<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Lucida Console" size="2"><span style="font-size:9pt;">
<div>--- Reformatted and resent ---</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>I am encountering curl-7.44.0+openssl-1.0.2d (FIPS-capable) TLS session-initialization failures like ...</div>
<div> </div>
<div>* TLSv1.2 (OUT), TLS header, Certificate Status (22):</div>
<div>* TLSv1.2 (OUT), TLS handshake, Client hello (1):</div>
<div>* error:14077102:SSL routines:SSL23_GET_SERVER_HELLO:unsupported protocol</div>
<div> </div>
<div>on only ONE (HOSTX) of two 2008 R2 IIS 7.5 HTTPS servers (HOSTX, ROOM40) which are supposed to be configured the same. </div>
<div> </div>
<div>I am using</div>
<div> </div>
<div> OpenSSL 1.0.2d-fips 9 Jul 2015</div>
<div> </div>
<div> curl 7.44.0 (i386-pc-win32) libcurl/7.44.0 OpenSSL/1.0.2d</div>
<div> Protocols: dict file ftp ftps gopher http https imap imaps ldap pop3 pop3s </div>
<div> rtsp smb smbs smtp smtps telnet tftp</div>
<div> Features: AsynchDNS Largefile NTLM SSL</div>
<div> </div>
<div>ROOM40 and HOSTX servers run IIS 7.5 or IIS 8.0, and, the values of the keys (SSL 2.0 - TLS 1.2, Client and Server) in the registry branch </div>
<div> </div>
<div> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols</div>
<div> </div>
<div>are the same (see following). All the OTHER ..\Protocols keys - Ciphers, CipherSuites, Hashes, and KeyExchangeAlgorithms - are the same (all blank). </div>
<div> </div>
<div> SSL 2.0</div>
<div> Client </div>
<div> "DisabledByDefault"=dword:00000001</div>
<div> "Enabled"=dword:00000000</div>
<div> Server</div>
<div> <empty></div>
<div> SSL 3.0 </div>
<div> Client </div>
<div> "Enabled"=dword:00000000</div>
<div> Server </div>
<div> "Enabled"=dword:00000000</div>
<div> TLS 1.0 (Does not exist on HOSTX) </div>
<div> Client</div>
<div> <empty></div>
<div> Server</div>
<div> <empty></div>
<div> TLS 1.1 </div>
<div> Client </div>
<div> "DisabledByDefault"=dword:00000000</div>
<div> "Enabled"=dword:00000001</div>
<div> Server </div>
<div> "DisabledByDefault"=dword:00000000</div>
<div> "Enabled"=dword:00000001</div>
<div> TLS 1.2 </div>
<div> Client</div>
<div> "Enabled"=dword:00000001</div>
<div> Server</div>
<div> "Enabled"=dword:00000001</div>
<div> </div>
<div>I’ve researched “TLS version intolerance”, SNI, ALPN and more, but, haven’t figured this out yet. </div>
<div>Following are four curl-7.44.0+openssl-1.0.2d (FIPS- capable) attempts to “upload” a file. The 1st attempt to server ROOM40 succeeds, but the subsequent three attempts to server HOSTX all fail.</div>
<div>Any hints or insights are very much appreciated ... </div>
<div> </div>
<div>Note: The following output has been been edited to enhance readability and disguise client and servers.</div>
<div> </div>
<div>===============================================================================</div>
<div> </div>
<div>==> openssl version</div>
<div>OpenSSL 1.0.2d-fips 9 Jul 2015</div>
<div> </div>
<div>==> curl --version</div>
<div>curl 7.44.0 (i386-pc-win32) libcurl/7.44.0 OpenSSL/1.0.2d</div>
<div>Protocols: dict file ftp ftps gopher http https imap imaps ldap pop3 pop3s </div>
<div>rtsp smb smbs smtp smtps telnet tftp</div>
<div>Features: AsynchDNS Largefile NTLM SSL</div>
<div> </div>
<div>==> REM -----------------------------------------------------------------------</div>
