On Wed, Jan 04, 2012, [email protected] wrote: > > Hello, > > I have a problem using SSL. When I click run, it immediately logs off. I > look at the log and I see: > > > LOG5[5748:5472]: stunnel 4.50 on x86-pc-mingw32-gnu platform > 2012.01.04 11:28:29 LOG5[5748:5472]: Compiled/running with OpenSSL > 0.9.8r-fips 8 Feb 2011 > 2012.01.04 11:28:29 LOG5[5748:5472]: Threading:WIN32 SSL:ENGINE,FIPS > Auth:none Sockets:SELECT,IPv6 > 2012.01.04 11:28:29 LOG5[5748:5472]: Reading configuration from file > stunnel.conf > 2012.01.04 11:28:29 LOG5[5748:5472]: FIPS mode enabled > 2012.01.04 11:28:29 LOG5[5748:5472]: Configuration successful > 2012.01.04 11:28:49 LOG5[5748:968]: Service Service Name accepted connection > from 127.0.0.1:50853<http://127.0.0.1:50853> > 2012.01.04 11:28:49 LOG5[5748:968]: connect_blocking: connected > 63.111.184.124:442<http://63.111.184.124:442> > 2012.01.04 11:28:49 LOG5[5748:968]: Service Service Name connected remote > server from 192.168.1.64:50854<http://192.168.1.64:50854> > 2012.01.04 11:28:49 LOG3[5748:968]: error queue: 14098005: error:14098005:SSL > routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib > 2012.01.04 11:28:49 LOG3[5748:968]: SSL_connect: 5067068: > error:05067068:Diffie-Hellman routines:GENERATE_KEY:key size too small > > Can you please tell me how to fix this? >
The above problem is cause by FIPS mode refusing to generate a DH key smaller than 1024 bits. This is caused by the parameters on the server which would need to be updated to be at least 1024 bits: this is advisable anyway for security reasons. A temporary alternative is to disable the use of EDH ciphersuites in the client and only use the static RSA ones. That does however mean you lose forward secrecy. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
