<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
It seems to work fine here!</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<img size="6885" contenttype="image/png" style="max-width: 100%; user-select: none;" unselectable="on" tabindex="-1" data-outlook-trace="F:1|T:1" src="cid:e41cb622-8559-442b-9b65-76043c2c4b27"><br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<img size="28215" contenttype="image/png" style="max-width: 100%; user-select: none;" unselectable="on" tabindex="-1" data-outlook-trace="F:1|T:1" src="cid:a3ae8ac2-646c-41c8-9842-4f9bde0aaf71"><br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> openssl-users <openssl-users-bounces@openssl.org> on behalf of Matt Caswell <matt@openssl.org><br>
<b>Sent:</b> Wednesday, 11 March 2020 4:25 AM<br>
<b>To:</b> Niki Dinsey <niki.dinsey@abingdon.org.uk>; openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Subject:</b> Re: Question about handshake error</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText"><br>
<br>
On 10/03/2020 17:05, Niki Dinsey wrote:<br>
> Hi there, I have an issue I can't seem to work out the answer to.<br>
> <br>
> Server: thankqcrm.accessacloud.com <<a href="http://thankqcrm.accessacloud.com">http://thankqcrm.accessacloud.com</a>><br>
> <br>
> root@willis:~# openssl version<br>
> OpenSSL 1.1.1d 10 Sep 2019<br>
> root@willis:~# openssl s_client -connect thankqcrm.accessacloud.com:443<br>
> <<a href="http://thankqcrm.accessacloud.com:443">http://thankqcrm.accessacloud.com:443</a>><br>
<br>
Running the exact same openssl version from my machine, and using the<br>
exact same s_client options as you, I get a successful connection.<br>
<br>
Some possibilities of what might be going wrong:<br>
<br>
1) Is it possible there is some middlebox betwen you and the target<br>
server that is causing a problem for you on your network? Can you try<br>
connecting from s_client from a machine outside your corporate network?<br>
<br>
or<br>
<br>
2) I have sometimes seen load balancers do strange things - where<br>
different machines in the cluster are configured differently to each<br>
other. This can mean different people see different results - or even if<br>
you run the same test at different times you see different results. This<br>
could explain why it works in 1.1.0 and not 1.1.1 (i.e. it actually is<br>
equally broken - but sometimes you hit the "right" server, and sometimes<br>
you hit the "wrong" server). You might want to try from a different<br>
machine and see if the same thing happens, and/or repeat the tests<br>
periodically (in the hope of hitting different servers in the cluster).<br>
<br>
or<br>
<br>
3) Possibly there is some local problem with your s_client build. Does<br>
it work ok for other sites?<br>
<br>
<br>
Matt<br>
<br>
<br>
> CONNECTED(00000004)<br>
> 140151269360768:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert<br>
> handshake failure:../ssl/record/rec_layer_s3.c:1544:SSL alert number 40<br>
> ---<br>
> no peer certificate available<br>
> ---<br>
> No client certificate CA names sent<br>
> ---<br>
> SSL handshake has read 7 bytes and written 318 bytes<br>
> Verification: OK<br>
> ---<br>
> New, (NONE), Cipher is (NONE)<br>
> Secure Renegotiation IS NOT supported<br>
> Compression: NONE<br>
