How to debug a TLSv1.3 protocol problem?

Matt Caswell matt at
Wed May 20 20:40:35 UTC 2020

On 20/05/2020 21:36, Viktor Dukhovni wrote:
> My take is that this is a sufficiently nasty problem to warrant some
> changes in SSL_read(), SSL_write, SSL_accept(), ... to internally
> memoize the error status before returning, in a manner that does not
> depend on the prior state of the error stack, and that then
> SSL_get_error() must look only at the given (SSL *) handle and
> not at the error stack.

We actually have always cleared the error stack on entering the libssl
state machine. It appears we don't do that on IO functions that don't
enter the state  machine (such as SSL_read()/SSL_write()).


More information about the openssl-users mailing list