{"id":52,"date":"2004-05-21T07:59:47","date_gmt":"2004-05-21T11:59:47","guid":{"rendered":"http:\/\/blogs.law.harvard.edu\/rlucastemp\/2004\/05\/21\/fix-apacheopenssl-wont-talk-to-som"},"modified":"2004-05-21T07:59:47","modified_gmt":"2004-05-21T11:59:47","slug":"fix-apacheopenssl-wont-talk-to-some-browsers-with-ssl3_get_client_h","status":"publish","type":"post","link":"https:\/\/archive.blogs.harvard.edu\/rlucastemp\/2004\/05\/21\/fix-apacheopenssl-wont-talk-to-some-browsers-with-ssl3_get_client_h\/","title":{"rendered":"[FIX] Apache\/OpenSSL won’t talk to some browsers, with SSL3_GET_CLIENT_HELLO:no shared cipher"},"content":{"rendered":"

<\/a><\/p>\n

If you are finding that some browsers are talking to your new Apache\/OpenSSL install,
\nwhile some are pulling a total blank (looks like a connection refused
\nor server not found), and you are getting this error:<\/p>\n

OpenSSL: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher [Hint: Too restrictive SSLCipherSuite or using <\/span>DSA server certificate?]
\n
\n<\/span><\/span><\/div>\n

<\/span><\/span><\/span>…
\nthen heed the warning.  You are likely using the DSA server
\ncertificate that comes with some fresh installs.  Check your cert
\ndirectories:<\/p>\n

ls -l \/etc\/httpd\/conf\/ssl.crt
\n<\/span>ls -l \/etc\/httpd\/conf\/ssl.key
\n<\/span><\/span><\/div>\n

\nDo you see that your server.crt (or whatever your httpd.conf defines as
\nyour cert) and your server.key (or whatever is your key) are symbolic
\nlinks to the default “snakeoil” certs?<\/p>\n

server.crt -> snakeoil-dsa.crt
\nserver.key -> snakeoil-dsa.key
\n<\/span><\/div>\n



\nOk, then you might have better luck in using the RSA versions, which play nice with more browsers:<\/span><\/p>\n

<\/span><\/p>\n

mv server.crt server.crt.orig
\nln -s snakeoil-rsa.crt server.crt<\/p>\n

mv server.key server.key.orig
\n<\/span><\/div>\n

<\/span><\/span><\/p>\n

ln -s snakeoil-rsa.key server.key<\/p>\n

apachectl stop && apachectl start
\n<\/span><\/div>\n



\n(Remembering that with Apache, when playing with SSL stuff, do a full stop and start upon making changes — a HUP won’t cut it)<\/span><\/p>\n


\nAs per all recommendations, do away with the snakeoil stuff ASAP and certainly before putting anything up on a public network.<\/span>
\n<\/span><\/span>
\nCAVEAT: Do not use this advice for production.  This advice should
\nonly be used for your own dev or testing, in order to get a fresh
\ninstall at least nominally working.  If you want real SSL and
\ncan’t figure it out, pay someone, because your security is worth it.<\/p>\n","protected":false},"excerpt":{"rendered":"

If you are finding that some browsers are talking to your new Apache\/OpenSSL install, while some are pulling a total blank (looks like a connection refused or server not found), and you are getting this error: OpenSSL: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher [Hint: Too restrictive SSLCipherSuite or using DSA server certificate?] … then heed the warning.  […]<\/p>\n","protected":false},"author":1180,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1460],"tags":[],"class_list":["post-52","post","type-post","status-publish","format-standard","hentry","category-rlucasstories"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/archive.blogs.harvard.edu\/rlucastemp\/wp-json\/wp\/v2\/posts\/52","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/archive.blogs.harvard.edu\/rlucastemp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/archive.blogs.harvard.edu\/rlucastemp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/rlucastemp\/wp-json\/wp\/v2\/users\/1180"}],"replies":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/rlucastemp\/wp-json\/wp\/v2\/comments?post=52"}],"version-history":[{"count":0,"href":"https:\/\/archive.blogs.harvard.edu\/rlucastemp\/wp-json\/wp\/v2\/posts\/52\/revisions"}],"wp:attachment":[{"href":"https:\/\/archive.blogs.harvard.edu\/rlucastemp\/wp-json\/wp\/v2\/media?parent=52"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/rlucastemp\/wp-json\/wp\/v2\/categories?post=52"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/rlucastemp\/wp-json\/wp\/v2\/tags?post=52"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}