On 1/4/2012 6:36 PM, [email protected] wrote:
Hello,
I have a problem using SSL. When I click run, it immediately logs
off. I look at the log and I see:
LOG5[5748:5472]: stunnel 4.50 on x86-pc-mingw32-gnu platform
2012.01.04 11:28:29 LOG5[5748:5472]: Compiled/running with OpenSSL
0.9.8r-fips 8 Feb 2011
2012.01.04 11:28:29 LOG5[5748:5472]: Threading:WIN32 SSL:ENGINE,FIPS
Auth:none Sockets:SELECT,IPv6
2012.01.04 11:28:29 LOG5[5748:5472]: Reading configuration from file
stunnel.conf
2012.01.04 11:28:29 LOG5[5748:5472]: FIPS mode enabled
2012.01.04 11:28:29 LOG5[5748:5472]: Configuration successful
2012.01.04 11:28:49 LOG5[5748:968]: Service Service Name accepted
connection from 127.0.0.1:50853 <http://127.0.0.1:50853>
2012.01.04 11:28:49 LOG5[5748:968]: connect_blocking: connected
63.111.184.124:442 <http://63.111.184.124:442>
2012.01.04 11:28:49 LOG5[5748:968]: Service Service Name connected
remote server from 192.168.1.64:50854 <http://192.168.1.64:50854>
2012.01.04 11:28:49 LOG3[5748:968]: error queue: 14098005:
error:14098005:SSL routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib
2012.01.04 11:28:49 LOG3[5748:968]: SSL_connect: 5067068:
error:05067068:Diffie-Hellman routines:GENERATE_KEY:key size too small
2012.01.04 11:28:49 LOG5[5748:968]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2012.01.04 11:28:50 LOG5[5748:3972]: Service Service Name accepted
connection from 127.0.0.1:50855 <http://127.0.0.1:50855>
2012.01.04 11:28:50 LOG5[5748:3972]: connect_blocking: connected
63.111.184.124:442 <http://63.111.184.124:442>
2012.01.04 11:28:50 LOG5[5748:3972]: Service Service Name connected
remote server from 192.168.1.64:50856 <http://192.168.1.64:50856>
2012.01.04 11:28:50 LOG3[5748:3972]: error queue: 14098005:
error:14098005:SSL routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib
2012.01.04 11:28:50 LOG3[5748:3972]: SSL_connect: 5067068:
error:05067068:Diffie-Hellman routines:GENERATE_KEY:key size too small
2012.01.04 11:28:50 LOG5[5748:3972]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2012.01.04 11:29:20 LOG5[5748:656]: Service Service Name accepted
connection from 127.0.0.1:50859 <http://127.0.0.1:50859>
2012.01.04 11:29:20 LOG5[5748:656]: connect_blocking: connected
63.111.184.124:442 <http://63.111.184.124:442>
2012.01.04 11:29:20 LOG5[5748:656]: Service Service Name connected
remote server from 192.168.1.64:50860 <http://192.168.1.64:50860>
2012.01.04 11:29:20 LOG3[5748:656]: error queue: 14098005:
error:14098005:SSL routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib
2012.01.04 11:29:20 LOG3[5748:656]: SSL_connect: 5067068:
error:05067068:Diffie-Hellman routines:GENERATE_KEY:key size too small
2012.01.04 11:29:20 LOG5[5748:656]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2012.01.04 11:29:50 LOG5[5748:4640]: Service Service Name accepted
connection from 127.0.0.1:50861 <http://127.0.0.1:50861>
2012.01.04 11:29:50 LOG5[5748:4640]: connect_blocking: connected
63.111.184.124:442 <http://63.111.184.124:442>
2012.01.04 11:29:50 LOG5[5748:4640]: Service Service Name connected
remote server from 192.168.1.64:50862 <http://192.168.1.64:50862>
2012.01.04 11:29:50 LOG3[5748:4640]: error queue: 14098005:
error:14098005:SSL routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib
2012.01.04 11:29:50 LOG3[5748:4640]: SSL_connect: 5067068:
error:05067068:Diffie-Hellman routines:GENERATE_KEY:key size too small
2012.01.04 11:29:50 LOG5[5748:4640]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2012.01.04 11:30:20 LOG5[5748:4244]: Service Service Name accepted
connection from 127.0.0.1:50863 <http://127.0.0.1:50863>
2012.01.04 11:30:20 LOG5[5748:4244]: connect_blocking: connected
63.111.184.124:442 <http://63.111.184.124:442>
2012.01.04 11:30:20 LOG5[5748:4244]: Service Service Name connected
remote server from 192.168.1.64:50864 <http://192.168.1.64:50864>
2012.01.04 11:30:20 LOG3[5748:4244]: error queue: 14098005:
error:14098005:SSL routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib
2012.01.04 11:30:20 LOG3[5748:4244]: SSL_connect: 5067068:
error:05067068:Diffie-Hellman routines:GENERATE_KEY:key size too small
