On Mon, Jun 10, 2019 at 03:21:16PM +0000, Patrick Regnouf via openssl-users wrote:
> All is well and good when the program works on the linux PC and the > handshake is succesful using the 0xc02f cipher. and that is linked to > version 3.0.0 of openssl. on the embedded version, (linked with version > 1.0.2s) firefox fails the handshake with ssl_no_shared_cipher whereas > chrome and safari do successfully handshake chrome client hello contains > 12 ciphers and the server hello seems to choose 0xc02f cipher firefox > client hello contains only 10 ciphers (including the above mentioned 0xc02f > cipher) and fails. any suggestion as to what could causes that failure > would be appreciated. In addition to the cipher algorithm, the two parties must also agree on the signature algorithms, supported EC groups, ... You've not provided much detail about the configuration of the embedded (1.0.2s) server. The cipher that works with the other browsers is: 0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD this requires a shared ECDHE curve, are you using "auto", or an explicit curve? What are the signature algorithms on your certificate chain? It would also be useful to post PCAP files of a working handshake with Chrome, and a failing handshake with Firefox. -- Viktor.