I use a custom internal authentication server. With the last round of updates it started having issues, apparently due to a change in the ciphers. This is on a CentOS6 box, fully updated.
curl https://crowd.test.org:8443 \ --cacert /etc/pki/ca-trust/source/anchors/ca.crt \ -vvv * About to connect() to crowd.test.org port 8443 (#0) * Trying 192.XXX.XXX.XXX... connected * Connected to crowd.test.org (192.XXX.XXX.XXX) port 8443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/ca-trust/source/anchors/ca.crt CApath: none * NSS error -12173 * Closing connection #0 * SSL connect error curl: (35) SSL connect error You have mail in /var/mail/root
I checked with nmap and found a supported cipher, TLS_DHE_RSA_WITH_AES_128_CBC_SHA. Checked this on the curl site and found the following does indeed work.
curl https://crowd.mydomain.org:8443 --cacert \ /etc/pki/ca-trust/source/anchors/ca2.crt \ -vvv --tlsv1.0 --ciphers rsa_aes_128_sha
How do I correct this? I already used the downgrade method I'd traditionally use without success.
yum history yum history undo 106