search

octo / librouteros

C library to communicate with network devices by MikroTik running their Linux-based operating system RouterOS.
ISC License
19 stars 6 forks source link

Feature Request: support for API over secure connection (api-ssl) #13

Open miegl opened 6 years ago

miegl commented 6 years ago

I'd like request support for API over secure connection.

manio commented 6 years ago

Hello Josef, Please pull and test the api-ssl branch in octo/librouteros.

The code is experimental and covers only the case without user certificate. SSL connection to port 8729 is enabled by default.

miegl commented 6 years ago

Thanks for your efforts! Unfortunately it doesn't work. Tested on somewhat older and latest routeros.

Output:

140038383850880:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1407:SSL alert number 40
ros_connect failed: Success
manio commented 6 years ago

Let me guess... openssl from debian? :)

miegl commented 6 years ago

bad guess - openssl from arch

$ openssl version
OpenSSL 1.1.0h  27 Mar 2018
manio commented 6 years ago

I had the same problem with OpenSSL from debian, but when I compile own OpenSSL and link against it - then it working like a charm:

$ ros 192.168.1.4 system-resource
Password for user admin:                  
create_socket (node = 192.168.1.4, service = 8729);
SSL handshake has read 834 bytes and written 602 bytes
SSL connection using ADH-AES256-SHA
send_command: command = /login;
send_command: arg[0] = =name=admin;
send_command: arg[1] = =password=<censored>;
send_command: command = /system/resource/print;
====== System resources ======
Uptime:             17.88 days
RouterOS version:  6.43rc42 (testing)
Architecture name:         arm
Board name:           hAP ac^2
CPU model:               ARMv7
CPU count:                   4
CPU load:                   24
CPU frequency:         716 MHz
Memory free:      9076736 Byte ( 3.6 %)
Memory used:    242581504 Byte (96.4 %)
Memory total:   251658240 Byte
Space free:       3665920 Byte (22.9 %)
Space used:      12324864 Byte (77.1 %)
Space total:     15990784 Byte
Sectors written:         33704 (58186)
Bad blocks:                  0
==============================

I think that either the RouterOS is using some old and weak encryption or OpenSSL in arch and debian is missing some features... Based on experience I'd rather bet for option one :)

miegl commented 6 years ago

I just can't get it to work. ADH-AES256-SHA and other ADH ciphers are available.

$ openssl s_client -tls1 -cipher "ADH AES256 SHA " -debug -msg -state -connect mikrotik:8729
CONNECTED(00000003)
SSL_connect:before SSL initialization
>>> ??? [length 0005]
    16 03 01 00 79
>>> TLS 1.0Handshake [length 0079], ClientHello
    01 00 00 75 03 01 07 1b 2b 79 8b a2 2a de a4 a9
    51 43 75 7a 4a bc 67 09 7d 1a d3 16 b7 68 ec fd
    de 0f e1 96 45 62 00 00 2a c0 0a c0 14 00 39 00
    38 00 35 00 88 00 87 c0 09 c0 13 00 33 00 32 00
    9a 00 99 00 45 00 44 00 84 00 2f 00 96 00 41 00
    07 00 ff 01 00 00 22 00 0b 00 04 03 00 01 02 00
    0a 00 0a 00 08 00 1d 00 17 00 19 00 18 00 23 00
    00 00 16 00 00 00 17 00 00
write to 0x5567ed690310 [0x5567ed703aa0] (126 bytes => 126 (0x7E))
0000 - 16 03 01 00 79 01 00 00-75 03 01 07 1b 2b 79 8b   ....y...u....+y.
0010 - a2 2a de a4 a9 51 43 75-7a 4a bc 67 09 7d 1a d3   .*...QCuzJ.g.}..
0020 - 16 b7 68 ec fd de 0f e1-96 45 62 00 00 2a c0 0a   ..h......Eb..*..
0030 - c0 14 00 39 00 38 00 35-00 88 00 87 c0 09 c0 13   ...9.8.5........
0040 - 00 33 00 32 00 9a 00 99-00 45 00 44 00 84 00 2f   .3.2.....E.D.../
0050 - 00 96 00 41 00 07 00 ff-01 00 00 22 00 0b 00 04   ...A......."....
0060 - 03 00 01 02 00 0a 00 0a-00 08 00 1d 00 17 00 19   ................
0070 - 00 18 00 23 00 00 00 16-00 00 00 17 00 00         ...#..........
SSL_connect:SSLv3/TLS write client hello
read from 0x5567ed690310 [0x5567ed6fa883] (5 bytes => 5 (0x5))
0000 - 15 03 01 00 02                                    .....
<<< ??? [length 0005]
    15 03 01 00 02
read from 0x5567ed690310 [0x5567ed6fa888] (2 bytes => 2 (0x2))
0000 - 02 28                                             .(
<<< TLS 1.0Alert [length 0002], fatal handshake_failure
    02 28
SSL3 alert read:fatal:handshake failure
SSL_connect:error in SSLv3/TLS write client hello
140072438067648:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1407:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 126 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1532621436
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---
miegl commented 6 years ago

