Hi all,
I’m having an issue which is handshake fail with the following log
ssl_tls.c:6720: |2| => handshake
ssl_cli.c:3391: |2| client state: 0
mbedtls_ssl_handshake_client_step ###############
ssl_tls.c:2475: |2| => flush output
ssl_tls.c:2487: |2| <= flush output
ssl_cli.c:3391: |2| client state: 1
mbedtls_ssl_handshake_client_step ###############
ssl_tls.c:2475: |2| => flush output
ssl_tls.c:2487: |2| <= flush output
MBEDTLS_SSL_CLIENT_HELLO
ssl_cli.c:0775: |2| => write client hello
ssl_cli.c:0813: |3| client hello, max version: [3:3]
ssl_cli.c:0708: |3| client hello, current time: 1531122843
ssl_cli.c:0822: |3| dumping ‘client hello, random bytes’ (32 bytes)
ssl_cli.c:0822: |3| 0000: 5b 43 14 9b 91 7a e4 fd 71 37 c0 dc b3 89 26 e0 [C…z…q7…&.
ssl_cli.c:0822: |3| 0010: 31 44 38 54 c5 5b 2e ab 85 00 c2 f5 13 d5 ce d2 1D8T.[…
ssl_cli.c:0875: |3| client hello, session id len.: 0
ssl_cli.c:0876: |3| dumping ‘client hello, session id’ (0 bytes)
ssl_cli.c:0923: |3| client hello, add ciphersuite: c02c
ssl_cli.c:0923: |3| client hello, add ciphersuite: c030
ssl_cli.c:0923: |3| client hello, add ciphersuite: 009f
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0ad
ssl_cli.c:0923: |3| client hello, add ciphersuite: c09f
ssl_cli.c:0923: |3| client hello, add ciphersuite: c024
ssl_cli.c:0923: |3| client hello, add ciphersuite: c028
ssl_cli.c:0923: |3| client hello, add ciphersuite: 006b
ssl_cli.c:0923: |3| client hello, add ciphersuite: c00a
ssl_cli.c:0923: |3| client hello, add ciphersuite: c014
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0039
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0af
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0a3
ssl_cli.c:0923: |3| client hello, add ciphersuite: c087
ssl_cli.c:0923: |3| client hello, add ciphersuite: c08b
ssl_cli.c:0923: |3| client hello, add ciphersuite: c07d
ssl_cli.c:0923: |3| client hello, add ciphersuite: c073
ssl_cli.c:0923: |3| client hello, add ciphersuite: c077
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00c4
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0088
ssl_cli.c:0923: |3| client hello, add ciphersuite: c02b
ssl_cli.c:0923: |3| client hello, add ciphersuite: c02f
ssl_cli.c:0923: |3| client hello, add ciphersuite: 009e
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0ac
ssl_cli.c:0923: |3| client hello, add ciphersuite: c09e
ssl_cli.c:0923: |3| client hello, add ciphersuite: c023
ssl_cli.c:0923: |3| client hello, add ciphersuite: c027
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0067
ssl_cli.c:0923: |3| client hello, add ciphersuite: c009
ssl_cli.c:0923: |3| client hello, add ciphersuite: c013
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0033
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0ae
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0a2
ssl_cli.c:0923: |3| client hello, add ciphersuite: c086
ssl_cli.c:0923: |3| client hello, add ciphersuite: c08a
ssl_cli.c:0923: |3| client hello, add ciphersuite: c07c
ssl_cli.c:0923: |3| client hello, add ciphersuite: c072
ssl_cli.c:0923: |3| client hello, add ciphersuite: c076
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00be
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0045
ssl_cli.c:0923: |3| client hello, add ciphersuite: c008
ssl_cli.c:0923: |3| client hello, add ciphersuite: c012
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0016
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00ab
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0a7
ssl_cli.c:0923: |3| client hello, add ciphersuite: c038
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00b3
ssl_cli.c:0923: |3| client hello, add ciphersuite: c036
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0091
ssl_cli.c:0923: |3| client hello, add ciphersuite: c091
ssl_cli.c:0923: |3| client hello, add ciphersuite: c09b
ssl_cli.c:0923: |3| client hello, add ciphersuite: c097
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0ab
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00aa
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0a6
ssl_cli.c:0923: |3| client hello, add ciphersuite: c037
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00b2
ssl_cli.c:0923: |3| client hello, add ciphersuite: c035
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0090
ssl_cli.c:0923: |3| client hello, add ciphersuite: c090
ssl_cli.c:0923: |3| client hello, add ciphersuite: c096
ssl_cli.c:0923: |3| client hello, add ciphersuite: c09a
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0aa
ssl_cli.c:0923: |3| client hello, add ciphersuite: c034
ssl_cli.c:0923: |3| client hello, add ciphersuite: 008f
ssl_cli.c:0923: |3| client hello, add ciphersuite: 009d
ssl_cli.c:0923: |3| client hello, add ciphersuite: c09d
ssl_cli.c:0923: |3| client hello, add ciphersuite: 003d
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0035
ssl_cli.c:0923: |3| client hello, add ciphersuite: c032
ssl_cli.c:0923: |3| client hello, add ciphersuite: c02a
ssl_cli.c:0923: |3| client hello, add ciphersuite: c00f
ssl_cli.c:0923: |3| client hello, add ciphersuite: c02e
ssl_cli.c:0923: |3| client hello, add ciphersuite: c026
ssl_cli.c:0923: |3| client hello, add ciphersuite: c005
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0a1
ssl_cli.c:0923: |3| client hello, add ciphersuite: c07b
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00c0
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0084
ssl_cli.c:0923: |3| client hello, add ciphersuite: c08d
ssl_cli.c:0923: |3| client hello, add ciphersuite: c079
ssl_cli.c:0923: |3| client hello, add ciphersuite: c089
ssl_cli.c:0923: |3| client hello, add ciphersuite: c075
ssl_cli.c:0923: |3| client hello, add ciphersuite: 009c
ssl_cli.c:0923: |3| client hello, add ciphersuite: c09c
ssl_cli.c:0923: |3| client hello, add ciphersuite: 003c
ssl_cli.c:0923: |3| client hello, add ciphersuite: 002f
ssl_cli.c:0923: |3| client hello, add ciphersuite: c031
ssl_cli.c:0923: |3| client hello, add ciphersuite: c029
ssl_cli.c:0923: |3| client hello, add ciphersuite: c00e
ssl_cli.c:0923: |3| client hello, add ciphersuite: c02d
ssl_cli.c:0923: |3| client hello, add ciphersuite: c025
ssl_cli.c:0923: |3| client hello, add ciphersuite: c004
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0a0
ssl_cli.c:0923: |3| client hello, add ciphersuite: c07a
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00ba
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0041
ssl_cli.c:0923: |3| client hello, add ciphersuite: c08c
ssl_cli.c:0923: |3| client hello, add ciphersuite: c078
ssl_cli.c:0923: |3| client hello, add ciphersuite: c088
ssl_cli.c:0923: |3| client hello, add ciphersuite: c074
ssl_cli.c:0923: |3| client hello, add ciphersuite: 000a
ssl_cli.c:0923: |3| client hello, add ciphersuite: c00d
ssl_cli.c:0923: |3| client hello, add ciphersuite: c003
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00ad
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00b7
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0095
ssl_cli.c:0923: |3| client hello, add ciphersuite: c093
ssl_cli.c:0923: |3| client hello, add ciphersuite: c099
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00ac
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00b6
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0094
ssl_cli.c:0923: |3| client hello, add ciphersuite: c092
ssl_cli.c:0923: |3| client hello, add ciphersuite: c098
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0093
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00a9
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0a5
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00af
ssl_cli.c:0923: |3| client hello, add ciphersuite: 008d
ssl_cli.c:0923: |3| client hello, add ciphersuite: c08f
ssl_cli.c:0923: |3| client hello, add ciphersuite: c095
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0a9
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00a8
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0a4
ssl_cli.c:0923: |3| client hello, add ciphersuite: 00ae
ssl_cli.c:0923: |3| client hello, add ciphersuite: 008c
ssl_cli.c:0923: |3| client hello, add ciphersuite: c08e
ssl_cli.c:0923: |3| client hello, add ciphersuite: c094
ssl_cli.c:0923: |3| client hello, add ciphersuite: c0a8
ssl_cli.c:0923: |3| client hello, add ciphersuite: 008b
ssl_cli.c:0923: |3| client hello, add ciphersuite: c007
ssl_cli.c:0923: |3| client hello, add ciphersuite: c011
ssl_cli.c:0923: |3| client hello, add ciphersuite: c033
ssl_cli.c:0923: |3| client hello, add ciphersuite: 008e
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0005
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0004
ssl_cli.c:0923: |3| client hello, add ciphersuite: c00c
ssl_cli.c:0923: |3| client hello, add ciphersuite: c002
ssl_cli.c:0923: |3| client hello, add ciphersuite: 0092
ssl_cli.c:0923: |3| client hello, add ciphersuite: 008a
ssl_cli.c:0930: |3| client hello, got 140 ciphersuites (excluding SCSVs)
ssl_cli.c:0939: |3| adding EMPTY_RENEGOTIATION_INFO_SCSV
ssl_cli.c:0988: |3| client hello, compress len.: 1
ssl_cli.c:0990: |3| client hello, compress alg.: 0
ssl_cli.c:0074: |3| client hello, adding server name extension: mbed TLS Server 1
ssl_cli.c:0191: |3| client hello, adding signature_algorithms extension
ssl_cli.c:0276: |3| client hello, adding supported_elliptic_curves extension
ssl_cli.c:0341: |3| client hello, adding supported_point_formats extension
ssl_cli.c:0523: |3| client hello, adding encrypt_then_mac extension
ssl_cli.c:0557: |3| client hello, adding extended_master_secret extension
ssl_cli.c:0590: |3| client hello, adding session ticket extension
ssl_cli.c:1064: |3| client hello, total extension length: 98
ssl_tls.c:2768: |2| => write record
ssl_tls.c:2914: |3| output record: msgtype = 22, version = [3:3], msglen = 425
ssl_tls.c:2475: |2| => flush output
ssl_tls.c:2494: |2| message length: 430, out_left: 430
ssl_tls.c:2500: |2| ssl->f_send() returned 430 (-0xfffffe52)
ssl_tls.c:2527: |2| <= flush output
ssl_tls.c:2926: |2| <= write record
ssl_cli.c:1090: |2| <= write client hello
ssl_cli.c:3391: |2| client state: 2
mbedtls_ssl_handshake_client_step ###############
ssl_tls.c:2475: |2| => flush output
ssl_tls.c:2487: |2| <= flush output
ssl_cli.c:1483: |2| => parse server hello
ssl_tls.c:3813: |2| => read record
ssl_tls.c:2256: |2| => fetch input
ssl_tls.c:2417: |2| in_left: 0, nb_want: 5
ssl_tls.c:2441: |2| in_left: 0, nb_want: 5
ssl_tls.c:2442: |2| ssl->f_recv(_timeout)() returned 5 (-0xfffffffb)
ssl_tls.c:2462: |2| <= fetch input
/error returned from here/
ssl_tls.c:3565: |3| input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c:2256: |2| => fetch input
ssl_tls.c:2417: |2| in_left: 5, nb_want: 7
ssl_tls.c:2441: |2| in_left: 5, nb_want: 7
ssl_tls.c:2442: |2| ssl->f_recv(_timeout)() returned 2 (-0xfffffffe)
ssl_tls.c:2462: |2| <= fetch input
ssl_tls.c:4104: |2| got an alert message, type: [2:40]
ssl_tls.c:4112: |1| is a fatal alert message (msg 40)
ssl_tls.c:3835: |1| mbedtls_ssl_handle_message_type() returned -30592 (-0x7780)
ssl_cli.c:1490: |1| mbedtls_ssl_read_record() returned -30592 (-0x7780)
ssl_tls.c:6730: |2| <= handshake
Looking at the log, the server I’m trying to connect give me a “fatal alert” message after adding ciphersuites.
About this I had some test whether the server provide correct ciphersuites
The server info is in the following
https://alexa-cdn.prod.reuters.tv/content/5minaudio 20180709_033003.mp3
about URL it has serveral DNS querry results wihch are
52.85.125.187
52.85.125.112
52.85.125.120
52.85.125.140
and I connected to 52.85.125.140 in the AVS code.
after getting “fatal alert” , I performed some command on the linux console.
nmap --script ssl-enum-ciphers -p 443 52.85.125.140
Starting Nmap 7.01 ( https://nmap.org ) at 2018-07-09 17:26 KST
Nmap scan report for server-52-85-125-140.icn50.r.cloudfront.net (52.85.125.140)
Host is up (0.0045s latency).
PORT STATE SERVICE
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 0.72 seconds.
As you can see, there’s no ciphersuites list which server giving.
so I tried rest of the URLs but it was also in vain.
However about other urls it gets correct response about the handshake,
and also the server provide supported cipher suites list by the console command.
only specific URL have this problem and when I get the handshake fail
the server do not provide correct ciphersuite list by the console command and I have no idea this symptom have to do with the reason of hand shake fails.
Any idea?
Thanks,
Soohwan.