<div>==> REM ATTEMPT TO UPLOAD TO ROOM40 (Successful)</div>
<div>==> REM -----------------------------------------------------------------------</div>
<div> </div>
<div>==> %CD%\curl.exe </div>
<div>--verbose -T "stuff.dat" </div>
<div>--tlsv1.2 </div>
<div>--ciphers AES128-SHA256:AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DES-CBC3-SHA</div>
<div>--capath ..\certs </div>
<div>--user matahari:18761917 <a href="https://ROOM40/datasink/">https://ROOM40/datasink/</a></div>
<div> </div>
<div>* Trying 10.11.51.37...</div>
<div>* Connected to ROOM40 (10.11. 51.37) port 443 (#0)</div>
<div>* ALPN, offering http/1.1</div>
<div>* Cipher selection: AES128-SHA256:AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DES-CBC3-SHA</div>
<div>* successfully set certificate verify locations:</div>
<div>* CAfile: none</div>
<div> CApath: ..\certs</div>
<div>* TLSv1.2 (OUT), TLS header, Certificate Status (22):</div>
<div>* TLSv1.2 (OUT), TLS handshake, Client hello (1):</div>
<div>* TLSv1.2 (IN), TLS handshake, Server hello (2):</div>
<div>* TLSv1.2 (IN), TLS handshake, Certificate (11):</div>
<div>* TLSv1.2 (IN), TLS handshake, Server key exchange (12):</div>
<div>* TLSv1.2 (IN), TLS handshake, Server finished (14):</div>
<div>* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):</div>
<div>* TLSv1.2 (OUT), TLS change cipher, Client hello (1):</div>
<div>* TLSv1.2 (OUT), TLS handshake, Finished (20):</div>
<div>* TLSv1.2 (IN), TLS change cipher, Client hello (1):</div>
<div>* TLSv1.2 (IN), TLS handshake, Finished (20):</div>
<div>* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-SHA256</div>
<div>* ALPN, server did not agree to a protocol</div>
<div>* Server certificate:</div>
<div>* subject: C=US; ST=CA; L=Los Angeles; O=CID; OU=LA DEV; CN=ROOM40</div>
<div>* start date: 2014-05-01 15:44:59 GMT</div>
<div>* expire date: 2018-02-05 22:10:46 GMT</div>
<div>* common name: ROOM40 (matched)</div>
<div>* issuer: CN=DISRAELI</div>
<div>* SSL certificate verify ok.</div>
<div>* Server auth using Basic with user 'matahari'</div>
<div>> PUT /datasink/stuff.dat HTTP/1.1</div>
<div>> Host: ROOM40</div>
<div>> Authorization: Basic ZnRwd2FsbDoxMzRGa3JlVDk1andfMlE=</div>
<div>> User-Agent: curl/7.44.0</div>
<div>> Accept: */*</div>
<div>> Content-Length: 161</div>
<div>> Expect: 100-continue</div>
<div>></div>
<div>< HTTP/1.1 100 Continue</div>
<div>* We are completely uploaded and fine</div>
<div>< HTTP/1.1 201 Created</div>
<div>< Location: <a href="http://ROOM40/datasink/stuff.dat">http://ROOM40/datasink/stuff.dat</a></div>
<div>< Server: Microsoft-IIS/7.5</div>
<div>< X-Powered-By: ASP.NET</div>
<div>< Date: Thu, 04 Aug 2016 01:31:09 GMT</div>
<div>< Content-Length: 0</div>
<div><</div>
<div>* Connection #0 to host ROOM40 left intact</div>
<div> </div>
<div>==> REM -----------------------------------------------------------------------</div>
<div>==> REM ATTEMPT #1 TO UPLOAD TO HOSTX (Fails)</div>
<div>==> REM -----------------------------------------------------------------------</div>
<div> </div>
<div>==> %CD%\curl.exe </div>
<div>--verbose -T "stuff.dat" </div>
<div>--tlsv1.2 </div>
<div>--ciphers AES128-SHA256:AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DES-CBC3-SHA</div>
<div>--capath ..\certs</div>
<div>--user TELawrence:18881935 <a href="https://hostx.area51.gov/upload/">https://hostx.area51.gov/upload/</a></div>
<div>* Trying 211.3.150.21...</div>
<div>* Connected to hostx.area51.gov (211.3.150.21) port 443 (#0)</div>
<div>* ALPN, offering http/1.1</div>
<div>* Cipher selection: AES128-SHA256:AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DES-CBC3-SHA</div>
<div>* successfully set certificate verify locations:</div>
<div>* CAfile: none</div>
<div> CApath: ..\certs</div>
<div>* TLSv1.2 (OUT), TLS header, Certificate Status (22):</div>
<div>* TLSv1.2 (OUT), TLS handshake, Client hello (1):</div>
<div>* error:14077102:SSL routines:SSL23_GET_SERVER_HELLO:unsupported protocol</div>
<div>* Closing connection 0</div>
<div>curl: (35) error:14077102:SSL routines:SSL23_GET_SERVER_HELLO:unsupported protocol</div>
<div> </div>
<div>==> REM -----------------------------------------------------------------------</div>
<div>==> REM ATTEMPT #2 TO UPLOAD TO HOSTX (Fails)</div>
<div>==> REM -----------------------------------------------------------------------</div>
<div> </div>
<div>==> %CD%\curl.exe </div>
<div>--verbose -T "stuff.dat"</div>
<div>--tlsv1.2 </div>
<div>--ciphers AES128-SHA256:AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256</div>
<div>--capath ..\certs </div>
<div>--user TELawrence:18881935 <a href="https://hostx.area51.gov/upload/">https://hostx.area51.gov/upload/</a></div>
<div>* Trying 211.3.150.21...</div>
<div>* Connected to hostx.area51.gov (211.3.150.21) port 443 (#0)</div>
<div>* ALPN, offering http/1.1</div>
<div>* Cipher selection: AES128-SHA256:AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256</div>
<div>* successfully set certificate verify locations:</div>
<div>* CAfile: none</div>
<div> CApath: ..\certs</div>
<div>* TLSv1.2 (OUT), TLS header, Certificate Status (22):</div>
<div>* TLSv1.2 (OUT), TLS handshake, Client hello (1):</div>
<div>* Unknown SSL protocol error in connection to hostx.area51.gov:443</div>
<div>* Closing connection 0</div>
<div>curl: (35) Unknown SSL protocol error in connection to hostx.area51.gov:443</div>
<div> </div>
<div> </div>
<div>==> REM -----------------------------------------------------------------------</div>
<div>==> REM ATTEMPT #3 TO UPLOAD TO HOSTX (Fails)</div>
<div>==> REM -----------------------------------------------------------------------</div>
<div> </div>
<div>==> %CD%\curl.exe </div>
<div>--verbose -T "stuff.dat" </div>
<div>--tlsv1.2 </div>
<div>--capath ..\certs </div>
<div>--user TELawrence:18881935 <a href="https://hostx.area51.gov/upload/">https://hostx.area51.gov/upload/</a></div>
<div>* Trying 211.3.150.21...</div>
<div>* Connected to hostx.area51.gov (211.3.150.21) port 443 (#0)</div>
<div>* ALPN, offering http/1.1</div>
<div>* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH</div>
<div>* successfully set certificate verify locations:</div>
<div>* CAfile: none</div>
<div> CApath: ..\certs</div>
<div>* TLSv1.2 (OUT), TLS header, Certificate Status (22):</div>
<div>* TLSv1.2 (OUT), TLS handshake, Client hello (1):</div>
<div>* error:14077102:SSL routines:SSL23_GET_SERVER_HELLO:unsupported protocol</div>
<div>* Closing connection 0</div>
<div>curl: (35) error:14077102:SSL routines:SSL23_GET_SERVER_HELLO:unsupported protocol</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
</span></font>
</body>
</html>