Here is PKGBUILD for openssl https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/openssl How did you build openssl to work with api-ssl?

manio commented 6 years ago

I just tested it on the library from sslscan. You can do the following: cd /usr/src git clone https://github.com/rbsec/sslscan cd sslscan make static (it will fetch and build the openssl with all features needed for sslscan - with weak and legacy SSL support)

Then apply the following patch on top of api-ssl branch: http://skyboo.net/temp/ssl/apissl.diff and rebuild the librouteros

Let me know if it helps...

miegl commented 6 years ago

Thanks, that works. Maybe librouteros should build it's own older version of openssl, because newer versions (since 1.1?) just don't work with api-ssl (well at least without certificate).

rpv-tomsk commented 6 years ago

Just tried my available router (connection established from Debian 7 environment, same from Debian 8, yes, they both a quite outdated):

# openssl s_client  -connect mikrotic:8729
CONNECTED(00000003)
depth=0 C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
verify error:num=18:self signed certificate
verify return:1
depth=0 C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
verify return:1
---
Certificate chain
 0 s:/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
   i:/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
---
Server certificate
-----BEGIN CERTIFICATE-----
[.. cut ..]
-----END CERTIFICATE-----
subject=/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
issuer=/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
---
No client certificate CA names sent
---
SSL handshake has read 2084 bytes and written 608 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : DHE-RSA-AES256-GCM-SHA384
    Session-ID: 714FB15C6E271A65064DA38DA116CEE15CA72260C3BFB168DD6F3141028594B6
    Session-ID-ctx:
    Master-Key: E90C889CE30272F2A9589A525D0441D37652B2756995DE67FE7229D9A70AAFE5BB5E8A2639E9D585E5DDE30B64A42D4E
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 4f bd f9 d3 ed 52 e4 b7-23 6c ea fa 2c 80 89 a1   O....R..#l..,...
    0010 - 95 e5 80 f7 db d2 37 0b-b9 10 85 b6 24 ff 3d fd   ......7.....$.=.
    0020 - 28 09 65 08 ad 64 b5 f4-65 8c cf 31 88 1d fc f4   (.e..d..e..1....
    0030 - f3 02 17 1c 8f 4b 08 fe-04 7d 4d 8b 31 0a d7 af   .....K...}M.1...
    0040 - 95 37 38 f2 5b 36 eb fb-83 e0 2b 4b ed fb fb 7e   .78.[6....+K...~
    0050 - f6 30 6a 37 3f e0 64 36-98 a1 f5 8d a3 2d 24 13   .0j7?.d6.....-$.
    0060 - 83 69 55 6d df 13 94 a1-00 6a 8b 6c 60 3c 75 57   .iUm.....j.l`<uW
    0070 - 3d 16 1f e6 b3 3f da 55-51 56 80 5b 4a f8 ce 3e   =....?.UQV.[J..>
    0080 - ac 2f b1 b5 bd 88 f4 e8-9c 53 04 d3 ca 64 e7 c2   ./.......S...d..
    0090 - 2b 26 9c d7 68 73 e5 73-07 f3 f0 b7 1b 79 70 68   +&..hs.s.....yph

    Start Time: 1532663908
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
^C

Is I'm correct, there will be connection problems only on newer OpenSSL versions (I used 1.0.1)?

manio commented 6 years ago

Yes Pavel, it looks like you connected because of your OpenSSL version (or maybe because you've installed self signed certificate on the mikrotik) - I was testing on clean default configuration without any certificate installed.

