the client? I looked into section 5.1.1 of RFC4492 but I couldn't find anything about the value of
- If someone has experience with RSA BSAFE Crypto-J and Java running in FIPS mode. Anybody else who ran into that problem and found a solution.