> Expansion: NONE<br>
> No ALPN negotiated<br>
> Early data was not sent<br>
> Verify return code: 0 (ok)<br>
> ---<br>
> <br>
> Works on OpenSSL 1.1.0:<br>
> <br>
> root@host:~# openssl version<br>
> OpenSSL 1.1.0l 10 Sep 2019<br>
> root@host:~# openssl s_client -connect thankqcrm.accessacloud.com:443<br>
> <<a href="http://thankqcrm.accessacloud.com:443">http://thankqcrm.accessacloud.com:443</a>><br>
> CONNECTED(00000003)<br>
> depth=2 C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = DigiCert Global Root CA<br>
> verify return:1<br>
> depth=1 C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = Thawte RSA CA 2018<br>
> verify return:1<br>
> depth=0 CN = *.accessacloud.com <<a href="http://accessacloud.com">http://accessacloud.com</a>><br>
> verify return:1<br>
> ---<br>
> Certificate chain<br>
> 0 s:/CN=*.accessacloud.com <<a href="http://accessacloud.com">http://accessacloud.com</a>><br>
> i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=Thawte<br>
> <<a href="http://www.digicert.com/CN=Thawte">http://www.digicert.com/CN=Thawte</a>> RSA CA 2018<br>
> 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=Thawte<br>
> <<a href="http://www.digicert.com/CN=Thawte">http://www.digicert.com/CN=Thawte</a>> RSA CA 2018<br>
> i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert<br>
> <<a href="http://www.digicert.com/CN=DigiCert">http://www.digicert.com/CN=DigiCert</a>> Global Root CA<br>
> 2 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert<br>
> <<a href="http://www.digicert.com/CN=DigiCert">http://www.digicert.com/CN=DigiCert</a>> Global Root CA<br>
> i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert<br>
> <<a href="http://www.digicert.com/CN=DigiCert">http://www.digicert.com/CN=DigiCert</a>> Global Root CA<br>
> 3 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert<br>
> <<a href="http://www.digicert.com/CN=DigiCert">http://www.digicert.com/CN=DigiCert</a>> Global Root CA<br>
> i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert<br>
> <<a href="http://www.digicert.com/CN=DigiCert">http://www.digicert.com/CN=DigiCert</a>> Global Root CA<br>
> ---<br>
> Server certificate<br>
> -----BEGIN CERTIFICATE-----<br>
> ...<br>
> -----END CERTIFICATE-----<br>
> subject=/CN=*.accessacloud.com <<a href="http://accessacloud.com">http://accessacloud.com</a>><br>
> issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=Thawte<br>
> <<a href="http://www.digicert.com/CN=Thawte">http://www.digicert.com/CN=Thawte</a>> RSA CA 2018<br>
> ---<br>
> No client certificate CA names sent<br>
> ---<br>
> SSL handshake has read 4999 bytes and written 494 bytes<br>
> Verification: OK<br>
> ---<br>
> New, TLSv1.2, Cipher is AES128-GCM-SHA256<br>
> Server public key is 2048 bit<br>
> Secure Renegotiation IS supported<br>
> Compression: NONE<br>
> Expansion: NONE<br>
> No ALPN negotiated<br>
> SSL-Session:<br>
> Protocol : TLSv1.2<br>
> Cipher : AES128-GCM-SHA256<br>
> Session-ID:<br>
> 05326CD4A0D128684EA530A59504BA8D02E99746AC2E40D0DA8B9B0E18F20CF0<br>
> Session-ID-ctx:<br>
> Master-Key:<br>
> B423C27867FFB6A021458D860CC8A5A6D947628A8216B5F8DD8D1CF3058545398185B94F772B3A816A15D1442FFF1822<br>
> PSK identity: None<br>
> PSK identity hint: None<br>
> SRP username: None<br>
> TLS session ticket lifetime hint: 14400 (seconds)<br>
