[openssl-users] a problem connecting to a specific Site ...

[Jakob Bohm]

On 03/11/2018 08:56, Walter H. wrote:
> Hello,
>
> it is a little bitte weird/strange/complicated;
>
> On 02.11.2018 23:05, Matt Caswell wrote:
>> On 02/11/2018 21:51, Walter H. wrote:
>>> Hello,
>>>
>>> when I try to connect tohttps://www.3bg.at/
>>> I get the following error
>>>
>>> Handshake with SSL server failed: error:1408E0F4:SSL
>>> routines:SSL3_GET_MESSAGE:unexpected message
>>>
>>> but
>>> https://www.ssllabs.com/ssltest/analyze.html?d=www.3bg.at
>>> says its ok ...
>>>
>>> is the problem on my side or on their side?
>> You'll need to give us more information. I can connect to that server
>> using OpenSSL 1.0.2 s_client.
>>
>> What version of OpenSSL are you using? Is this with your own application
>> or from s_client? What ciphersuites have you configured? Any other
>> relevant configuration that we should know about?
>>
>>
> the mentioned error comes with squid - ssl-bump on;
> in case I switch it off and have it as normal proxy, then is really 
> suspisious:
> - an old Firefox (17.0.11esr) has no problems, the Sites is shown and 
> works
>
> - an older Google Chrome (the last one f. WinXP, v46) gives:
>                       SSL connection error
>                       ERR_SSL_PROTOCOL_ERROR
>
> - a fork of the latest Pale Moon (Mypal) and an old Palemoon itself 
> (the last one f. WinXP) gives:
>                     An error occurred during a connection to www.3bg.at.
>                     Peer’s certificate has an invalid signature.
>                     (Error code: SEC_ERROR_BAD_SIGNATURE)
>
> what is this strange?
>
> but what does this mean at the mentioned SSLlabs result:
>
> Certificate Transparency No
>
> when I compare to any other site (e.g. my own with Let's encrypt 
> certificate),
> I get
>
> Certificate Transparency *Yes (certificate)*
>
> is this caused on my side or on the other side?
>
>
Certificate Transparency means that the CA that issued the certificate
also published it using a Google-promoted protocol to provide
"Transparency" for the certificate issuing industry, at the cost of
customer privacy.

Chrome Browser now (or soon) punishes websites that whose certificate
was not published that way, making it a relevant test for web server
operators wanting to check that everything will work in all browsers.

Enjoy

Jakob
-- 
Jakob Bohm, CIO, Partner, WiseMo A/S.  https://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded