Re: [Dovecot] using ecc-certificates (ellyptic curve) will not establish connection
hi building 2.0.15 (f6a2c0e8bc03) against the 10.0e ssl-libs _WORKS_ (on some parts ;) Note: be careful on the client-side as many clients won't understand these types of certificates check the version of openssl if you have problems ... a client on OS X 10.6 (OpenSSL 0.9.8r 8 Feb 2011) gives the folowing error # openssl s_client -host remoteserver -port 993 CONNECTED(0003) 8346:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:/SourceCache/OpenSSL098/OpenSSL098-35.1/src/ssl/s23_clnt.c:602: ==> /var/log/mail.log <== dovecot: imap-login: Disconnected (no auth attempts): rip=, lip=, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher well - THIS would work (for debuging :) # openssl s_client -host remoteserver -port 993 -cipher ECCdraft Greetings Mike Am 09.10.2011 um 16:21 schrieb Fresel Michal - hi competence e.U.: > hi > > I want to use ECC(ellyptic curve cryptography) for SSL-connections but > somehow dovecot doesn't like my ECC-certificates :( > > I tried to test using following scenario: > > > machine: > debian 6 (x64) > dovecot 2.0.15-0~auto+21 ((f6a2c0e8bc03) from http://xi.rename-it.nl/debian > openssl 1.0.0e-2 from testing (as the default 0.9.8o-4squeeze3 needs also the > parameter -cipher ECCdraft for testing) > > > > creating keys+cert for ecc (i.e. curves prime192v1, secp521r1) > # openssl ecparam -name prime192v1 -genkey -out prime192v1.key > # openssl req -new -key prime192v1.key -out prime192v1.csr > # openssl req -x509 -in prime192v1.csr -key prime192v1.key -out > prime192v1.crt > > testing these in 2 windows > # openssl s_server -cert prime192v1.crt -key prime192v1.key -www > # openssl s_client > note: when using the default openssl version 0.9.8o-4squeeze3 you need to > append -cipher ECCdraft > > > output (cut) > ... > New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES256-SHA > Server public key is 192 bit > Secure Renegotiation IS supported > Compression: zlib compression > Expansion: zlib compression > SSL-Session: >Protocol : SSLv3 >Cipher: ECDHE-ECDSA-AES256-SHA >Session-ID: x >Session-ID-ctx: >Master-Key: x >Key-Arg : None >PSK identity: None >PSK identity hint: None >Compression: 1 (zlib compression) >Start Time: x >Timeout : 7200 (sec) >Verify return code: 18 (self signed certificate) > > > looks promising - also for the secp521r1 curve > > > but when changing dovecot.conf to use these keys and certificates it won't > use them and return errors > > # openssl s_client -port 993 > CONNECTED(0003) > 140543456835240:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert > handshake failure:s3_pkt.c:1195:SSL alert number 40 > 140543456835240:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake > failure:s3_pkt.c:591: > --- > no peer certificate available > --- > No client certificate CA names sent > --- > SSL handshake has read 7 bytes and written 0 bytes > --- > New, (NONE), Cipher is (NONE) > Secure Renegotiation IS NOT supported > Compression: NONE > Expansion: NONE > SSL-Session: >Protocol : SSLv3 >Cipher: >Session-ID: >Session-ID-ctx: >Master-Key: >Key-Arg : None >PSK identity: None >PSK identity hint: None >Start Time: x >Timeout : 7200 (sec) >Verify return code: 0 (ok) > --- > > and the log gives (using verbose_ssl = yes in dovecot.conf) > > ==> /var/log/mail.log <== > dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept > initialization [127.0.0.1] > > ==> /var/log/mail.info <== > dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept > initialization [127.0.0.1] > > ==> /var/log/mail.warn <== > dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept > initialization [127.0.0.1] > > ==> /var/log/mail.log <== > dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept > initialization [127.0.0.1] > > ==> /var/log/mail.info <== > dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept > initialization [127.0.0.1] > > ==> /var/log/mail.warn <== > dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept > initialization [127.0.0.1] > > ==> /var/log/mail.log <== > dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal > handshake failure [127.0.0.1] > > ==> /var/log/mail.info <== > dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal > handshake failure [127.0.0.1] > > ==> /var/log/mail.warn <== > dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal > handshake failure [127.0.0.1] > > ==> /var/log/mail.log <== > dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client > hello C [127.0.0.1] > > ==> /var/log/mail.info <== > dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client > hello C [127.0.0.1] > > ==> /var/log/mail.
[Dovecot] using ecc-certificates (ellyptic curve) will not establish connection
hi I want to use ECC(ellyptic curve cryptography) for SSL-connections but somehow dovecot doesn't like my ECC-certificates :( I tried to test using following scenario: machine: debian 6 (x64) dovecot 2.0.15-0~auto+21 ((f6a2c0e8bc03) from http://xi.rename-it.nl/debian openssl 1.0.0e-2 from testing (as the default 0.9.8o-4squeeze3 needs also the parameter -cipher ECCdraft for testing) creating keys+cert for ecc (i.e. curves prime192v1, secp521r1) # openssl ecparam -name prime192v1 -genkey -out prime192v1.key # openssl req -new -key prime192v1.key -out prime192v1.csr # openssl req -x509 -in prime192v1.csr -key prime192v1.key -out prime192v1.crt testing these in 2 windows # openssl s_server -cert prime192v1.crt -key prime192v1.key -www # openssl s_client note: when using the default openssl version 0.9.8o-4squeeze3 you need to append -cipher ECCdraft output (cut) ... New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES256-SHA Server public key is 192 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : SSLv3 Cipher: ECDHE-ECDSA-AES256-SHA Session-ID: x Session-ID-ctx: Master-Key: x Key-Arg : None PSK identity: None PSK identity hint: None Compression: 1 (zlib compression) Start Time: x Timeout : 7200 (sec) Verify return code: 18 (self signed certificate) looks promising - also for the secp521r1 curve but when changing dovecot.conf to use these keys and certificates it won't use them and return errors # openssl s_client -port 993 CONNECTED(0003) 140543456835240:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1195:SSL alert number 40 140543456835240:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:591: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher: Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None Start Time: x Timeout : 7200 (sec) Verify return code: 0 (ok) --- and the log gives (using verbose_ssl = yes in dovecot.conf) ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] ==> /var/log/mail.log <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher ==> /var/log/mail.info <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher ==> /var/log/mail.warn <== dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client hello C [127.0.0.1] from doveconf -a: ssl = required ssl_ca = ssl_cert =
