Re: TLS with HPUX problem

[Philip Guenther <guenther+ldapsoft@sendmail.com>]

On Wed, 28 May 2008, Michael Ströder wrote:
> Adam Leach wrote:
> > TLS trace: SSL_accept:error in SSLv2/v3 read client hello A
> > TLS: can't accept.
> > TLS: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 
> > s23_srvr.c:580
>
> Looks like your client trys to negotiate the SSLv23 protocol variant and your 
> server does not accept this. You might have a look at the client's 
> configuration to enforce SSLv3 or TLSv1. You should avoid using SSLv2 for 
> security reasons anyway.

"SSLv23" is OpenSSL's name for the version negotiation code, handling the 
choice between SSLv2, SSLv3, and TLSv1.  Support for specific versions can 
be disabled using the SSL_{,CTX_}set_options() functions...which OpenLDAP 
doesn't call.  With that ruled out, it looks from the OpenSSL code that 
the "unknown protocol" error would only be generated when the client sent 
something that didn't look like either the SSLv2 format or the SSLv3/TLS 
format, such as if it sent normal LDAP on the ldaps port.


Philip Guenther