<html><head></head><body><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div><div><div>As requested here are two captures attached: one successfully handshakes with the server (chrome) and one fails the handshake (firefox).<br><div>I would be very grateful if anyone could shed some light on this.<br><div><br><div>the openssl version which is linked to my server/relay program is 1.0.2s<br><div><br><div>Thanks<br><div><br>/Patrick<br></div></div></div></div></div></div></div><div><br><div><br><div><br><div><br>On Mon, 2019-06-10 at 13:41 -0400, Viktor Dukhovni wrote:</div></div></div></div></div>On Mon, Jun 10, 2019 at 03:21:16PM +0000, Patrick Regnouf via openssl-users wrote:<br>> <br>> > All is well and good when the program works on the linux PC and the<br>> > handshake is succesful using the 0xc02f cipher. and that is linked to<br>> > version 3.0.0 of openssl. on the embedded version, (linked with version<br>> > 1.0.2s) firefox fails the handshake with ssl_no_shared_cipher whereas<br>> > chrome and safari do successfully handshake chrome client hello contains<br>> > 12 ciphers and the server hello seems to choose 0xc02f cipher firefox<br>> > client hello contains only 10 ciphers (including the above mentioned 0xc02f<br>> > cipher) and fails. any suggestion as to what could causes that failure<br>> > would be appreciated.<br>> <br>> In addition to the cipher algorithm, the two parties must also agree<br>> on the signature algorithms, supported EC groups, ...<br>> <br>> You've not provided much detail about the configuration of the<br>> embedded (1.0.2s) server. The cipher that works with the other<br>> browsers is:<br>> <br>> 0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD<br>> <br>> this requires a shared ECDHE curve, are you using "auto", or an<br>> explicit curve? What are the signature algorithms on your certificate<br>> chain?<br>> <br>> It would also be useful to post PCAP files of a working handshake<br>> with Chrome, and a failing handshake with Firefox.</div><div><br></div></div></body></html>