2

I use a custom internal authentication server. With the last round of updates it started having issues, apparently due to a change in the ciphers. This is on a CentOS6 box, fully updated.

curl https://crowd.test.org:8443 \
   --cacert /etc/pki/ca-trust/source/anchors/ca.crt \
   -vvv
* About to connect() to crowd.test.org port 8443 (#0)
*   Trying 192.XXX.XXX.XXX... connected
* Connected to crowd.test.org (192.XXX.XXX.XXX) port 8443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/ca-trust/source/anchors/ca.crt
  CApath: none
* NSS error -12173
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error
You have mail in /var/mail/root

I checked with nmap and found a supported cipher, TLS_DHE_RSA_WITH_AES_128_CBC_SHA. Checked this on the curl site and found the following does indeed work.

curl https://crowd.mydomain.org:8443 --cacert \
  /etc/pki/ca-trust/source/anchors/ca2.crt \
  -vvv --tlsv1.0 --ciphers rsa_aes_128_sha

How do I correct this? I already used the downgrade method I'd traditionally use without success.

yum history 
yum history undo 106 
0

Based on https://mozilla.github.io/python-nss-docs/nss.error-module.html it looks like that's a sign that the server has a weak ephemeral Diffie-Hellman key:

SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY = -12173

On the servers I've seen this error, that was indeed the case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.