<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Sorry we did do that. It just didn’t look different so I didn’t send it (pasted below). I also have asked for help from the server admin but it is a non English speaking country and they don’t seem to be interested in talking to me. I have another product supposedly using OpenSSL that is currently working fine so it must be possible. That product is using 0.9.8something. So specifying -cipher "AES128-SHA” will cause it to not use DHE?</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><br class=""></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">openssl s_client -state -msg -cipher "ALL" -connect <a href="http://ftp.echannel.banksys.be:16370" class="">ftp.echannel.banksys.be:16370</a> -starttls ftp<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">CONNECTED(00000104)<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">SSL_connect:before SSL initialization<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">>>> ??? [length 0005]<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 16 03 01 00 f7<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">>>> TLS 1.2Handshake [length 00f7], ClientHello<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 01 00 00 f3 03 03 da ac 89 55 94 51 e0 ce 4b 3b<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> ec ee 33 fd 31 1f 75 f1 50 1a 50 73 09 07 5a 0e<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> cf 7d c3 ac 54 03 00 00 84 c0 2c c0 30 00 a3 00<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 9f cc a9 cc a8 cc aa c0 af c0 ad c0 a3 c0 9f c0<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 2b c0 2f 00 a2 00 9e c0 ae c0 ac c0 a2 c0 9e c0<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 24 c0 28 00 6b 00 6a c0 73 c0 77 00 c4 00 c3 c0<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 23 c0 27 00 67 00 40 c0 72 c0 76 00 be 00 bd c0<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 0a c0 14 00 39 00 38 00 88 00 87 c0 09 c0 13 00<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 33 00 32 00 9a 00 99 00 45 00 44 00 9d c0 a1 c0<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 9d 00 9c c0 a0 c0 9c 00 3d 00 c0 00 3c 00 ba 00<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 35 00 84 00 2f 00 96 00 41 00 07 00 ff 01 00 00<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 46 00 0b 00 04 03 00 01 02 00 0a 00 0a 00 08 00<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 1d 00 17 00 19 00 18 00 23 00 00 00 0d 00 20 00<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 1e 06 01 06 02 06 03 05 01 05 02 05 03 04 01 04<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 02 04 03 03 01 03 02 03 03 02 01 02 02 02 03 00<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 16 00 00 00 17 00 00<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">SSL_connect:SSLv3/TLS write client hello<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><<< ??? [length 0005]<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 15 03 02 00 02<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><<< TLS 1.2Alert [length 0002], fatal insufficient_security<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> 02 47<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">SSL3 alert read:fatal:insufficient security<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">SSL_connect:error in SSLv3/TLS write client hello<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">2152:error:1409442F:SSL routines:ssl3_read_bytes:tlsv1 alert insufficient security:ssl\record\rec_layer_s3.c:1385:SSL alert number 71</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><br class=""></span></div><div><blockquote type="cite" class=""><div class="">On Apr 19, 2017, at 11:43 AM, Viktor Dukhovni <<a href="mailto:openssl-users@dukhovni.org" class="">openssl-users@dukhovni.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On Tue, Apr 18, 2017 at 05:06:40PM +0000, Viktor Dukhovni wrote:<br class=""><br class=""><blockquote type="cite" class="">The ClientHello decodes via tshark as:<br class=""><br class="">[...]<br class=""> Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)<br class=""> Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)<br class=""> Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)<br class=""> Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)<br class="">[...]<br class=""><br class="">This is a modern ClientHello (OpenSSL 1.1.0 it seems) and should<br class="">be broadly interoperable. The DEFAULT cipherlist includes only<br class="">AES, is there a chance that the server only supports RC4 and/or<br class="">3DES?<br class=""><br class="">Try:<br class=""><br class=""> $ openssl s_client -state -msg -cipher ALL \<br class=""> -connect <a href="http://ftp.echannel.banksys.be:16370" class="">ftp.echannel.banksys.be:16370</a> -starttls ftp<br class=""><br class="">Capture a PCAP file of the traffic with<br class=""><br class=""> # tcpdump -s0 -w /some/file tcp port 16370<br class=""><br class="">and post the the decode from:<br class=""><br class=""> $ tshark -r /tmp/p2 -d tcp.port==16370,ssl -V |<br class=""> sed -ne '/^Secure Sockets Layer/,/^$/p'<br class=""><br class="">Or just attach the PCAP file to your follow-up message.<br class=""></blockquote><br class="">On Wed, Apr 19, 2017 at 10:53:27AM -0400, Joseph Southwell wrote:<br class=""><br class=""><blockquote type="cite" class="">Is there a way to enable one or both of those ciphers in OpenSSL?<br class=""><br class=""><blockquote type="cite" class="">On Apr 18, 2017, at 1:28 PM, Jason Schultz <<a href="mailto:jetson23@hotmail.com" class="">jetson23@hotmail.com</a>> wrote:<br class=""><br class="">RSA_With_AES_128_CBC_SHA and RSA_With_3DES_EDE_CBC_SHA<br class=""></blockquote></blockquote><br class="">With so many different names for the underlying TLS ciphersuites<br class="">one can only guess which ones are the same. That said, I'd say<br class="">that the first one on your list is enabled by default, and was used<br class="">in your TLS ClientHello (TLS_RSA_WITH_AES_128_CBC_SHA 0x002f).<br class=""><br class="">It is possible that (despite any claims to the contrary) the server<br class="">only supports the 3DES ciphersuite above, in which case you need<br class="">either OpenSSL 1.0.2 or a build of OpenSSL 1.1.0 with the Configure<br class="">option "--enable-weak-ssl-ciphers". The 3DES TLS ciphers are by<br class="">default disabled at compile-time in OpenSSL 1.1.0 and later.<br class=""><br class="">I did suggest the "-cipher ALL" option as a first place to start to<br class="">find out what the server actually supports. I'm puzzled as to why<br class="">you've not tried that yet.<br class=""><br class="">A more exotic scenario is that the server is configured with a weak<br class="">DHE group and having chosen DHE decides that the group is too weak.<br class="">In that case you could try just the purported AES cipher:<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>-cipher "AES128-SHA"<br class=""><br class="">The name was obtained via:<br class=""><br class=""> $ openssl ciphers -V ALL | grep 0x00,0x2F<br class=""> 0x00,0x2F - AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1<br class=""><br class="">Finally, you really should ask for help from the server administrator<br class="">they should have useful data in their logs.<br class=""><br class="">-- <br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Viktor.<br class="">-- <br class="">openssl-users mailing list<br class="">To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" class="">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br class=""><br class=""></div></div></blockquote></div><br class=""></body></html>