Ssl_Ctx_Set_Cipher_List() Paradoxically Causes "No Ciphers Available"
I'm Writing a Program That Communicates over Dtls Using Openssl with Rsa Certificates for Client and Server, Signed with X509_Sign(Cert, Private_Key...
I'm writing a program that communicates over DTLS using OpenSSL with RSA certificates for client and server, signed with X509_sign(cert, private_key, EVP_get_digestbyname("SHA384")).
When I do not restrict OpenSSL in selecting the cipher, it automatically chooses ECDHE-RSA-AES256-GCM-SHA384 to secure the connection (that is what SSL_get_cipher_list() returns after the handshake).
And in deed, I think this cipher is a really good option. It uses forward security and up-to-date ciphers.That's why I want to ensure that this cipher is always choosen by calling
assert(SSL_CTX_set_cipher_list(ctx, "ECDHE-RSA-AES256-GCM-SHA384") == 1);
in the beginning. However, when I do that, the handshake fails with
140737353926512:error:140F80B5:SSL routines:DTLS1_CLIENT_HELLO:no ciphers available:d1_clnt.c:851:
To me this behaviour is a bit paradox: If I let OpenSSL freely choose the cipher, it selects ECDHE-RSA-AES256-GCM-SHA384, but it I force it to use it it rejects. Like a teenager.
Does one of you have a clue what's wrong here?
1 Answer
We need to configure these as well:
After that, we can check the wireshark client.hello and server.hello result
-OpenSSL Preferences:
SSL_library_init();
OpenSSL_add_all_algorithms();
SSL_load_error_strings();
SSL_CTX *ctx= SSL_CTX_new(SSLv23_client_method());
// You can use server or client method whether represents your solution,
but in this solution, client creates the cipher pool and server side selects one of them.
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
// you need to use SSL_VERIFY_PEER because you are using a SSL certificate.
// otherwise we can use SSL_VERIFY_NONE
SSL_CTX_set_verify_depth(ctx, 50); // Passes an int for depth!
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); // Use only TLS v1 or later.
SSL_CTX_set_cipher_list(ctx, "HIGH:!aNULL:!eNULL:@STRENGTH"); // Setting tls1.2 ciphers!
SSL_CTX_set_ciphersuites(ctx, "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256"); // Setting tls1.3 ciphers!
-Diffie-Hellman groups!
int SSL_CTX_set1_groups_list(ctx, "X25519:X448"); // We can add some Diffie-Hellman groups
-Signature Algorithms
SSL_CTX_set1_sigalgs_list(ctx, "ECDSA+SHA256:RSA+SHA256"); // We can add some signature algorithms!
References:
- - - - - - -
Sarah Jenkins is a veteran tech journalist with over 12 years of experience covering artificial intelligence, mobile innovations, and digital ethics. Her insights have appeared in leading technology publications worldwide.
