CODEWITHSUNDEEP
sslgohttps
microo8
microo8

Reputation: 3794

ssl version and cipher suites of the client

I'm working on a soap server, that will serve some old embedded computers with an legacy soap protocol.

I write it in go and so far used just plain http, but in production it must use ssl encryption. So I've just created a key and a cert (from this site) and used the http.ListenAndServeTLS function.

But now the computers cannot connect and the server is just printing a handshake error:

server.go:2848: http: TLS handshake error from [::1]:38790: tls: no cipher suite supported by both client and server

In the docs, for the computers, isn't the supported ssl version or the ciphers. So I wanted to know, how to find out the client's ssl version, and also the available cipher suites that the client supports.

And then how can I configure the golang http server so it will support the selected ciphers.

Upvotes: 1

Views: 4777

Answers (1)

Marc
Marc

Reputation: 21145

There seems to be two questions here, so let's do this in two parts:

Finding the client's TLS version and supported cipher suites:

To do this, you need to set the GetConfigForClient field of the tls.Config object.

This field takes a method with signature:

func(*ClientHelloInfo) (*Config, error)

It is called on receipt of a Client Hello message with a ClientHelloInfo struct. This struct contains the following fields of interest to you:

    // CipherSuites lists the CipherSuites supported by the client (e.g.
    // TLS_RSA_WITH_RC4_128_SHA).
    CipherSuites []uint16

    // SupportedVersions lists the TLS versions supported by the client.
    // For TLS versions less than 1.3, this is extrapolated from the max
    // version advertised by the client, so values other than the greatest
    // might be rejected if used.
    SupportedVersions []uint16

Please read the comments around GetConfigForClient and ClientHelloInfo for exactly how GetConfigForClient should behave, and for field details.

Specifying server-supported version and cipher suites:

This is also done through the tls.Config object using the following fields:

    // CipherSuites is a list of supported cipher suites. If CipherSuites
    // is nil, TLS uses a list of suites supported by the implementation.
    CipherSuites []uint16

    // MinVersion contains the minimum SSL/TLS version that is acceptable.
    // If zero, then TLS 1.0 is taken as the minimum.
    MinVersion uint16

    // MaxVersion contains the maximum SSL/TLS version that is acceptable.
    // If zero, then the maximum version supported by this package is used,
    // which is currently TLS 1.2.
    MaxVersion uint16

For example, you could set your tls.Config with the following fields:

    CipherSuites: []uint16{
        tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
        etc...
        tls.TLS_RSA_WITH_AES_256_CBC_SHA,
    },

    MinVersion: tls.VersionTLS12,

The full list of supported cipher suites is in the tls docs.

Upvotes: 5

Related Questions