<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi <span style="font-family:"Microsoft Yahei UI", Verdana, Simsun, "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">Michael,</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family:"Microsoft Yahei UI", Verdana, Simsun, "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family:"Microsoft Yahei UI", Verdana, Simsun, "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">Thanks a lot for your analysis.
I've fixed this issue as mentioned in previous email.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family:"Microsoft Yahei UI", Verdana, Simsun, "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="color: rgb(0, 0, 0);"><span style="font-size: 14.6667px;">Regards,</span></div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Allen</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>发件人:</b> openssl-users <openssl-users-bounces@openssl.org> 代表 openssl-users-request@openssl.org <openssl-users-request@openssl.org><br>
<b>发送时间:</b> 2022年1月1日 15:48<br>
<b>收件人:</b> openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>主题:</b> openssl-users Digest, Vol 86, Issue 1</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Send openssl-users mailing list submissions to<br>
openssl-users@openssl.org<br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
openssl-users-request@openssl.org<br>
<br>
You can reach the person managing the list at<br>
openssl-users-owner@openssl.org<br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of openssl-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. RE: undefined symbol: OSSL_provider_init when running "make<br>
test" for OpenSSL 3.0 (Lee Staniforth)<br>
2. RE: [openssl-1.1.1l] TLS1.2 Server responses with Alert<br>
(Michael Wojcik)<br>
3. Re: [openssl-1.1.1l] TLS1.2 Server responses with Alert<br>
(Mark Hack)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Fri, 31 Dec 2021 13:46:49 +0000<br>
From: Lee Staniforth <Lee.Staniforth@synchronoss.com><br>
To: Matt Caswell <matt@openssl.org>, "openssl-users@openssl.org"<br>
<openssl-users@openssl.org><br>
Subject: RE: undefined symbol: OSSL_provider_init when running "make<br>
test" for OpenSSL 3.0<br>
Message-ID:<br>
<DM6PR07MB8028DD6128102487938131E882469@DM6PR07MB8028.namprd07.prod.outlook.com><br>
<br>
Content-Type: text/plain; charset="us-ascii"<br>
<br>
Thanks very much, Matt and defulger.<br>
Removing the "-fvisibility=hidden" has enabled the tests to pass.<br>
<br>
I'll now have to see how my application (which is statically linked to OpenSSL) fairs.<br>
<br>
Lee<br>
<br>
From: Matt Caswell <matt@openssl.org><br>
Sent: 23 December 2021 10:13<br>
To: Lee Staniforth <Lee.Staniforth@synchronoss.com>; openssl-users@openssl.org<br>
Subject: Re: undefined symbol: OSSL_provider_init when running "make test" for OpenSSL 3.0<br>
<br>
On 21/12/2021 15:09, Lee Staniforth wrote: > ./Configure linux-x86_64 no-shared -m64 -fPIC -fvisibility=hidden Try dropping "-fvisibility=hidden". I can replicate this problem when using no-shared and<br>
External (matt@openssl.org<mailto:matt@openssl.org>)<br>
Report This Email<<a href="https://protection.inkyphishfence.com/report?id=c3luY2hyb25vc3MvbGVlLnN0YW5pZm9ydGhAc3luY2hyb25vc3MuY29tL2NiZGFiM2RjZDIzNWI3NDllOWQzYzRlYzBlYTA3Y2I1LzE2NDAyNTQzODIuMzc=#key=1fa1e349d7396284bf7cc883faec871a">https://protection.inkyphishfence.com/report?id=c3luY2hyb25vc3MvbGVlLnN0YW5pZm9ydGhAc3luY2hyb25vc3MuY29tL2NiZGFiM2RjZDIzNWI3NDllOWQzYzRlYzBlYTA3Y2I1LzE2NDAyNTQzODIuMzc=#key=1fa1e349d7396284bf7cc883faec871a</a>>
FAQ<<a href="https://www.inky.com/banner-faq/">https://www.inky.com/banner-faq/</a>> Protection by INKY<<a href="https://www.inky.com">https://www.inky.com</a>><br>
<br>
<br>
<br>
<br>
<br>
<br>
On 21/12/2021 15:09, Lee Staniforth wrote:<br>
<br>
> ./Configure linux-x86_64 no-shared -m64 -fPIC -fvisibility=hidden<br>
<br>
<br>
<br>
Try dropping "-fvisibility=hidden". I can replicate this problem when<br>
<br>
using no-shared and -fvisibility=hidden. If I drop the<br>
<br>
"-fvisibility=hidden" the problem goes away.<br>
<br>
<br>
<br>
Matt<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://mta.openssl.org/pipermail/openssl-users/attachments/20211231/0f037481/attachment-0001.htm">https://mta.openssl.org/pipermail/openssl-users/attachments/20211231/0f037481/attachment-0001.htm</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Fri, 31 Dec 2021 15:05:26 +0000<br>
From: Michael Wojcik <Michael.Wojcik@microfocus.com><br>
To: "openssl-users@openssl.org" <openssl-users@openssl.org><br>
Subject: RE: [openssl-1.1.1l] TLS1.2 Server responses with Alert<br>
Message-ID:<br>
<DM6PR18MB27005C4E44DE291D1C26B9EEF9469@DM6PR18MB2700.namprd18.prod.outlook.com><br>