> TLS session ticket:<br>
> 0000 - e5 7b cf ea bc 3d 6b 9a-59 ec 40 63 01 19 52 6c <br>
> .{...=k.Y.@c..Rl<br>
> 0010 - 72 c4 34 f0 a3 ff 37 f4-58 b1 9a bb 84 fc 94 36 <br>
> r.4...7.X......6<br>
> 0020 - 16 8e 39 04 94 e2 fd ae-0f 05 e7 6c 12 94 58 4a <br>
> ..9........l..XJ<br>
> 0030 - 09 56 e5 bd 67 d7 e7 17-d4 a8 03 ba 6e 05 be b6 <br>
> .V..g.......n...<br>
> 0040 - ce 5d 9a ee 81 73 97 c8-ff 9c be 6b 8f 37 cb bf <br>
> .]...s.....k.7..<br>
> 0050 - 44 76 93 83 95 58 6d b8-63 f6 ba 4d 55 22 d2 14 <br>
> Dv...Xm.c..MU"..<br>
> 0060 - 93 09 01 46 f0 fa f1 35-5a 80 0e ab a4 ca 9e c8 <br>
> ...F...5Z.......<br>
> 0070 - ed 8f c8 3c 89 e8 91 b3-0e 41 a9 e4 3f 79 f6 63 <br>
> ...<.....A..?y.c<br>
> 0080 - e2 62 91 c9 2f 8c 5a dd-b0 a1 55 b3 86 35 62 5a <br>
> .b../.Z...U..5bZ<br>
> 0090 - af c2 9a 8a 35 7a 46 3b-3c 2e 24 0d 45 69 96 fc <br>
> ....5zF;<.$.Ei..<br>
> <br>
> Start Time: 1583859230<br>
> Timeout : 7200 (sec)<br>
> Verify return code: 0 (ok)<br>
> Extended master secret: no<br>
> ---<br>
> <br>
> <br>
> Works using 1.1.1d if I pass in -tls1_1<br>
> <br>
> root@willis:~# openssl version<br>
> OpenSSL 1.1.1d 10 Sep 2019<br>
> root@willis:~# openssl s_client -connect thankqcrm.accessacloud.com:443<br>
> <<a href="http://thankqcrm.accessacloud.com:443">http://thankqcrm.accessacloud.com:443</a>> -tls1_1<br>
> CONNECTED(00000004)<br>
> depth=2 C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = DigiCert Global Root CA<br>
> verify return:1<br>
> depth=1 C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = Thawte RSA CA 2018<br>
> verify return:1<br>
> depth=0 CN = *.accessacloud.com <<a href="http://accessacloud.com">http://accessacloud.com</a>><br>
> verify return:1<br>
> ---<br>
> Certificate chain<br>
> 0 s:CN = *.accessacloud.com <<a href="http://accessacloud.com">http://accessacloud.com</a>><br>
> i:C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = Thawte RSA CA 2018<br>
> 1 s:C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = Thawte RSA CA 2018<br>
> i:C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = DigiCert Global Root CA<br>
> 2 s:C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = DigiCert Global Root CA<br>
> i:C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = DigiCert Global Root CA<br>
> 3 s:C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = DigiCert Global Root CA<br>
> i:C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = DigiCert Global Root CA<br>
> ---<br>
> Server certificate<br>
> -----BEGIN CERTIFICATE-----<br>
> ...<br>
> -----END CERTIFICATE-----<br>
> subject=CN = *.accessacloud.com <<a href="http://accessacloud.com">http://accessacloud.com</a>><br>
> <br>
> issuer=C = US, O = DigiCert Inc, OU = <a href="http://www.digicert.com">www.digicert.com</a><br>
> <<a href="http://www.digicert.com">http://www.digicert.com</a>>, CN = Thawte RSA CA 2018<br>
> <br>
> ---<br>
> No client certificate CA names sent<br>
> ---<br>
> SSL handshake has read 5059 bytes and written 481 bytes<br>
> Verification: OK<br>
> ---<br>
> New, SSLv3, Cipher is AES128-SHA<br>
> Server public key is 2048 bit<br>
> Secure Renegotiation IS supported<br>
> Compression: NONE<br>
> Expansion: NONE<br>
> No ALPN negotiated<br>
> SSL-Session:<br>
> Protocol : TLSv1.1<br>
> Cipher : AES128-SHA<br>
> Session-ID:<br>
> 9438801392B268A70F6B60C25E388481D69638ED8122A274BB0E15111BFF329B<br>
> Session-ID-ctx:<br>
> Master-Key:<br>
> EA86A4D07020F193BC66444A2D16EC67AD9524A6A78D068542B6CAF745D0B51FBE51EA0F9E9A6557561CFD5AE9E2D986<br>
> PSK identity: None<br>
> PSK identity hint: None<br>
> SRP username: None<br>
> TLS session ticket lifetime hint: 14400 (seconds)<br>
> TLS session ticket:<br>
> 0000 - e5 7b cf ea bc 3d 6b 9a-59 ec 40 63 01 19 52 6c <br>
> .{...=k.Y.@c..Rl<br>
> 0010 - 3a c0 bc fb ff 57 a2 7f-38 a9 91 64 5e 87 b4 88 <br>
> :....W..8..d^...<br>
> 0020 - f2 35 bc 04 b3 27 b3 fc-0f ac 3d 8a 03 a4 59 cb <br>
> .5...'....=...Y.<br>
> 0030 - a7 2c 8e 0f f3 a0 a2 13-50 fa 6f 2e 07 eb 1e 89 <br>
> .,......P.o.....<br>
> 0040 - 73 0d d0 3e d5 01 68 3a-18 56 00 71 fa 38 1e e0 <br>
> s..>..h:.V.q.8..<br>
> 0050 - 87 15 68 a4 d0 d7 13 67-c7 b1 e6 45 54 fd 22 e1 <br>
> ..h....g...ET.".<br>
> 0060 - 65 66 40 6c e3 7e 42 f1-1a 46 32 7b b9 a1 c0 80 <br>
> ef@l.~B..F2{....<br>
> 0070 - 12 ee f1 d9 92 5f b7 3b-7b 38 66 76 cc af b1 eb <br>
> ....._.;{8fv....<br>
> 0080 - 97 4c 02 af 61 9d 1b 35-c8 64 f5 ce 19 34 42 92 <br>
> .L..a..5.d...4B.<br>
> 0090 - a0 0e b9 51 ab de c0 cf-90 bd 65 2b 0b 08 19 3b <br>
> ...Q......e+...;<br>
> 00a0 - 2e fe 1f 75 1f b5 b8 48-40 8c 56 d4 dc 82 31 b0 <br>
> ...u...H@.V...1.<br>
> 00b0 - 2f 52 b9 1f 11 f7 d2 63-01 c0 89 57 dd a6 53 56 <br>
> /R.....c...W..SV<br>
> <br>
> Start Time: 1583859354<br>
> Timeout : 7200 (sec)<br>
> Verify return code: 0 (ok)<br>
> Extended master secret: no<br>
> ---<br>
> <br>
> <br>
> ---------------------------------<br>
> This error started our of the blue. The vendor confirmed a change in<br>
> certificate about the same time that curl/'python requests' stopped<br>
> working. So it looks to me like their cert change caused the issue.<br>
> <br>
> Tested on Debian 10 and Ubuntu 20.04 Focal Fossa.<br>
> <br>
> Why does this certificate work with tls1.2 on 1.1.0 but not on 1.1.1???<br>
> <br>
> I can force tls1.1, but want to inform the vendor there are problems<br>
> with their new certificate but don't really understand much of this.<br>
> <br>
> Any help appreciated. <br>
> <br>
> Regards<br>
> <br>
> Niki<br>
> <br>
> <br>
> Save the date: Abingdon's first 24hr *Giving Day - 18 March 2020*.<br>
> Help support our ambition to double the number of bursaries across the<br>
> Foundation.<br>
> <br>
> <<a href="http://www.150givingday.abingdon.org.uk">http://www.150givingday.abingdon.org.uk</a>><br>
> <br>
> <br>
> Abingdon School: A company limited by guarantee Registered in England<br>
> and Wales. Company No. 3625063 <br>
> <br>
> Registered Office: <br>
> Abingdon School <br>
> Park Road<br>
> Abingdon <br>
> OX14 1DE <br>
> Registered Charity No. 1071298<br>
> <br>
> All information in this message and attachments is confidential and may<br>
> be legally privileged. Only intended recipients are authorised to use<br>
> it. E-mail transmissions are not guaranteed to be secure or error free<br>
> and the sender does not accept liability for such errors or omissions.<br>
> The company will not accept any liability in respect of such<br>
> communication that violates our ICT policies.<br>
</div>
</span></font></div>
</div>
</body>
</html>