My testing env on debian:

$ openssl version
OpenSSL 1.1.0h  27 Mar 2018

$ openssl s_client -host mikrotik -port 8729 -debug -state
CONNECTED(00000003)
SSL_connect:before SSL initialization
write to 0x563e7b0bad50 [0x563e7b0cb500] (176 bytes => 176 (0xB0))
0000 - 16 03 01 00 ab 01 00 00-a7 03 03 f2 4d 3f f8 95   ............M?..
0010 - c3 d2 ed 5a ca 1f d3 ed-b8 8f b5 c0 d4 61 8d 28   ...Z.........a.(
0020 - 09 9b 5f 44 cf de cf 8c-d2 4b 9c 00 00 38 c0 2c   .._D.....K...8.,
0030 - c0 30 00 9f cc a9 cc a8-cc aa c0 2b c0 2f 00 9e   .0.........+./..
0040 - c0 24 c0 28 00 6b c0 23-c0 27 00 67 c0 0a c0 14   .$.(.k.#.'.g....
0050 - 00 39 c0 09 c0 13 00 33-00 9d 00 9c 00 3d 00 3c   .9.....3.....=.<
0060 - 00 35 00 2f 00 ff 01 00-00 46 00 0b 00 04 03 00   .5./.....F......
0070 - 01 02 00 0a 00 0a 00 08-00 1d 00 17 00 19 00 18   ................
0080 - 00 23 00 00 00 16 00 00-00 17 00 00 00 0d 00 20   .#............. 
0090 - 00 1e 06 01 06 02 06 03-05 01 05 02 05 03 04 01   ................
00a0 - 04 02 04 03 03 01 03 02-03 03 02 01 02 02 02 03   ................
SSL_connect:SSLv3/TLS write client hello
read from 0x563e7b0bad50 [0x563e7b0c22e3] (5 bytes => 5 (0x5))
0000 - 15 03 03 00 02                                    .....
read from 0x563e7b0bad50 [0x563e7b0c22e8] (2 bytes => 2 (0x2))
0000 - 02 28                                             .(
SSL3 alert read:fatal:handshake failure
SSL_connect:error in SSLv3/TLS write client hello
139817186066624:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1407:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 176 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1532668604
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

Isn't it because of TLSv1?

@Miegl I prefer to have OpenSSL from distibution. Bundling/expanding the makefile to include OpenSSL is not the way I like it (it would be probably also a blocker to include the librouteros in debian), but we'll see...

Maybe there will be a need to open a ticket on the mikrotik and request them to update openssl in routeros... I think it would solve our problems...

rpv-tomsk commented 6 years ago

Some useful examples:

I can reproduce alert number 40 adding -ssl3 option:

# openssl s_client  -connect router:8729 -ssl3
CONNECTED(00000003)
3073889980:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1315:SSL alert number 40
3073889980:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:637:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1532675535
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

But I'm able to connect using -tls1 option:

root@hs01:/opt# openssl s_client  -connect router:8729 -tls1
CONNECTED(00000003)
depth=0 C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
verify error:num=18:self signed certificate
verify return:1
depth=0 C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
verify return:1
---
Certificate chain
 0 s:/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
   i:/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
---
Server certificate
-----BEGIN CERTIFICATE-----
[.. cut ..]
-----END CERTIFICATE-----
subject=/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
issuer=/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
---
No client certificate CA names sent
---
SSL handshake has read 2090 bytes and written 524 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 241D8F81ACF9A8EDBD19A4C5ED4B77F1E9C2E6C0F87079A54CB4BB42084FC059
    Session-ID-ctx:
    Master-Key: 12C20419873C1BE5E3DB092409677ED863448BC10F76E50D1D1CAC9FA58B090126F0A54E104C3A536BC4E26070CC3E98
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - f9 5c aa 0d 84 a3 9e 8f-52 43 46 37 ca 66 31 ea   .\......RCF7.f1.
    0010 - 00 10 c9 f5 8b c9 c8 ef-48 ea 96 65 31 04 d5 52   ........H..e1..R
    0020 - ac 35 7d 50 2c c1 c4 32-ec 23 4c fa 5a 7a ba fa   .5}P,..2.#L.Zz..
    0030 - 78 40 20 6a 50 3c dd f4-0d a2 b8 4a d4 ce e2 a1   x@ jP<.....J....
    0040 - 61 d6 4d 91 e0 92 16 d2-14 5b 3c 7e ed 79 4f e9   a.M......[<~.yO.
    0050 - 1f b8 73 d1 74 1d 97 10-aa 07 b0 74 cc d4 cc dc   ..s.t......t....
    0060 - d2 70 9e 3e 31 de 05 82-15 2e 11 71 96 46 cf 01   .p.>1......q.F..
    0070 - ec 68 66 a2 70 70 fd ab-c4 0e 42 42 85 82 b0 38   .hf.pp....BB...8
    0080 - 51 1d 98 6c 6a f9 12 87-a5 83 cf 8b bd cc da b4   Q..lj...........
    0090 - 47 8c 44 c9 70 1f 8c d6-8b 62 36 02 b5 31 c4 2f   G.D.p....b6..1./

