<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
code
{mso-style-priority:99;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thanks Steven for pointing me in the right direction: when I switched to an EC/ECDSA key for tomcat then openssl could connect using ECDHE-ECDSA-AES256-GCM-SHA384.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">But only after installing the unlimited strength policy files on the server, with the defaults the best was ECDHE-ECDSA-AES128-GCM-SHA256.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Andrew<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> openssl-users [mailto:openssl-users-bounces@openssl.org]
<b>On Behalf Of </b>Steven Collison<br>
<b>Sent:</b> Tuesday, June 06, 2017 07:30<br>
<b>To:</b> openssl-users@openssl.org<br>
<b>Cc:</b> openssl-dev@openssl.org<br>
<b>Subject:</b> Re: [openssl-users] Problem in connecting to Java (Tomcat) server with ECDHE ciphers<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p><span style="font-family:"Arial",sans-serif">As a sanity check, are you using an ECDSA certificate on your Tomcat server? ECDHE-ECDSA-AES256-GCM-SHA384 can’t be negotiated without one. Perhaps you can try
<br>
</span><code><span style="font-size:10.0pt;background:#F7F7F7">openssl s_client -connect a.b.c.d:<port> -msg -debug -cipher “ECDHE-RSA-AES256-GCM-SHA384”</span></code><span style="font-family:"Arial",sans-serif"> if you’re using an RSA cert.<o:p></o:p></span></p>
<p><span style="font-family:"Arial",sans-serif">-Steven<o:p></o:p></span></p>
<p><span style="font-family:"Arial",sans-serif">On 3 Jun 2017, at 22:01, Pravesh Rai wrote:<o:p></o:p></span></p>
</div>
<div>
<blockquote style="border:none;border-left:solid #777777 1.5pt;padding:0in 0in 0in 4.0pt;margin-left:0in;margin-top:5.0pt;margin-right:0in;margin-bottom:3.75pt">
<p><span style="font-family:"Arial",sans-serif;color:#777777">Hi,<br>
<br>
Even though I've disabled SSLvX protocols on both - client (openssl-1.0.2k)<br>
& server (Java 1.8 with Tomcat), still getting following handshake error,<br>
while executing:<br>
<br>
"openssl s_client -connect a.b.c.d:<port> -msg -debug -cipher<br>
ECDHE-ECDSA-AES256-GCM-SHA384"<br>
<br>
<br>
...<br>
read from 0x213f50 [0x21c410] (7 bytes => 7 (0x7))<br>
0000 - 15 03 03 00 02 02 28 ......(<br>
<<< TLS 1.2 [length 0005]<br>
15 03 03 00 02<br>
<<< TLS 1.2 Alert [length 0002], fatal handshake_failure<br>
02 28<br>
14756:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert<br>
handshake failure:.\ssl\s23_clnt.c:769:<br>
...<br>
<br>
And, such error happens, only when ECDHE ciphers are selected during the<br>
connection.<br>
<br>
Any clue on this?<br>
<br>
Thanks,<br>
PR<br>
-- <br>
openssl-users mailing list<br>
To unsubscribe: </span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mta.openssl.org_mailman_listinfo_openssl-2Dusers&d=DwMFaQ&c=UrUhmHsiTVT5qkaA4d_oSzcamb9hmamiCDMzBAEwC7E&r=rM-xapYCunnmjke6suxLaVU8krc3wfCZvRQxfT87RRc&m=E9RTp_nB68n9DCD_f0OiM165NBTgKk7sApgOSnM1L7Q&s=znUch5G2tNF3MmxunH-Q2x43BWNm4u0_nB1EnB6hKnU&e="><span style="font-family:"Arial",sans-serif;color:#777777">https://mta.openssl.org/mailman/listinfo/openssl-users</span></a><span style="font-family:"Arial",sans-serif;color:#777777"><o:p></o:p></span></p>
</blockquote>
</div>
</div>
</div>
</body>
</html>