<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal">
<p dir="auto">As a sanity check, are you using an ECDSA certificate on your Tomcat server? ECDHE-ECDSA-AES256-GCM-SHA384 can’t be negotiated without one. Perhaps you can try <br>
<code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">openssl s_client -connect a.b.c.d:<port> -msg -debug -cipher “ECDHE-RSA-AES256-GCM-SHA384”</code> if you’re using an RSA cert.</p>
<p dir="auto">-Steven</p>
<p dir="auto">On 3 Jun 2017, at 22:01, Pravesh Rai wrote:</p>
<p dir="auto"></p></div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">Hi,<br>
<br>
Even though I've disabled SSLvX protocols on both - client (openssl-1.0.2k)<br>
& server (Java 1.8 with Tomcat), still getting following handshake error,<br>
while executing:<br>
<br>
"openssl s_client -connect a.b.c.d:<port> -msg -debug -cipher<br>
ECDHE-ECDSA-AES256-GCM-SHA384"<br>
<br>
<br>
...<br>
read from 0x213f50 [0x21c410] (7 bytes => 7 (0x7))<br>
0000 - 15 03 03 00 02 02 28 ......(<br>
<<< TLS 1.2 [length 0005]<br>
15 03 03 00 02<br>
<<< TLS 1.2 Alert [length 0002], fatal handshake_failure<br>
02 28<br>
14756:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert<br>
handshake failure:.\ssl\s23_clnt.c:769:<br>
...<br>
<br>
And, such error happens, only when ECDHE ciphers are selected during the<br>
connection.<br>
<br>
Any clue on this?<br>
<br>
Thanks,<br>
PR<br>
-- <br>
openssl-users mailing list<br>
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" style="color:#777">https://mta.openssl.org/mailman/listinfo/openssl-users</a></p>
</blockquote></div>
<div style="white-space:normal">
</div>
</div>
</body>
</html>