mainGnuTLS - Support: sr #106628, interoperability problem with some...

 
 

sr #106628: interoperability problem with some certificates

Submitter:  Arkadiusz Miskiewicz <arekm>
Submitted:  Tue 03 Feb 2009 06:19:21 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  Invalid
Privacy:  Public Assigned to:  jas
Open/Closed:  Closed Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 25 Aug 2009 08:17:55 AM UTC, comment #3: 

Could you explain a little more of what is broken with these servers, so I could report that to owners of these servers?

New broken server is www.centrum24.pl. Don't know if this is the same issue.

All these servers are... banks, huh.

I wonder how openssl handles these servers since with openssl there is no such interoperability problem while I wanted to avoid openssl and use gnutls.

Arkadiusz Miskiewicz <arekm>
Thu 16 Apr 2009 11:17:08 PM UTC, comment #2: 

The server is buggy, to talk to it you need to disable ALL of:

1) any extension
2) MAC padding
3) offer of TLS 1.1

You can talk to the server by using:

jas@mocca:~$ gnutls-cli  -p 443 www.mbank.com.pl  --priority NORMAL:-CTYPE-OPENPGP:-VERS-TLS1.1:%COMPAT --disable-extensions

I'm closing since I don't see anything more we can do, if you think otherwise please re-open.

/Simon

Simon Josefsson <jas>
Group administrator
Sat 07 Feb 2009 05:16:59 PM UTC, comment #1: 


version 2.7.5

[arekm@carme-pld ~/gnutls-test/bin]$ ./gnutls-cli -p 443 www.mbank.com.pl
Resolving 'www.mbank.com.pl'...
Connecting to '193.41.230.81:443'...
* Fatal error: A TLS packet with unexpected length was received.
* Handshake has failed
GNUTLS ERROR: A TLS packet with unexpected length was received.
zsh: exit 1     ./gnutls-cli -p 443 www.mbank.com.pl
[arekm@carme-pld ~/gnutls-test/bin]$ ./gnutls-cli -version
./gnutls-cli (GnuTLS) 2.7.5
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Nikos Mavrogiannopoulos.

Arkadiusz Miskiewicz <arekm>
Tue 03 Feb 2009 06:19:21 PM UTC, original submission:  

$ gnutls-cli -p 443 www.mbank.com.pl
Resolving 'www.mbank.com.pl'...
Connecting to '193.41.230.81:443'...
* Fatal error: A TLS packet with unexpected length was received.
* Handshake has failed
GNUTLS ERROR: A TLS packet with unexpected length was received.
zsh: exit 1     gnutls-cli -p 443 www.mbank.com.pl


$ gnutls-cli --version
gnutls-cli (GnuTLS) 2.6.3
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Nikos Mavrogiannopoulo

Arkadiusz Miskiewicz <arekm>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jas (Posted a comment)
  • -email is unavailable- added by arekm (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-04-16 jas StatusNone Invalid
        Assigned toNone jas
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code