    Start Time: 1532675583
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)
---

Or even with use of -tls1_1:

# openssl s_client  -connect router:8729 -tls1_1
CONNECTED(00000003)
depth=0 C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
verify error:num=18:self signed certificate
verify return:1
depth=0 C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
verify return:1
---
Certificate chain
 0 s:/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
   i:/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
---
Server certificate
-----BEGIN CERTIFICATE-----
[..cut..]
-----END CERTIFICATE-----
subject=/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
issuer=/C=RU/ST=Tomsk/L=Tomsk/O=Router/OU=Router
---
No client certificate CA names sent
---
SSL handshake has read 2106 bytes and written 540 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 0D355180883A12CB934DC2901434EFA8C906FA3A5901B3DC422346E5620F2DFF
    Session-ID-ctx:
    Master-Key: 0AC42976ECEB0BCB355E7A53E105B7883731EE4FFEC0D46B0965EAF935A09C52E1E02C1330BD39A09CC5F03F1ECF4654
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - f9 5c aa 0d 84 a3 9e 8f-52 43 46 37 ca 66 31 ea   .\......RCF7.f1.
    0010 - 61 a0 73 96 1b f8 e3 12-dd 5e be 91 90 0c 48 16   a.s......^....H.
    0020 - 78 8f 58 5a 15 1e 1d 84-3e b2 02 ec 05 d6 4b 7e   x.XZ....>.....K~
    0030 - 1c 0f 78 0f 05 3c 03 a2-b1 75 5c cf c1 a4 ab ba   ..x..<...u\.....
    0040 - 1f 44 8e 96 0d 11 8d a3-01 21 99 53 65 ce 88 39   .D.......!.Se..9
    0050 - f9 fb a5 96 66 3a 66 3f-dd 09 7f 84 fd 08 09 69   ....f:f?.......i
    0060 - 76 38 d8 22 6f 61 ac 16-58 ee 68 a0 40 bb f7 b2   v8."oa..X.h.@...
    0070 - 9c 58 40 49 75 58 8a 55-ee fd 0b ee d4 25 c6 96   .X@IuX.U.....%..
    0080 - 68 a1 ee 10 e8 bd a2 6d-3c 87 c6 6a 7f ab 78 3f   h......m<..j..x?
    0090 - af be 4f e5 5b 3f 00 87-16 fa 67 4d b9 ce 67 90   ..O.[?....gM..g.

    Start Time: 1532675595
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)
---
rpv-tomsk commented 6 years ago

Useful reading: https://www.openssl.org/docs/man1.1.0/ssl/TLS_client_method.html

The SSLv3 protocol is deprecated and should generally not be used. Applications should typically use SSL_CTX_set_min_proto_version to set the minimum protocol to at least TLS1_VERSION.

Can you please try to patch and check using openssl-1.1.0?

manio commented 6 years ago

Thanks for examples, when I add -tls1, -tls1_1, -tls1_2, then in every the same failure:

140039919550656:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1407:SSL alert number 40

Do you guys have an account on mikrotik forum? janisk from forum is stating that it should definitely work (https://forum.mikrotik.com/viewtopic.php?f=1&t=73103#p371843) but it was in 2013. Nevertheless they should make it compatible with modern OpenSSL releases imo.

rpv-tomsk commented 6 years ago

140039919550656:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1407:SSL alert number 40

ssl3, sslv3, rec_layer_s3 .... This looks strange >)

rpv-tomsk commented 6 years ago

Possible explanation of the cause: https://mta.openssl.org/pipermail/openssl-users/2017-February/005300.html

And there is a possible solution:

Thanks. I have added more ciphers using SSL_set_cipher_list(3) and all is fine now.

rpv-tomsk commented 6 years ago

Can you please try -cipher option of s_client?

miegl commented 6 years ago

There's no way of connecting with recent openssl 1.1. With openssl 1.0 (1.0.2o in this case) it works.

$ openssl-1.0 s_client -tls1 -cipher "ADH AES256 SHA " -debug -msg -state -connect 10.59.74.5:8729
CONNECTED(00000003)
SSL_connect:before/connect initialization
>>> ??? [length 0005]
    16 03 01 00 e2
write to 0x55c36bb16ba0 [0x55c36bbf34d3] (231 bytes => 231 (0xE7))
0000 - 16 03 01 00 e2 01 00 00-de 03 01 44 8b b0 eb dd   ...........D....
0010 - 22 3d 94 b6 71 ca 00 af-05 b6 ff d4 a6 8d af f3   "=..q...........
0020 - 1f d6 a8 d5 36 1f 5f 23-9b dd 95 00 00 84 00 3a   ....6._#.......:
0030 - 00 89 00 34 00 9b 00 46-00 18 00 1b c0 14 c0 0a   ...4...F........
0040 - 00 39 00 38 00 37 00 36-c0 19 c0 0f c0 05 00 35   .9.8.7.6.......5
0050 - 00 88 00 87 00 86 00 85-00 84 c0 13 c0 09 00 33   ...............3
0060 - 00 32 00 31 00 30 00 9a-00 99 00 98 00 97 00 45   .2.1.0.........E
0070 - 00 44 00 43 00 42 c0 18-c0 0e c0 04 00 2f 00 96   .D.C.B......./..
0080 - 00 41 00 07 c0 11 c0 07-c0 16 c0 0c c0 02 00 05   .A..............
0090 - c0 12 c0 08 00 16 00 13-00 10 00 0d c0 17 c0 0d   ................
00a0 - c0 03 00 0a c0 10 c0 06-c0 15 c0 0b c0 01 00 02   ................
00b0 - 00 ff 01 00 00 31 00 0b-00 04 03 00 01 02 00 0a   .....1..........
00c0 - 00 1c 00 1a 00 17 00 19-00 1c 00 1b 00 18 00 1a   ................
00d0 - 00 16 00 0e 00 0d 00 0b-00 0c 00 09 00 0a 00 23   ...............#
00e0 - 00 00 00 0f 00 01 01                              .......
>>> TLS 1.0 Handshake [length 00e2], ClientHello
    01 00 00 de 03 01 44 8b b0 eb dd 22 3d 94 b6 71
    ca 00 af 05 b6 ff d4 a6 8d af f3 1f d6 a8 d5 36
    1f 5f 23 9b dd 95 00 00 84 00 3a 00 89 00 34 00
    9b 00 46 00 18 00 1b c0 14 c0 0a 00 39 00 38 00
    37 00 36 c0 19 c0 0f c0 05 00 35 00 88 00 87 00
    86 00 85 00 84 c0 13 c0 09 00 33 00 32 00 31 00
    30 00 9a 00 99 00 98 00 97 00 45 00 44 00 43 00
    42 c0 18 c0 0e c0 04 00 2f 00 96 00 41 00 07 c0
    11 c0 07 c0 16 c0 0c c0 02 00 05 c0 12 c0 08 00
    16 00 13 00 10 00 0d c0 17 c0 0d c0 03 00 0a c0
    10 c0 06 c0 15 c0 0b c0 01 00 02 00 ff 01 00 00
    31 00 0b 00 04 03 00 01 02 00 0a 00 1c 00 1a 00
    17 00 19 00 1c 00 1b 00 18 00 1a 00 16 00 0e 00
    0d 00 0b 00 0c 00 09 00 0a 00 23 00 00 00 0f 00
    01 01
SSL_connect:unknown state
read from 0x55c36bb16ba0 [0x55c36bbeef83] (5 bytes => 5 (0x5))
0000 - 16 03 01 00 3a                                    ....:
<<< ??? [length 0005]
    16 03 01 00 3a
read from 0x55c36bb16ba0 [0x55c36bbeef88] (58 bytes => 58 (0x3A))
0000 - 02 00 00 36 03 01 30 a4-ac 0d 22 09 15 6a 96 bf   ...6..0..."..j..
