Scott Haneda:
> Thanks for the estimation. Comparing a working transaction with one
> that does not work, shows no difference. The one part I need even
> more debug log data, only states "start tls" and then "failure". I
> somehow need to get to the data that happens between those two log
> lines.
OpenSSL does not like what the proxy sends. To find out where the
proxy errs, you will need to go beyond logfiles, and look at the
data that is actually sent over the wire.
As Tsutomu once said, tcpdump is your friend (*).
For example one mistake is to send STARTTLS in a network packet
that also contains the first portion of the TLS handshake. The
proxy should send STARTTLS, wait for a positives server reply, and
then it should send the TLS handshake.
If you can't figure out what OpenSSL does not like about what the
proxy sends, then you will have to find someone to do it for you.
I won't.
Wietse
(*) And as Dan Farmer replied, "No: tcpdump is YOUR friend", meaning
that not everyone has the stomach to dissect packet dumps.
