On Sat, Jan 23, 2010, Dr. Stephen Henson wrote: > On Fri, Jan 22, 2010, Michael Stone wrote: > > > > > This certainly looks like a 12-byte verify_data field encoded as a > > variable-length vector (i.e. prefixed with a 1-byte length). > > > > 6. We receive a fatal unexpected_message alert: > > > > <<< TLS 1.0 Alert [length 0002], fatal unexpected_message > > 02 0a > > > > 7. The end. > > > > ## Questions > > > > 1. Everything looks good until we get the unexpected_message > > alert. Is there some reason why we should expect to see it? > > > > Just a quick note. I can reproduce this now and I'm investigating it further. >
I've traced the cause this was *fun*. The full story is in: http://cvs.openssl.org/chngview?cn=19145 This is a case of a bug in OpenSSL (PR#1949) being fixed but a related bug in Apache still existing in older versions. The clue to this was that the hello request message was never sent back to the client. As a result it never initiated the renegotiation handsgake and appeared to refuse the renegotiation request (which we regard as a fatal error) and that was the result. The above patch should address this, if you trace the reference in PR#1949 you'll also see and Apache only fix for this. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org
