<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;">Hello, we have a problem with a .NET application running on a Linux server, possibly caused by incorrect TLS settings on the server we are making requests to.</span><br>
</div>
<div dir="ltr">
<div dir="ltr">
<div class="x_x_elementToProof" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<div>We made several attempts to configure OpenSSL on our server and none were able to connect to the destination server address.</div>
<div>The URL we are trying to connect to is notacarioca.rio.gov.br.</div>
When trying to run an openssl s_client -connect, we get error 104, with the following return:<br>
</div>
<div class="x_x_elementToProof" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div class="x_x_elementToProof elementToProof" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="font-size:10pt"><i>openssl s_client -connect notacarioca.rio.gov.br:443</i></span><i><br>
</i></div>
<div class="x_x_elementToProof" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<i><br>
</i></div>
<div class="x_x_elementToProof" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<blockquote style="margin-top:0; margin-bottom:0">
<div><span style="font-size:10pt"><b>CONNECTED(00000003)</b></span></div>
<div><span style="font-size:10pt"><b>write:errno=104</b></span></div>
<div><span style="font-size:10pt">---</span></div>
<div><span style="font-size:10pt">no peer certificate available</span></div>
<div><span style="font-size:10pt">---</span></div>
<div><span style="font-size:10pt">No client certificate CA names sent</span></div>
<div><span style="font-size:10pt">---</span></div>
<div><span style="font-size:10pt">SSL handshake has read 0 bytes and written 334 bytes</span></div>
<div><span style="font-size:10pt">Verification: OK</span></div>
<div><span style="font-size:10pt">---</span></div>
<div><span style="font-size:10pt">New, (NONE), Cipher is (NONE)</span></div>
<div><span style="font-size:10pt">Secure Renegotiation IS NOT supported</span></div>
<div><span style="font-size:10pt">Compression: NONE</span></div>
<div><span style="font-size:10pt">Expansion: NONE</span></div>
<div><span style="font-size:10pt">No ALPN negotiated</span></div>
<div><span style="font-size:10pt">Early data was not sent</span></div>
<div><span style="font-size:10pt">Verify return code: 0 (ok)</span></div>
</blockquote>
<br>
</div>
<div class="x_x_elementToProof" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
</div>
When executing an nmap at the address we have the following result
<div class="x_x_elementToProof" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div class="x_x_elementToProof" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<blockquote style="margin-top:0; margin-bottom:0"><span style="font-size:10pt"><i> nmap --script ssl-enum-ciphers -p 443 notacarioca.rio.gov.br</i></span>
<div><span style="font-size:10pt">Starting Nmap 7.70 ( https://nmap.org ) at 2022-08-26 00:44 -03</span></div>
<div><span style="font-size:10pt">Nmap scan report for notacarioca.rio.gov.br (187.111.98.122)</span></div>
<div><span style="font-size:10pt">Host is up (0.15s latency).</span></div>
<div><br>
</div>
<div><span style="font-size:10pt">PORT STATE SERVICE</span></div>
<div><span style="font-size:10pt">443/tcp open https</span></div>
<div><span style="font-size:10pt">| ssl-enum-ciphers:</span></div>
<div><span style="font-size:10pt">| TLSv1.2:</span></div>
<div><span style="font-size:10pt">| ciphers:</span></div>
<div><span style="font-size:10pt">| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A</span></div>
<div><span style="font-size:10pt">| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A</span></div>
<div><span style="font-size:10pt">| TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A</span></div>
<div><span style="font-size:10pt">| TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A</span></div>
<div><span style="font-size:10pt">| compressors:</span></div>
<div><span style="font-size:10pt">| NULL</span></div>
<div><span style="font-size:10pt">| cipher preference: server</span></div>
<div><span style="font-size:10pt">|_ least strength: A</span></div>
<div><br>
</div>
<div><span style="font-size:10pt">Nmap done: 1 IP address (1 host up) scanned in 7.11 seconds</span></div>
</blockquote>
<div><span style="font-size:12pt"><br>
</span></div>
<div><span style="font-size:12pt">Currently the OpenSSL configuration on our server looks like this. We tried several ways, but none worked. As we have little experience with OpenSSL we don't know what is wrong.</span><span style="font-size:10pt"><br>
</span></div>
<div><span style="font-size:12pt"><br>
</span></div>
<div><span style="font-size:12pt">
<blockquote style="margin-top:0; margin-bottom:0">
<div>CipherString = DEFAULT@SECLEVEL=0</div>
<div>Ciphersuites = TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256:TLS_RSA_WITH_AES_128_CBC_SHA256:TLS_RSA_WITH_AES_256_CBC_SHA256:TLS_RSA_WITH_AES_128_GCM_SHA256:TLS_RSA_WITH_AES_256_GCM_SHA384</div>
<div>MinProtocol = TLSv1.0</div>
<div>MaxProtocol = TLSv1.3</div>
<div>SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_rsae_sha256:rsa_pss_pss_sha384:rsa_pss_rsae_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224:ECDSA+SHA1:RSA+SHA1</div>
</blockquote>
</span></div>
<br>
</div>
<div class="x_x_elementToProof" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
An observation is that our application running in Windows environment works. We were able to access the URL normally.<br>
Can someone please help us to solve this problem?<br>
</div>
</div>
</div>
</body>
</html>