2012.01.04 11:30:20 LOG5[5748:4244]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2012.01.04 11:30:50 LOG5[5748:4260]: Service Service Name accepted
connection from 127.0.0.1:50865 <http://127.0.0.1:50865>
2012.01.04 11:30:50 LOG5[5748:4260]: connect_blocking: connected
63.111.184.124:442 <http://63.111.184.124:442>
2012.01.04 11:30:50 LOG5[5748:4260]: Service Service Name connected
remote server from 192.168.1.64:50866 <http://192.168.1.64:50866>
2012.01.04 11:30:50 LOG3[5748:4260]: error queue: 14098005:
error:14098005:SSL routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib
2012.01.04 11:30:50 LOG3[5748:4260]: SSL_connect: 5067068:
error:05067068:Diffie-Hellman routines:GENERATE_KEY:key size too small
2012.01.04 11:30:50 LOG5[5748:4260]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2012.01.04 11:31:20 LOG5[5748:4600]: Service Service Name accepted
connection from 127.0.0.1:50868 <http://127.0.0.1:50868>
2012.01.04 11:31:20 LOG5[5748:4600]: connect_blocking: connected
63.111.184.124:442 <http://63.111.184.124:442>
2012.01.04 11:31:20 LOG5[5748:4600]: Service Service Name connected
remote server from 192.168.1.64:50869 <http://192.168.1.64:50869>
2012.01.04 11:31:20 LOG3[5748:4600]: error queue: 14098005:
error:14098005:SSL routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib
2012.01.04 11:31:20 LOG3[5748:4600]: SSL_connect: 5067068:
error:05067068:Diffie-Hellman routines:GENERATE_KEY:key size too small
2012.01.04 11:31:20 LOG5[5748:4600]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2012.01.04 11:31:50 LOG5[5748:5900]: Service Service Name accepted
connection from 127.0.0.1:50870 <http://127.0.0.1:50870>
2012.01.04 11:31:50 LOG5[5748:5900]: connect_blocking: connected
63.111.184.124:442 <http://63.111.184.124:442>
2012.01.04 11:31:50 LOG5[5748:5900]: Service Service Name connected
remote server from 192.168.1.64:50871 <http://192.168.1.64:50871>
2012.01.04 11:31:50 LOG3[5748:5900]: error queue: 14098005:
error:14098005:SSL routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib
2012.01.04 11:31:50 LOG3[5748:5900]: SSL_connect: 5067068:
error:05067068:Diffie-Hellman routines:GENERATE_KEY:key size too small
2012.01.04 11:31:50 LOG5[5748:5900]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
2012.01.04 11:32:20 LOG5[5748:4640]: Service Service Name accepted
connection from 127.0.0.1:50872 <http://127.0.0.1:50872>
2012.01.04 11:32:20 LOG5[5748:4640]: connect_blocking: connected
63.111.184.124:442 <http://63.111.184.124:442>
2012.01.04 11:32:20 LOG5[5748:4640]: Service Service Name connected
remote server from 192.168.1.64:50873 <http://192.168.1.64:50873>
2012.01.04 11:32:20 LOG3[5748:4640]: error queue: 14098005:
error:14098005:SSL routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib
2012.01.04 11:32:20 LOG3[5748:4640]: SSL_connect: 5067068:
error:05067068:Diffie-Hellman routines:GENERATE_KEY:key size too small
2012.01.04 11:32:20 LOG5[5748:4640]: Connection reset: 0 bytes sent to
SSL, 0 bytes sent to socket
Can you please tell me how to fix this?
Regards,
*/Vaneita Howell, AVP/*//
*/Technical Account Manager/*//
*/State Street eExchange Solutions /*
I am afraid more context is needed to understand this issue (what is the
server,
how is it configured, what crypto options are set on the server and
client etc.).
However the error messages seem to indicate that something (probably the
other end of the connection) has specified a very insecure (much less than
1024 bits) cryptographic key size to be used with the Diffie-Hellman public
key algorithm.
Alternatively, something is wrong on a fundamental protocol level and the
old OpenSSL library in your copy of stunnel misunderstands completely,
spitting out nonsense error messages.
Of cause there is also the possibility that you are under attack and the
attacker is trying to mess with the encryption in a way that OpenSSL
is actually detecting and blocking to protect you.
--
Jakob Bohm, CIO, WiseMo A/S,<http://www.wisemo.com>
This public comment is non-binding and may contain errors.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