<br>
Content-Type: text/plain; charset="us-ascii"<br>
<br>
> From: openssl-users <openssl-users-bounces@openssl.org> On Behalf Of Ma Zhenhua<br>
> Sent: Thursday, 30 December, 2021 23:59<br>
<br>
> On the SSL/TLS server, there's one error as follows. <br>
> "SSL Error(118) - no suitable signature algorithm"<br>
<br>
Debugging handshake failures isn't my area of expertise, but I note both ClientHellos include a signature_algorithms extension, and the contents are quite different. In particular, the successful ClientHello includes the Signature Hash Algorithm Hash and Signature
Hash Algorithm Signature parameters, while the failing one doesn't.<br>
<br>
The failing one also includes a signature_algorithms_cert extension, while the successful one does not. I don't know offhand how the algorithms specified in that extension correspond to the signature-algorithm OIDs in signatures, but the server's certificate
has 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) which seems like it ought to correspond to either rsa_pss_rsae_sha256 or rsa_pss_pss_sha256. (Apparently those are both RSA-PSS with SHA256, as the name implies, and the difference between the two of them
is whether the public key is encoded using the rsaEncryption format in the certificate, or the id-RSASSA-PSS format. The failing client is saying it understands both, AIUI.)<br>
<br>
So my guess would be the server is unhappy that the failing client's ClientHello doesn't include the parameters for the various supported signature schemes in its signature_algorithms extension. But that's just a guess, and I don't know how you'd fix it.<br>
<br>
-- <br>
Michael Wojcik<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Sat, 01 Jan 2022 01:48:25 -0600<br>
From: Mark Hack <markhack@markhack.com><br>
To: "openssl-users@openssl.org" <openssl-users@openssl.org><br>
Subject: Re: [openssl-1.1.1l] TLS1.2 Server responses with Alert<br>
Message-ID:<br>
<abcec7b3e2f12619015128811528090e09206b51.camel@markhack.com><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
<br>
The server error is correct - the signature_algorithms_cert extension<br>
does not offer rsa_pkcs1_sha256 (0x0401) which is the server<br>
certificate signing algorithm.<br>
If the client is written in Java, check java.security for<br>
"jdk.certpath.disabledAlgorithms" and check the constraints.<br>
<br>
<br>
On Fri, 2021-12-31 at 15:05 +0000, Michael Wojcik wrote:<br>
> > From: openssl-users <openssl-users-bounces@openssl.org> On Behalf<br>
> > Of Ma Zhenhua<br>
> > Sent: Thursday, 30 December, 2021 23:59<br>
> > On the SSL/TLS server, there's one error as follows. <br>
> > "SSL Error(118) - no suitable signature algorithm"<br>
> <br>
> Debugging handshake failures isn't my area of expertise, but I note<br>
> both ClientHellos include a signature_algorithms extension, and the<br>
> contents are quite different. In particular, the successful<br>
> ClientHello includes the Signature Hash Algorithm Hash and Signature<br>
> Hash Algorithm Signature parameters, while the failing one doesn't.<br>
> <br>
> The failing one also includes a signature_algorithms_cert extension,<br>
> while the successful one does not. I don't know offhand how the<br>
> algorithms specified in that extension correspond to the signature-<br>
> algorithm OIDs in signatures, but the server's certificate has<br>
> 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) which seems like it<br>
> ought to correspond to either rsa_pss_rsae_sha256 or<br>
> rsa_pss_pss_sha256. (Apparently those are both RSA-PSS with SHA256,<br>
> as the name implies, and the difference between the two of them is<br>
> whether the public key is encoded using the rsaEncryption format in<br>
> the certificate, or the id-RSASSA-PSS format. The failing client is<br>
> saying it understands both, AIUI.)<br>
> <br>
> So my guess would be the server is unhappy that the failing client's<br>
> ClientHello doesn't include the parameters for the various supported<br>
> signature schemes in its signature_algorithms extension. But that's<br>
> just a guess, and I don't know how you'd fix it.<br>
> <br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://mta.openssl.org/pipermail/openssl-users/attachments/20220101/8dfee888/attachment.htm">https://mta.openssl.org/pipermail/openssl-users/attachments/20220101/8dfee888/attachment.htm</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
openssl-users mailing list<br>
openssl-users@openssl.org<br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of openssl-users Digest, Vol 86, Issue 1<br>
********************************************<br>
</div>
</span></font></div>
</div>
</body>
</html>