0010 - e3 59 e1 64 5b e1 34 07-5b 18 ac eb b2 ab de fd   .Y.d[.4.[.......
0020 - 3d b2 6a 68 f6 97 00 00-3a 00 00 0e ff 01 00 01   =.jh....:.......
0030 - 00 00 23 00 00 00 0f 00-01 01                     ..#.......
<<< TLS 1.0 Handshake [length 003a], ServerHello
    02 00 00 36 03 01 30 a4 ac 0d 22 09 15 6a 96 bf
    e3 59 e1 64 5b e1 34 07 5b 18 ac eb b2 ab de fd
    3d b2 6a 68 f6 97 00 00 3a 00 00 0e ff 01 00 01
    00 00 23 00 00 00 0f 00 01 01
SSL_connect:unknown state
read from 0x55c36bb16ba0 [0x55c36bbeef83] (5 bytes => 5 (0x5))
0000 - 16 03 01 02 0b                                    .....
<<< ??? [length 0005]
    16 03 01 02 0b
read from 0x55c36bb16ba0 [0x55c36bbeef88] (523 bytes => 523 (0x20B))
0000 - 0c 00 02 07 01 00 8e 10-21 ff 7f c0 8e 69 df f7   ........!....i..
0010 - 49 da 8e 0b 36 00 52 1f-1f 0f 1e 96 21 ed 46 9c   I...6.R.....!.F.
0020 - e0 ea 1f c2 e9 d5 8c 41-9a b9 4c 01 63 4d a3 52   .......A..L.cM.R
0030 - ae 62 1d 5c fa a0 64 0d-9c df b5 d1 5c 02 23 cf   .b.\..d.....\.#.
0040 - 0d 34 30 46 10 73 67 5e-67 4c af 1c 30 58 4a 06   .40F.sg^gL..0XJ.
0050 - b9 e5 39 9f 58 e3 1d 08-28 1f ce b6 d5 e9 99 21   ..9.X...(......!
0060 - e8 27 9a ae 2d 2d 03 f2-e3 d5 24 73 cb 21 5d 41   .'..--....$s.!]A
0070 - 47 7e 9a 1d 37 30 83 ca-1d 03 e3 16 49 bf a0 e2   G~..70......I...
0080 - b3 24 42 d7 e9 5c 02 dc-98 b6 07 1f 5e 1b 2a 8d   .$B..\......^.*.
0090 - c7 d7 4b e7 72 24 56 81-23 44 e8 b8 74 79 f4 cf   ..K.r$V.#D..ty..
00a0 - 58 df 57 b4 b2 b0 49 15-31 e8 01 71 93 b4 3c e9   X.W...I.1..q..<.
00b0 - 75 5f f4 a5 a1 b7 05 b7-05 08 5c 68 6c 35 c9 a2   u_........\hl5..
00c0 - 3f 9a 32 c0 be 22 24 9f-db e7 3a 96 ec dd 5d c6   ?.2.."$...:...].
00d0 - 5a bf 0e fd 55 d1 d5 4a-ab 25 01 e9 d2 ab 8d 79   Z...U..J.%.....y
00e0 - 51 28 8a 4e a9 67 f0 71-13 89 b4 da 1e c4 36 68   Q(.N.g.q......6h
00f0 - 5f 5a 11 85 d9 e3 44 ab-a7 c1 e6 e0 6c 03 81 68   _Z....D.....l..h
0100 - ba 53 fe 2d 9d 47 00 01-05 01 00 81 de ce 90 74   .S.-.G.........t
0110 - aa 59 97 9e f5 a5 67 53-0a 4f a5 be 36 69 61 4a   .Y....gS.O..6iaJ
0120 - 60 cb 9c 4c b9 67 c8 8c-c8 93 8d c1 91 29 e8 fe   `..L.g.......)..
0130 - 5b cf 3b 80 d7 5e 6f 16-89 a6 9a 8d 7b a6 1e 8e   [.;..^o.....{...
0140 - 87 35 f7 26 12 11 c4 a0-c5 11 4f bc 2d 6c 94 dd   .5.&......O.-l..
0150 - a7 b5 11 64 d7 80 58 ac-f4 31 46 55 70 fa c9 80   ...d..X..1FUp...
0160 - ac e2 53 50 b7 0c 6a 0c-f6 26 6c 2b 7c 74 0b 92   ..SP..j..&l+|t..
0170 - 8e 5c 74 46 27 47 34 78-70 15 34 64 ca 2b f0 3a   .\tF'G4xp.4d.+.:
