<div dir="auto">Thank you so much for the response Jakob.<div dir="auto"><br></div><div dir="auto">Yes I agree with you about the connection succeeded and later rejected on credentials part. The same worked from all the RHEL Version below 7 so I was thinking it might be a issue at OS level. </div><div dir="auto"><br></div><div dir="auto">Based on your suggestion, I feel that the issue is with the Exchange Server. Please double confirm.</div><div dir="auto"><br></div><div dir="auto">Thanks and Regards</div><div dir="auto">Chandu </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, May 11, 2019, 3:02 PM Jakob Bohm via openssl-users <<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Your transcript below seems to show a successful connection to Microsoft's<br>
cloud mail, then Microsoft rejecting the password and closing the <br>
connection.<br>
<br>
You are not connecting to your own Exchange server, but to a central <br>
Microsoft<br>
service that also handles their consumer mail accounts (<a href="http://hotmail.com" rel="noreferrer noreferrer" target="_blank">hotmail.com</a>, <br>
<a href="http://live.com" rel="noreferrer noreferrer" target="_blank">live.com</a>,<br>
<a href="http://outlook.com" rel="noreferrer noreferrer" target="_blank">outlook.com</a> etc.). This service load balances connections between many <br>
servers<br>
which cab give different results for each try.<br>
<br>
On 10/05/2019 17:01, Chandu Gangireddy wrote:<br>
> Dear OpenSSL Users,<br>
><br>
> At my corporate environment, I'm experience a challenge to use openssl <br>
> s_client utility. I really appreciate if someone can help me narrow <br>
> down the issue.<br>
><br>
> Here the details -<br>
><br>
> Platform: RHEL 7.x<br>
> *Openssl version:*<br>
> OpenSSL 1.0.2k-fips 26 Jan 2017<br>
> built on: reproducible build, date unspecified<br>
> platform: linux-x86_64<br>
> options: bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) <br>
> idea(int) blowfish(idx)<br>
> compiler: gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB <br>
> -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT <br>
> -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 <br>
> -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 <br>
> -grecord-gcc-switches -m64 -mtune=generic -Wa,--noexecstack -DPURIFY <br>
> -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 <br>
> -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM <br>
> -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM <br>
> -DGHASH_ASM -DECP_NISTZ256_ASM<br>
> OPENSSLDIR: "/etc/pki/tls"<br>
> engines: rdrand dynamic<br>
><br>
> Command tried to tes the connectivity between my Linux client server <br>
> to remote office 365 exchange server using POP3 port -<br>
><br>
> $ openssl s_client -crlf -connect <a href="http://outlook.office365.com:995" rel="noreferrer noreferrer" target="_blank">outlook.office365.com:995</a> <br>
> <<a href="http://outlook.office365.com:995" rel="noreferrer noreferrer" target="_blank">http://outlook.office365.com:995</a>><br>
> ...<br>
> ...<br>
> subject=/C=US/ST=Washington/L=Redmond/O=Microsoft <br>
> Corporation/CN=<a href="http://outlook.com" rel="noreferrer noreferrer" target="_blank">outlook.com</a> <<a href="http://outlook.com" rel="noreferrer noreferrer" target="_blank">http://outlook.com</a>><br>
> issuer=/C=US/O=DigiCert Inc/CN=DigiCert Cloud Services CA-1<br>
> ---<br>
> No client certificate CA names sent<br>
> Peer signing digest: SHA256<br>
> Server Temp Key: ECDH, P-256, 256 bits<br>
> ---<br>
> SSL handshake has read 3952 bytes and written 415 bytes<br>
> ---<br>
> New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384<br>
> Server public key is 2048 bit<br>
> Secure Renegotiation IS supported<br>
> Compression: NONE<br>
> Expansion: NONE<br>
> No ALPN negotiated<br>
> SSL-Session:<br>
> Protocol : TLSv1.2<br>
> Cipher : ECDHE-RSA-AES256-GCM-SHA384<br>
> Session-ID: <br>
> 072F0000FFDC6177DE9CAB2B59EA06E486A25AD8A2882A9B82F16678BAD74E79<br>
> Session-ID-ctx:<br>
> Master-Key: <br>
> DD7B59F38867FEAB9656B519FBCD743158E528C63FF9A96CE758120424159F26967F9F6FE57A9B5E7CAD806798322278<br>
> Key-Arg : None<br>
> Krb5 Principal: None<br>
> PSK identity: None<br>
> PSK identity hint: None<br>
> Start Time: 1557500061<br>
> Timeout : 300 (sec)<br>
> Verify return code: 0 (ok)<br>
> ---<br>
> +OK The Microsoft Exchange POP3 service is ready. <br>
> [QgBOADYAUABSADEANABDAEEAMAAwADQAMgAuAG4AYQBtAHAAcgBkADEANAAuAHAAcgBvAGQALgBvAHUAdABsAG8AbwBrAC4AYwBvAG0A]<br>
> *USER <a href="mailto:netcool2@cox.com" target="_blank" rel="noreferrer">netcool2@cox.com</a> <mailto:<a href="mailto:netcool2@cox.com" target="_blank" rel="noreferrer">netcool2@cox.com</a>>*<br>
> *+OK*<br>
> *PASS XXXXXXXX*<br>
> *-ERR Logon failure: unknown user name or bad password.*<br>
> *quit*<br>
> *+OK Microsoft Exchange Server POP3 server signing off.*<br>
> *read:errno=0*<br>
><br>
> Operating System:<br>
> Red Hat Enterprise Linux Server release 7.2 (Maipo)<br>
><br>
> When I did the same from a different server, it worked as expected. <br>
> Following are the two difference which I noticed between a working <br>
> server and non-working server.<br>
> *<br>
> *<br>
> *Working server details:*<br>
> 1. Red Hat Enterprise Linux Server release 6.9 (Santiago)<br>
> 2. openssl version<br>
> OpenSSL 1.0.1e-fips 11 Feb 2013<br>
> built on: Mon Jan 30 07:47:24 EST 2017<br>
> platform: linux-x86_64<br>
> options: bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) <br>
> idea(int) blowfish(idx)<br>
> compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS <br>
> -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN <br>
> -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions <br>
> -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic <br>
> -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT <br>
> -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM <br>
> -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM <br>
> -DWHIRLPOOL_ASM -DGHASH_ASM<br>
> OPENSSLDIR: "/etc/pki/tls"<br>
> engines: dynamic<br>
><br>
> Please let me know if you need any further details from my end.<br>
><br>
> Thanks, in advance.<br>
> Chandu<br>
<br>
<br>
-- <br>
Jakob Bohm, CIO, partner, WiseMo A/S. <a href="https://www.wisemo.com" rel="noreferrer noreferrer" target="_blank">https://www.wisemo.com</a><br>
Transformervej 29, 2860 Soborg, Denmark. direct: +45 31 13 16 10 <br>
<call:+4531131610><br>
This message is only for its intended recipient, delete if misaddressed.<br>
WiseMo - Remote Service Management for PCs, Phones and Embedded<br>
</blockquote></div>