search

edicl / hunchentoot

Web server written in Common Lisp
https://edicl.github.io/hunchentoot/
702 stars 125 forks source link

Cipher Suite negotiation failure in LW8 / ssl-ctx is not initialized #224

Closed mdbergmann closed 10 months ago

mdbergmann commented 10 months ago

I'm receiving the following error when trying to connect with a client to hunchentoot with SSL acceptor.

[2024-01-20 13:07:04 [ERROR]] Error while processing connection: Error when reading from #<COMM:SOCKET-STREAM 80100F88CB> : "Cipher Suite negotiation failure" [-9801].

I've tracked it down to ctx-configure-callback function, as set up by attach-ssl not being called. Despite initialize-connection-stream and make-ssl-server-stream are called (in ssl.lisp).

Anyone got an idea?

hanshuebner commented 10 months ago

This looks like an SSL version incompatibility between your server and your client. Is it possible that your server uses a very old SSL version that does not support modern ciphers? Can you look at the debug logs on the server side to determine what TLS version is being used?

mdbergmann commented 10 months ago

Well, client and server is on the same host. It works with SBCL and cl+ssl. For me it seems like as if the ssl-ctx is not configured with the certificate and private key I have defined. Or do you think that the handshake and cipher negotiation is happening before the ctx-configure-callback? I was thinking it might also be a problem with client (Drakma), but I get the same error when trying to connect with a browser.

hanshuebner commented 10 months ago

What is the platform that it does not work with? From the error message, I would suspect LispWorks. Is it possible that LispWorks uses a different (outdated) version of OpenSSL?

mdbergmann commented 10 months ago

Hmm, it's LispWorks 8.0.1. The latest. I'll try to check what version they have bundled. I'll try some more with pure LispWorks API to see if it actually works there.

mdbergmann commented 10 months ago

Please check PR #225. While this works, I do not know why the previous variant does not work.

mdbergmann commented 10 months ago

Fixed with #225