Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to get it work at all?

I used this manual. I created a verifier file and started openssl s_server with a self-signed RSA certificate. Now I can't connect to it.

>gnutls-cli --srpusername user --srppasswd secret 127.0.0.1 -p 4433 --insecure
Processed 145 CA certificate(s).
Resolving '127.0.0.1'...
Connecting to '127.0.0.1:4433'...
*** Fatal error: A TLS fatal alert has been received.
*** Received alert [40]: Handshake failed
No certificates found!
*** Handshake has failed
GnuTLS error: A TLS fatal alert has been received.

Curl seems not to work too, but win32 binaries doesn't have SRP in "Features:" output from curl -V

Even openssl s_client stops working as far as I add -cipher SRP param.

openssl s_server -srpvfile xx.srp -tls1 -cipher SRP -cert ssl.crt -key ssl.key -www

-

Loading 'screen' into random state - done
CONNECTED(00000750)
2672:error:1407745B:SSL routines:SSL23_GET_SERVER_HELLO:reason(1115):.\ssl\s23_c
lnt.c:741:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 321 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

What now?

I'm using latest versions (OpenSSL 1.0.1e 11 Feb 2013, gnutls-3.0.22-w32, latest curl win32 build).

How should SRP accounts be registered?

Please add a tag for TLS-SRP

share|improve this question

migrated from security.stackexchange.com Mar 18 '13 at 7:02

This question came from our site for information security professionals.

    
How are you starting the server, and does your OpenSSL version even support TLS-SRP? (≥ 1.0.1) – grawity Mar 18 '13 at 10:14
    
Just read the manual. I use latest OpenSSL (OpenSSL 1.0.1e 11 Feb 2013). – Smit Johnth Mar 18 '13 at 21:18

These instructions worked for me using openssl 1.0.1e compiled on win32.

Step 1. create empty SRP password file passwd.txt

Step 2. Add a user to the SRP password file

openssl srp -srpvfile passwd.txt -userinfo "This is Myself" -add myself
Enter pass phrase for myself:
Verifying - Enter pass phrase for myself:

Step 3. Start SRP server

openssl s_server -nocert -cipher SRP -srpvfile passwd.txt -accept 444
Loading 'screen' into random state - done
Using default temp DH parameters
Using default temp ECDH parameters
ACCEPT

Step 4. Connect to server

openssl s_client -srpuser myself -cipher SRP -connect localhost:444
Loading 'screen' into random state - done
CONNECTED(00000108)
Enter pass phrase for SRP user:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 2407 bytes and written 1184 bytes
---
New, TLSv1/SSLv3, Cipher is SRP-AES-256-CBC-SHA
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : SRP-AES-256-CBC-SHA
    Session-ID: 69AE0C7ED831DCCDA0E79CB5ED55E0BF9C65CA64B4077585CF9DD93CEE611358
share|improve this answer
    
Well, this seem to work. Gratulate you to be the first at all who paid attention to this question! But! 1. Seems OpenSSL creates by default 8 kbit verifier, it's a little bit too long, 1.5-2 kbit should be enough. How to do this? There is a -gN parameter, what does it do? 2. How to use this outside of openssl console tool? Even gnutls example from the manual fails. – Smit Johnth May 22 '13 at 2:33
    
Hey! Come back please! – Smit Johnth May 31 '13 at 11:48
    
Hi @disk eater, I follow your instruction for Openssl version 1.0.1f. we need to remove the '-nocert' option in server setup and create the server.pem file – Dien Nguyen Aug 19 '15 at 3:38
    
Thanks a lot for your instruction @disk eater – Dien Nguyen Aug 19 '15 at 3:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .