I'm getting error
NSS error -12286 while downloading a file from HTTPS using
I can download the same file without issues using
wget so I can exclude any firewall or blacklist issues.
Already tried, with no luck, options
--cipher ecdhe_ecdsa_aes_128_gcm_sha_256, that is the server preferred cipher according to Qualys SSL Labs Test Server tool here: https://www.ssllabs.com/ssltest/analyze.html?d=intribunale.net&latest
Here is the
# curl -v https://www.intribunale.net/immobili * About to connect() to www.intribunale.net port 443 (#0) * Trying 220.127.116.11... connected * Connected to www.intribunale.net (18.104.22.168) port 443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS error -12286 * Closing connection #0 * SSL connect error curl: (35) SSL connect error
My lib versions are:
# curl -V curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2 Protocols: tftp ftp telnet dict ldap ldaps http file https ftps scp sftp Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz
SSL_ERROR_NO_CYPHER_OVERLAP"Cannot communicate securely with peer: no common encryption algorithm(s)." The local and remote systems share no cipher suites in common. This can be due to a misconfiguration at either end. It can be due to a server being misconfigured to use a non-RSA certificate with the RSA key exchange algorithm.
--cipher[s]specifying that ECDHE suite, it doesn't even send ClientHello, just closes the connection and gives the error. This appears to be something out of sync internally, perhaps after RedHat's long denial of ECC. RedHat wget uses OpenSSL, and recent RedHat OpenSSL does support ECC (only with P256 P384 P521 but that's enough here).
stunnel(which uses openssl) as plain-to-SSL, tell curl
-H "Host: realhost"so the target server can't tell the difference. ...