CODEWITHSUNDEEP
openssltls1.2
r13kumar
r13kumar

Reputation: 15

Anonymous Cipher not working with OpenSSL1.1.1-D

I am verifying the anonymous cipher support with OpenSSL-1.1.1-D but its failing with SSL routines:ssl_cipher_list_to_bytes:no ciphers available:ssl\statem\statem_clnt.c:3798:No ciphers enabled for max supported SSL/TLS version.

NOTE:: TLSv1.3 is disabled explicitly.

Kindly find the S_Server and S_Client results as below

OpenSSL S_Server

s_server -no_tls1_3 -cipher ADH-AES128-SHA:ADH-AES128-SHA256:ADH-AES256-SHA256 -state -accept localhost:14000 -nocert -msg

Using default temp DH parameters
ACCEPT
SSL_accept:before SSL initialization
TLS 1.0, Alert [length 0002], fatal unexpected_message
SSL3 alert write:fatal:unexpected_message
SSL_accept:error in error
ERROR
41244:error:140940F4:SSL routines:ssl3_read_bytes:unexpected message:ssl\record\rec_layer_s3.c:1477: shutting down SSL
CONNECTION CLOSED

OpenSSL S_Client

s_client -no_tls1_3 -cipher ADH-AES128-SHA256:ADH-AES256-SHA256 -state -connect localhost:14000 -msg

CONNECTED(00000168)
SSL_connect:before SSL initialization
TLS 1.2, Alert [length 0002], fatal internal_error
SSL3 alert write:fatal:internal error
SSL_connect:error in error 35516:error:141A90B5:SSL routines:ssl_cipher_list_to_bytes:no ciphers available:ssl\statem\statem_clnt.c:3798:No ciphers enabled for max supported SSL/TLS version
no peer certificate available
No client certificate CA names sent
SSL handshake has read 0 bytes and written 7 bytes
Verification: OK
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1573710105
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no

Upvotes: 0

Views: 2246

Answers (1)

skverma
skverma

Reputation: 66

Please try adding :@SECLEVEL=0 onto the end of your cipher strings, e.g.

-cipher "ADH-AES128-SHA:ADH-AES128-SHA256:ADH-AES256-SHA256:@SECLEVEL=0"

The anon ciphersuites are disabled in the default security level in OpenSSL 1.1.0+

Upvotes: 5

Related Questions