2

After a recent upgrade to openssl-1.1.0c I can't connect to the IMAP-Server at work anymore. Connecting to other IMAP-Servers (e.g. imap.gmx.de:993) works without problems, using the exact same command.

When trying to connect to the server using 

openssl s_client -connect mbox.uni-stuttgart.de:993

I am getting the following error:

CONNECTED(00000003)
140093138867328:error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter:ssl/record/rec_layer_s3.c:1388:SSL alert number 47

The server is running the CommuniGate Pro Suite.

Here's what I have tested so far:

  • Connecting from another machine with OpenSSL 1.0.1t works flawless.
  • Connecting to other secure services on the same target machine that offer SSLv3 (not e-mail related: Apache server) works flawless.

Any clues about why the connection to the e-mail related services lead to the error mentioned above would be highly appreciated!

Improve this question
3
  • If the server is public it would help to provide the URL so that one can check the server properties.
    – Steffen Ullrich
    Dec 6, 2016 at 9:54
  • @steffen The server resides at mbox.uni-stuttgart.de, I've updated my question accordingly.
    – xxm
    Dec 6, 2016 at 10:23
  • You should use both TLS 1.0 (or above) and Server Name Indication (SNI). Change your command to openssl s_client -connect mbox.uni-stuttgart.de:993 -tls1 -servername mbox.uni-stuttgart.de. I can connect with s_client using the additional parameters.
    – jww
    Dec 18, 2016 at 2:16

2 Answers 2

Reset to default
1

The server supports only DES-CBC3-SHA, RC4-SHA and RC4-MD5 as ciphers. These ciphers are no longer considered secure and thus they are not contained in the default cipher set in OpenSSL 1.1.0. From the changelog of 1.1.0:

... To mitigate the SWEET32 attack (CVE-2016-2183), 3DES cipher suites have been disabled by default and removed from DEFAULT
... RC4 based libssl ciphersuites are now classed as "weak" ciphers and are disabled by default.

You should still be able to connect to the server by explicitly allowing this ciphers, i.e. 

 openssl s_client -cipher 'RC4-SHA' ...
Improve this answer
0

openssl s_client -cipher ALL -connect … will get you through as long as ANY of the ciphers available on remote system is supported.

The generic format is the same used by many similar options in other software: cipher_spec[:cipher_spec]..., f.e. classic ALL:!aNULL:!EXPORT:!LOW:!RC4:+TLSv1.0, meaning "all, but exclude anonymous ciphers, exclude ciphers with export restrictions, exclude ciphers which were considered low-security at the library compile time, exclude ciphers based on RC4 and move TLSv1.0 support to the end of the list of negotiable protocols(ciphers)".

See https://www.openssl.org/docs/man1.1.1/man1/ciphers.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .