Stunnel “wrong version number” error with TLS-PSKInternet Explorer 8 - TLS Fatal Error Close Notify - Oracle HTTP - Server Apache 2.2.22.0TLS 1.0 handshake fails in Windows Server 2012 R2How to configure IIS 7.5 SSL TLS to work with iOS 9 ATSWhy is server FIN'ing after starting TLS session?Disabling TLS 1.0 prevents Client HELLO packetUse of SSL in ADFSTLS Error 70 issueshaproxy tls alert decrypt errorlftp 4.8.4 refuses to talk TLS1.2 with z/OS ftps hostGetting error error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure on jmeter
Layout of complex table
Singing along to guitar chords (harmony)
MH370 blackbox - is it still possible to retrieve data from it?
Swapping rooks in a 4x4 board
Pull-up sequence accumulator counter
Is my Rep in Stack-Exchange Form?
What happens when your group is victim of a surprise attack but you can't be surprised?
Why do some games show lights shine through walls?
Why does adding parentheses prevent an error?
Does the Paladin's Aura of Protection affect only either her or ONE ally in range?
Short story with brother-sister conjoined twins as protagonists?
Are there any vegetarian astronauts?
Impossible darts scores
How well known and how commonly used was Huffman coding in 1979?
How many satellites can stay in a Lagrange point?
How come I was asked by a CBP officer why I was in the US?
How can I convince my reader that I will not use a certain trope?
Going to get married soon, should I do it on Dec 31 or Jan 1?
Is there a maximum distance from a planet that a moon can orbit?
Does the posterior necessarily follow the same conditional dependence structure as the prior?
Alphabet completion rate
Intuitively, why does putting capacitors in series decrease the equivalent capacitance?
Calculating the partial sum of a expl3 sequence
What are the penalties for overstaying in USA?
Stunnel “wrong version number” error with TLS-PSK
Internet Explorer 8 - TLS Fatal Error Close Notify - Oracle HTTP - Server Apache 2.2.22.0TLS 1.0 handshake fails in Windows Server 2012 R2How to configure IIS 7.5 SSL TLS to work with iOS 9 ATSWhy is server FIN'ing after starting TLS session?Disabling TLS 1.0 prevents Client HELLO packetUse of SSL in ADFSTLS Error 70 issueshaproxy tls alert decrypt errorlftp 4.8.4 refuses to talk TLS1.2 with z/OS ftps hostGetting error error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure on jmeter
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I've got Stunnel running on a Raspberry Pi which is acting as a TLS wrapper for an apache2 server. I've configured it to use TLS-PSK (correctly, I think), but the logs show the following when I try to complete the TLS handshake:
2016.04.11 21:05:53 LOG7[0]: Service [PSK_server] started
2016.04.11 21:05:53 LOG5[0]: Service [PSK_server] accepted connection from 192.168.42.10:4097
2016.04.11 21:05:53 LOG7[0]: SSL state (accept): before/accept initialization
2016.04.11 21:05:53 LOG7[0]: SNI: no virtual services defined
2016.04.11 21:05:53 LOG7[0]: SSL alert (write): fatal: protocol version
2016.04.11 21:05:53 LOG3[0]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2016.04.11 21:05:53 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2016.04.11 21:05:53 LOG7[0]: Deallocating application specific data for addr index
2016.04.11 21:05:53 LOG7[0]: Local descriptor (FD=3) closed
2016.04.11 21:05:53 LOG7[0]: Service [PSK_server] finished (0 left)</code>
I've checked in Wireshark, and the packets I'm sending are all TLS 1.2.
My stunnel config file looks like this:
output = /etc/stunnel/stunnel.log
client = no
fips = no
ciphers = PSK
PSKsecrets = /home/psk.txt
debug = 7
sslVersion = TLSv1.2
[PSK_server]
accept = PSK_server
connect = 80
It sends a TLS fatal alert packet with error code 70 (which is protocol_version, so it doesn't really tell me much more than the logs)
It's weird; I can send the Client Hello message, and the server sends Server Hello and Server Hello Done with no problem. It's only when I send my Client Key Exchange message that I get the alert.
Any help/suggestions would be appreciated!
ssl tls stunnel
asked Apr 11 '16 at 21:22
Alex HunterAlex Hunter
63 bronze badges
add a comment |
I've got Stunnel running on a Raspberry Pi which is acting as a TLS wrapper for an apache2 server. I've configured it to use TLS-PSK (correctly, I think), but the logs show the following when I try to complete the TLS handshake:
2016.04.11 21:05:53 LOG7[0]: Service [PSK_server] started
2016.04.11 21:05:53 LOG5[0]: Service [PSK_server] accepted connection from 192.168.42.10:4097
2016.04.11 21:05:53 LOG7[0]: SSL state (accept): before/accept initialization
2016.04.11 21:05:53 LOG7[0]: SNI: no virtual services defined
2016.04.11 21:05:53 LOG7[0]: SSL alert (write): fatal: protocol version
2016.04.11 21:05:53 LOG3[0]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2016.04.11 21:05:53 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2016.04.11 21:05:53 LOG7[0]: Deallocating application specific data for addr index
2016.04.11 21:05:53 LOG7[0]: Local descriptor (FD=3) closed
2016.04.11 21:05:53 LOG7[0]: Service [PSK_server] finished (0 left)</code>
I've checked in Wireshark, and the packets I'm sending are all TLS 1.2.
My stunnel config file looks like this:
output = /etc/stunnel/stunnel.log
client = no
fips = no
ciphers = PSK
PSKsecrets = /home/psk.txt
debug = 7
sslVersion = TLSv1.2
[PSK_server]
accept = PSK_server
connect = 80
It sends a TLS fatal alert packet with error code 70 (which is protocol_version, so it doesn't really tell me much more than the logs)
It's weird; I can send the Client Hello message, and the server sends Server Hello and Server Hello Done with no problem. It's only when I send my Client Key Exchange message that I get the alert.
Any help/suggestions would be appreciated!
ssl tls stunnel
asked Apr 11 '16 at 21:22
Alex HunterAlex Hunter
63 bronze badges
add a comment |
I've got Stunnel running on a Raspberry Pi which is acting as a TLS wrapper for an apache2 server. I've configured it to use TLS-PSK (correctly, I think), but the logs show the following when I try to complete the TLS handshake:
2016.04.11 21:05:53 LOG7[0]: Service [PSK_server] started
2016.04.11 21:05:53 LOG5[0]: Service [PSK_server] accepted connection from 192.168.42.10:4097
2016.04.11 21:05:53 LOG7[0]: SSL state (accept): before/accept initialization
2016.04.11 21:05:53 LOG7[0]: SNI: no virtual services defined
2016.04.11 21:05:53 LOG7[0]: SSL alert (write): fatal: protocol version
2016.04.11 21:05:53 LOG3[0]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2016.04.11 21:05:53 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2016.04.11 21:05:53 LOG7[0]: Deallocating application specific data for addr index
2016.04.11 21:05:53 LOG7[0]: Local descriptor (FD=3) closed
2016.04.11 21:05:53 LOG7[0]: Service [PSK_server] finished (0 left)</code>
I've checked in Wireshark, and the packets I'm sending are all TLS 1.2.
My stunnel config file looks like this:
output = /etc/stunnel/stunnel.log
client = no
fips = no
ciphers = PSK
PSKsecrets = /home/psk.txt
debug = 7
sslVersion = TLSv1.2
[PSK_server]
accept = PSK_server
connect = 80
It sends a TLS fatal alert packet with error code 70 (which is protocol_version, so it doesn't really tell me much more than the logs)
It's weird; I can send the Client Hello message, and the server sends Server Hello and Server Hello Done with no problem. It's only when I send my Client Key Exchange message that I get the alert.
Any help/suggestions would be appreciated!
ssl tls stunnel
asked Apr 11 '16 at 21:22
Alex HunterAlex Hunter
63 bronze badges
I've got Stunnel running on a Raspberry Pi which is acting as a TLS wrapper for an apache2 server. I've configured it to use TLS-PSK (correctly, I think), but the logs show the following when I try to complete the TLS handshake:
2016.04.11 21:05:53 LOG7[0]: Service [PSK_server] started
2016.04.11 21:05:53 LOG5[0]: Service [PSK_server] accepted connection from 192.168.42.10:4097
2016.04.11 21:05:53 LOG7[0]: SSL state (accept): before/accept initialization
2016.04.11 21:05:53 LOG7[0]: SNI: no virtual services defined
2016.04.11 21:05:53 LOG7[0]: SSL alert (write): fatal: protocol version
2016.04.11 21:05:53 LOG3[0]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2016.04.11 21:05:53 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2016.04.11 21:05:53 LOG7[0]: Deallocating application specific data for addr index
2016.04.11 21:05:53 LOG7[0]: Local descriptor (FD=3) closed
2016.04.11 21:05:53 LOG7[0]: Service [PSK_server] finished (0 left)</code>
I've checked in Wireshark, and the packets I'm sending are all TLS 1.2.
My stunnel config file looks like this:
output = /etc/stunnel/stunnel.log
client = no
fips = no
ciphers = PSK
PSKsecrets = /home/psk.txt
debug = 7
sslVersion = TLSv1.2
[PSK_server]
accept = PSK_server
connect = 80
It sends a TLS fatal alert packet with error code 70 (which is protocol_version, so it doesn't really tell me much more than the logs)
It's weird; I can send the Client Hello message, and the server sends Server Hello and Server Hello Done with no problem. It's only when I send my Client Key Exchange message that I get the alert.
Any help/suggestions would be appreciated!
ssl tls stunnel
ssl tls stunnel
asked Apr 11 '16 at 21:22
Alex HunterAlex Hunter
63 bronze badges
asked Apr 11 '16 at 21:22
Alex HunterAlex Hunter
63 bronze badges
edited Apr 11 '16 at 21:29
Alex Hunter
asked Apr 11 '16 at 21:22
Alex HunterAlex Hunter
63 bronze badges
asked Apr 11 '16 at 21:22
Alex HunterAlex Hunter
63 bronze badges
asked Apr 11 '16 at 21:22
Alex HunterAlex Hunter
63 bronze badges
63 bronze badges
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
I would downgraded the TLS Version
This is working for me from a raspberry pi
options = NO_SSLv2
options = NO_SSLv3
CAFile = /etc/stunnel/server.crt
cert = /etc/stunnel/server.crt
key = /etc/stunnel/server.key
pid = /var/run/stunnel.pid
output = /var/log/stunnel
verify = 4
debug = 5
[SERVICE]
client = yes
accept = 127.0.0.1:9200
connect = SERVER.com:1111
answered Apr 11 '16 at 21:27
JofreJofre
3943 silver badges11 bronze badges
Thanks for the reply. I removed the "sslVersion = TLS1.2" line and restarted stunnel but I still get the same messages in the log, unfortunately
– Alex Hunter
Apr 11 '16 at 21:36
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f769633%2fstunnel-wrong-version-number-error-with-tls-psk%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I would downgraded the TLS Version
This is working for me from a raspberry pi
options = NO_SSLv2
options = NO_SSLv3
CAFile = /etc/stunnel/server.crt
cert = /etc/stunnel/server.crt
key = /etc/stunnel/server.key
pid = /var/run/stunnel.pid
output = /var/log/stunnel
verify = 4
debug = 5
[SERVICE]
client = yes
accept = 127.0.0.1:9200
connect = SERVER.com:1111
answered Apr 11 '16 at 21:27
JofreJofre
3943 silver badges11 bronze badges
Thanks for the reply. I removed the "sslVersion = TLS1.2" line and restarted stunnel but I still get the same messages in the log, unfortunately
– Alex Hunter
Apr 11 '16 at 21:36
add a comment |
I would downgraded the TLS Version
This is working for me from a raspberry pi
options = NO_SSLv2
options = NO_SSLv3
CAFile = /etc/stunnel/server.crt
cert = /etc/stunnel/server.crt
key = /etc/stunnel/server.key
pid = /var/run/stunnel.pid
output = /var/log/stunnel
verify = 4
debug = 5
[SERVICE]
client = yes
accept = 127.0.0.1:9200
connect = SERVER.com:1111
answered Apr 11 '16 at 21:27
JofreJofre
3943 silver badges11 bronze badges
Thanks for the reply. I removed the "sslVersion = TLS1.2" line and restarted stunnel but I still get the same messages in the log, unfortunately
– Alex Hunter
Apr 11 '16 at 21:36
add a comment |
I would downgraded the TLS Version
This is working for me from a raspberry pi
options = NO_SSLv2
options = NO_SSLv3
CAFile = /etc/stunnel/server.crt
cert = /etc/stunnel/server.crt
key = /etc/stunnel/server.key
pid = /var/run/stunnel.pid
output = /var/log/stunnel
verify = 4
debug = 5
[SERVICE]
client = yes
accept = 127.0.0.1:9200
connect = SERVER.com:1111
answered Apr 11 '16 at 21:27
JofreJofre
3943 silver badges11 bronze badges
I would downgraded the TLS Version
This is working for me from a raspberry pi
options = NO_SSLv2
options = NO_SSLv3
CAFile = /etc/stunnel/server.crt
cert = /etc/stunnel/server.crt
key = /etc/stunnel/server.key
pid = /var/run/stunnel.pid
output = /var/log/stunnel
verify = 4
debug = 5
[SERVICE]
client = yes
accept = 127.0.0.1:9200
connect = SERVER.com:1111
answered Apr 11 '16 at 21:27
JofreJofre
3943 silver badges11 bronze badges
answered Apr 11 '16 at 21:27
JofreJofre
3943 silver badges11 bronze badges
answered Apr 11 '16 at 21:27
JofreJofre
3943 silver badges11 bronze badges
answered Apr 11 '16 at 21:27
JofreJofre
3943 silver badges11 bronze badges
3943 silver badges11 bronze badges
Thanks for the reply. I removed the "sslVersion = TLS1.2" line and restarted stunnel but I still get the same messages in the log, unfortunately
– Alex Hunter
Apr 11 '16 at 21:36
add a comment |
Thanks for the reply. I removed the "sslVersion = TLS1.2" line and restarted stunnel but I still get the same messages in the log, unfortunately
– Alex Hunter
Apr 11 '16 at 21:36
Thanks for the reply. I removed the "sslVersion = TLS1.2" line and restarted stunnel but I still get the same messages in the log, unfortunately
– Alex Hunter
Apr 11 '16 at 21:36
Thanks for the reply. I removed the "sslVersion = TLS1.2" line and restarted stunnel but I still get the same messages in the log, unfortunately
– Alex Hunter
Apr 11 '16 at 21:36
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f769633%2fstunnel-wrong-version-number-error-with-tls-psk%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
