[v4] SSL Handshake Issue
Added by Jeremy Brisko over 6 years ago
Hey Guys
Great work on the library. Finally got my application upgraded and am just going through testing and upgrading functionality. When I try an access my application over SSL I get a ERR_CONNECTION_CLOSED and in my application log I get SSL handshake error: no shared cipher. I have built wt with SSL support. Where would you start to diagnose this issue. With the same setup it worked great in v3. How can I tell what ciphers are being offered?
Thanks!
Replies (4)
RE: [v4] SSL Handshake Issue - Added by Jeremy Brisko over 6 years ago
Hey Guys
Sorry to be a pain, in my testing it seems that there are no ciphers being offered to handshake with. Any ideas where I can start on this one? I am compiling agains OpenSSL 1.0.2l on Mac OS X High Sierra. Worked great in v3, but v4 doesn't handshake.
Thanks
RE: [v4] SSL Handshake Issue - Added by Wim Dumon over 6 years ago
Hey Jeremy,
Really weird. We don't really do much with cyphers: either we use whatever OpenSSL does by default, or we pass the value specified on the command line verbatim to OpenSSL. Do you specify a cypher list on the command line or do you use OpenSSL's default?
Best regards,
Wim.
RE: [v4] SSL Handshake Issue - Added by Jeremy Brisko over 6 years ago
Wim,
Thanks for the information. I have tried both methods of using the default as well as passing a cipher list, I get the same result on both. I thought it may be an issue with my certificate after doing some research, so I installed nginx and proxied using my same certificate files and this method works fine, however I would really like to get the wthttp server working stand-alone. Do you know which versions of OpenSSL WT4 has been tested with?
Thanks!
Jeremy
RE: [v4] SSL Handshake Issue - Added by Ray . over 4 years ago
I think I have narrowed this down to line 207 in src/http/Server.C:
if (!config_.httpsAddress().empty() && config_.parentPort() == -1) {
This forces the use of:
--https-address
--https-port
rather than the newer
--https-listen
After changing the command line arguments to match, the 'no shared cipher' message goes away and successful ssl connections are made.