0180 - 77 c4 7b f9 98 32 db a8-28 d6 b6 3c 2b 22 51 91   w.{..2..(..<+"Q.
0190 - 84 45 15 cf ab b4 fa b3-16 2b 2b ac 81 d2 59 c4   .E.......++...Y.
01a0 - eb 7f 2a f8 9d be 07 bd-90 bf 78 74 6c ba df 0a   ..*.......xtl...
01b0 - 1d fd 34 bd 66 14 9e 67-e6 a0 da d1 cd dc 87 43   ..4.f..g.......C
01c0 - ea a7 dd 78 10 e0 e4 80-87 c4 48 35 b7 d7 57 9e   ...x......H5..W.
01d0 - 61 e1 78 6d fb 1b 0f 97-9e 8a f0 c1 99 01 b4 ae   a.xm............
01e0 - b5 98 3f 03 c2 45 2a cb-6b d9 88 45 83 3f a4 c7   ..?..E*.k..E.?..
01f0 - 50 c9 db 01 60 a5 e9 25-69 98 e5 a6 a6 2a a4 ac   P...`..%i....*..
0200 - c9 73 5c e7 9b e3 3f 19-78 3f 66                  .s\...?.x?f
<<< TLS 1.0 Handshake [length 020b], ServerKeyExchange
    0c 00 02 07 01 00 8e 10 21 ff 7f c0 8e 69 df f7
    49 da 8e 0b 36 00 52 1f 1f 0f 1e 96 21 ed 46 9c
    e0 ea 1f c2 e9 d5 8c 41 9a b9 4c 01 63 4d a3 52
    ae 62 1d 5c fa a0 64 0d 9c df b5 d1 5c 02 23 cf
    0d 34 30 46 10 73 67 5e 67 4c af 1c 30 58 4a 06
    b9 e5 39 9f 58 e3 1d 08 28 1f ce b6 d5 e9 99 21
    e8 27 9a ae 2d 2d 03 f2 e3 d5 24 73 cb 21 5d 41
    47 7e 9a 1d 37 30 83 ca 1d 03 e3 16 49 bf a0 e2
    b3 24 42 d7 e9 5c 02 dc 98 b6 07 1f 5e 1b 2a 8d
    c7 d7 4b e7 72 24 56 81 23 44 e8 b8 74 79 f4 cf
    58 df 57 b4 b2 b0 49 15 31 e8 01 71 93 b4 3c e9
    75 5f f4 a5 a1 b7 05 b7 05 08 5c 68 6c 35 c9 a2
    3f 9a 32 c0 be 22 24 9f db e7 3a 96 ec dd 5d c6
    5a bf 0e fd 55 d1 d5 4a ab 25 01 e9 d2 ab 8d 79
    51 28 8a 4e a9 67 f0 71 13 89 b4 da 1e c4 36 68
    5f 5a 11 85 d9 e3 44 ab a7 c1 e6 e0 6c 03 81 68
    ba 53 fe 2d 9d 47 00 01 05 01 00 81 de ce 90 74
    aa 59 97 9e f5 a5 67 53 0a 4f a5 be 36 69 61 4a
    60 cb 9c 4c b9 67 c8 8c c8 93 8d c1 91 29 e8 fe
    5b cf 3b 80 d7 5e 6f 16 89 a6 9a 8d 7b a6 1e 8e
    87 35 f7 26 12 11 c4 a0 c5 11 4f bc 2d 6c 94 dd
    a7 b5 11 64 d7 80 58 ac f4 31 46 55 70 fa c9 80
    ac e2 53 50 b7 0c 6a 0c f6 26 6c 2b 7c 74 0b 92
    8e 5c 74 46 27 47 34 78 70 15 34 64 ca 2b f0 3a
    77 c4 7b f9 98 32 db a8 28 d6 b6 3c 2b 22 51 91
    84 45 15 cf ab b4 fa b3 16 2b 2b ac 81 d2 59 c4
    eb 7f 2a f8 9d be 07 bd 90 bf 78 74 6c ba df 0a
    1d fd 34 bd 66 14 9e 67 e6 a0 da d1 cd dc 87 43
    ea a7 dd 78 10 e0 e4 80 87 c4 48 35 b7 d7 57 9e
    61 e1 78 6d fb 1b 0f 97 9e 8a f0 c1 99 01 b4 ae
    b5 98 3f 03 c2 45 2a cb 6b d9 88 45 83 3f a4 c7
    50 c9 db 01 60 a5 e9 25 69 98 e5 a6 a6 2a a4 ac
    c9 73 5c e7 9b e3 3f 19 78 3f 66
SSL_connect:unknown state
read from 0x55c36bb16ba0 [0x55c36bbeef83] (5 bytes => 5 (0x5))
