On Fri, 10 Jan 2003, Ken Murchison wrote:
> Steve Huston wrote:
> > Now, our current Cyrus server has a self-signed cert which Pine doesn't like
> > unless you add /novalidate-cert to the hostname of the server. But this time,
> > that doesn't even help as it just says "There was an SSL/TLS failure for the
> > server" "The reason for the failure was: SSL Negotiation failed" Cyrus also
> > reports the same thing in the logs. I understand the point of
> > '/novalidate-cert', meaning don't try to check the signing authority on the
>
> I just tested Pine 4.44 against my Cyrus 2.1.11 using a self-signed cert
> (/novalidate-cert) and it works fine. Below is the output from ssldump
> (http://www.rtfm.com/ssldump/) for reference. I'd use ssldump to see
> where in the negotiation it fails.
Ahh, that's just what I needed. Thanks!
Now, armed with something to decode the packets, I may have found at least
somewhat closer to what the problem is:
> 1 2 0.1424 (0.0016) S>C Handshake
> ServerHello
> Version 3.1
> session_id[32]=
> ce 24 19 9e 16 7a da 4a 2d 2d f7 ef 83 24 ff 55
> 19 3d 31 9b 72 9f b9 57 17 bc 61 4a 38 4c c5 4d
> cipherSuite TLS_RSA_WITH_3DES_EDE_CBC_SHA
> compressionMethod NULL
> 1 3 0.1424 (0.0000) S>C Handshake
> Certificate
That's what yours showed... I got up to the same point:
1 2 0.7860 (0.0028) S>C Handshake
ServerHello
Version 3.1
session_id[32]=
d0 7e 52 7d 5e db fe 0f dc 8d de 61 a5 1c 37 00
b2 ec 36 9e 0d 41 cd d0 f8 1d 8c 2b 20 d3 11 ee
cipherSuite TLS_RSA_WITH_3DES_EDE_CBC_SHA
compressionMethod NULL
1 3 0.7860 (0.0000) S>C Handshake
Certificate
ERROR: Length mismatch
[root@diomedes root]#
Hmm... now I'm completely confused. Now if I try to connect via port 993, it
works perfectly fine with the same cert and all. But ... I think I'm more
puzzled now than I was before. I'm using the same versions of Cyrus and Pine
that you tried it on.
--
Steve Huston - Unix Systems Administrator, Dept. of Astrophysical Sciences
Princeton University | ICBM Address: 40.346525 -74.651285
126 Peyton Hall |"On my ship, the Rocinante, wheeling through
Princeton, NJ 08544 | the galaxies; headed for the heart of Cygnus,
(609) 258-7375 | headlong into mystery." -Rush, 'Cygnus X-1'
