0

I´d like to run

openssl s_server -key rsa_key.pem -cert rsa_cert.pem

that will accept Heartbeat extension. My client side

openssl s_client -connect localhost:4433 -key rsa_key.pem -cert rsa_cert.pem

is offering it at ClientHello, but server side don´t select it. What I need to do at running server side with accepting this extension?

Next question is - how I know at server side, that I got heartbeat request? Will I see it in terminal, that runs s_server? I tried Wireshark, but I dont know, how decrypt these encrypted messages. I tried adding key to Wireshark/Edit/Preferences, but it didnt helped.

1
  • Heartbeats use record type 24 (hex 18) and nothing else does, so you don't need to decrypt to identify them. However, for Wireshark to decrypt SSL/TLS using the server key (in legacy clear or PKCS12 format only) the connection must use a plain-RSA ciphersuite, not 'ephemeral' DHE-* or ECDHE-* (or anonymous, or weirder things like PSK or SRP) and OpenSSL's default cipherlist (like most) prefers ephemeral; simplest fix: specify e.g. -cipher AES128-SHA Feb 19, 2017 at 0:00

1 Answer 1

1

OpenSSL 1.0.2 supports TLS heartbeats. That capability was removed from OpenSSL 1.1.0. Therefore if you run s_client using version 1.0.2 and s_server using version 1.1.0 you will see the behaviour you are experiencing, i.e. heartbeat extension being offered but not accepted.

s_client/s_server do not tell you directly when they have received a HEARTBEAT request, although they tell you if they sent one, e.g. from s_client type "B" at the terminal and s_client will report "HEARTBEATING". On the s_server side all you will see is the message "Read BLOCK". This means that the server tried to read incoming data, but there wasn't any application data to display (because a Heartbeat isn't application data). Similarly you can do the same thing the other way around (i.e. issue "B" at the terminal from s_server).

You can get more information if you are willing to compile OpenSSL yourself. If you compile 1.0.2 using the the "enable-ssl-trace" option to "Configure" (or config) and then start s_server or s_client with the "-trace" option it will give you verbose information about the packets it is sending and receiving - including heartbeat packets.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .