helpGnuTLS - Support: sr #106628, interoperability problem with some...

 
 

sr #106628: interoperability problem with some certificates

Submitted by:  Arkadiusz Miskiewicz <arekm>
Submitted on:  Tue 03 Feb 2009 06:19:21 PM UTC  
 
Category: NonePriority: 5 - Normal
Severity: 3 - NormalStatus: Invalid
Privacy: PublicAssigned to: Simon Josefsson <jas>
Open/Closed: ClosedOperating System: GNU/Linux

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 25 Aug 2009 08:17:55 AM UTC, comment #3:

Could you explain a little more of what is broken with these servers, so I could report that to owners of these servers?

New broken server is http://www.centrum24.pl. Don't know if this is the same issue.

All these servers are... banks, huh.

I wonder how openssl handles these servers since with openssl there is no such interoperability problem while I wanted to avoid openssl and use gnutls.

Arkadiusz Miskiewicz <arekm>
Thu 16 Apr 2009 11:17:08 PM UTC, comment #2:

The server is buggy, to talk to it you need to disable ALL of:

1) any extension
2) MAC padding
3) offer of TLS 1.1

You can talk to the server by using:

jas@mocca:~$ gnutls-cli -p 443 http://www.mbank.com.pl --priority NORMAL:-CTYPE-OPENPGP:-VERS-TLS1.1:%COMPAT --disable-extensions

I'm closing since I don't see anything more we can do, if you think otherwise please re-open.

/Simon

Simon Josefsson <jas>
Project AdministratorIn charge of this item.
Sat 07 Feb 2009 05:16:59 PM UTC, comment #1:

version 2.7.5

[arekm@carme-pld ~/gnutls-test/bin]$ ./gnutls-cli -p 443 http://www.mbank.com.pl
Resolving 'http://www.mbank.com.pl'...
Connecting to '193.41.230.81:443'...

      • Fatal error: A TLS packet with unexpected length was received.
      • Handshake has failed

GNUTLS ERROR: A TLS packet with unexpected length was received.
zsh: exit 1 ./gnutls-cli -p 443 http://www.mbank.com.pl
[arekm@carme-pld ~/gnutls-test/bin]$ ./gnutls-cli -version
./gnutls-cli (GnuTLS) 2.7.5
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Nikos Mavrogiannopoulos.

Arkadiusz Miskiewicz <arekm>
Tue 03 Feb 2009 06:19:21 PM UTC, original submission:

$ gnutls-cli -p 443 http://www.mbank.com.pl
Resolving 'http://www.mbank.com.pl'...
Connecting to '193.41.230.81:443'...

      • Fatal error: A TLS packet with unexpected length was received.
      • Handshake has failed

GNUTLS ERROR: A TLS packet with unexpected length was received.
zsh: exit 1 gnutls-cli -p 443 http://www.mbank.com.pl

$ gnutls-cli --version
gnutls-cli (GnuTLS) 2.6.3
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Nikos Mavrogiannopoulo

Arkadiusz Miskiewicz <arekm>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jas (Posted a comment)
  • -unavailable- added by arekm (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 16 Apr 2009 11:17:08 PM UTCjasStatusNone=>Invalid
      Assigned toNone=>jas
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup