OpenSSL квитируют отказ

Я рекомендую Вам Подстановочный сертификат SSL для обеспечения домена плюс sub домен.

3
задан 10 April 2013 в 06:06
1 ответ

The incompatibility that you ran into is this:

The version of OpenSSL on RHEL5 (and its derivatives) doesn't advertise support for TLS at all. It only does SSLv3 and SSLv2.

The version of OpenSSL on RHEL6 (and its derivatives) supports TLS all the way up to TLSv1.2. It also does SSLv3, but it wants to negotiate TLS.

They should still be able to negotiate a session, as there is a (small) list of common ciphers to both of them, but depending on what you have selected for cipher settings on the server (e.g. to mitigate BEAST, eliminate low-security ciphers, etc.) there may not be any common ciphers that the client and server can use to communicate.

The cipher suites for the server would be set in in your Tomcat server.xml or in Apache's SSLCipherSuite if you have it sitting behind Apache. The client would use whatever it was configured to use, or DEFAULT otherwise.

The resolution is to check the cipher suites on the server, e.g. with openssl ciphers -v STRING where STRING is whatever you configured on the server, and repeating the same on the client, and then adjusting one or both until a cipher suite is available that both will negotiate.

5
ответ дан 3 December 2019 в 05:44

Теги

Похожие вопросы