0000 - 16 03 01 00 04                                    .....
<<< ??? [length 0005]
    16 03 01 00 04
read from 0x55c36bb16ba0 [0x55c36bbeef88] (4 bytes => 4 (0x4))
0000 - 0e 00 00 00                                       ....
<<< TLS 1.0 Handshake [length 0004], ServerHelloDone
    0e 00 00 00
SSL_connect:unknown state
>>> ??? [length 0005]
    16 03 01 01 06
>>> TLS 1.0 Handshake [length 0106], ClientKeyExchange
    10 00 01 02 01 00 28 69 fd e5 8c 37 d5 c8 42 12
    b0 9d 09 7d 1b 3f 64 95 0e 17 6a 8d a7 c8 03 ca
    c1 e1 17 94 47 f3 90 50 1a ea 60 b4 e2 f6 2b f5
    c5 07 c6 15 dd 94 13 ca 79 13 d3 81 17 29 db 68
    11 81 c1 3f ea c3 59 a9 05 c7 36 f0 77 8c b3 3d
    a9 8a f9 dd c4 f3 3d 65 42 42 4e d3 b7 fc ba 83
    49 aa 12 22 56 b4 a3 f6 a0 25 1e ca 2a d3 ba 7d
    28 f4 f6 02 ee c0 a6 0f 99 c9 39 d6 79 d8 4d f1
    f5 52 78 95 96 8d 6a f5 c0 88 7a db 48 32 85 ce
    d7 3b 32 9d 02 bb 16 a2 ac 89 b7 6a 4c f7 8f 1c
    eb 95 8d a6 26 80 e8 ee b0 25 7e 9d 97 67 78 7b
    38 e9 d1 1d e6 3f b8 ed 4b 68 00 9c 70 c2 f3 d1
    b1 80 75 b4 76 a1 39 b6 36 a5 63 16 5a a5 e2 05
    62 62 82 d9 50 68 ab a0 c8 4d 80 58 fb 35 ab 12
    b7 a1 46 b6 b6 79 d8 30 38 0a d5 74 6e 4d 1d e6
    2c 32 e7 2a 09 b4 23 40 bb 80 d0 c0 56 a2 85 14
    31 31 86 51 08 97
write to 0x55c36bb16ba0 [0x55c36bbf89a0] (267 bytes => 267 (0x10B))
0000 - 16 03 01 01 06 10 00 01-02 01 00 28 69 fd e5 8c   ...........(i...
0010 - 37 d5 c8 42 12 b0 9d 09-7d 1b 3f 64 95 0e 17 6a   7..B....}.?d...j
0020 - 8d a7 c8 03 ca c1 e1 17-94 47 f3 90 50 1a ea 60   .........G..P..`
0030 - b4 e2 f6 2b f5 c5 07 c6-15 dd 94 13 ca 79 13 d3   ...+.........y..
0040 - 81 17 29 db 68 11 81 c1-3f ea c3 59 a9 05 c7 36   ..).h...?..Y...6
0050 - f0 77 8c b3 3d a9 8a f9-dd c4 f3 3d 65 42 42 4e   .w..=......=eBBN
0060 - d3 b7 fc ba 83 49 aa 12-22 56 b4 a3 f6 a0 25 1e   .....I.."V....%.
0070 - ca 2a d3 ba 7d 28 f4 f6-02 ee c0 a6 0f 99 c9 39   .*..}(.........9
0080 - d6 79 d8 4d f1 f5 52 78-95 96 8d 6a f5 c0 88 7a   .y.M..Rx...j...z
0090 - db 48 32 85 ce d7 3b 32-9d 02 bb 16 a2 ac 89 b7   .H2...;2........
00a0 - 6a 4c f7 8f 1c eb 95 8d-a6 26 80 e8 ee b0 25 7e   jL.......&....%~
00b0 - 9d 97 67 78 7b 38 e9 d1-1d e6 3f b8 ed 4b 68 00   ..gx{8....?..Kh.
00c0 - 9c 70 c2 f3 d1 b1 80 75-b4 76 a1 39 b6 36 a5 63   .p.....u.v.9.6.c
00d0 - 16 5a a5 e2 05 62 62 82-d9 50 68 ab a0 c8 4d 80   .Z...bb..Ph...M.
00e0 - 58 fb 35 ab 12 b7 a1 46-b6 b6 79 d8 30 38 0a d5   X.5....F..y.08..
00f0 - 74 6e 4d 1d e6 2c 32 e7-2a 09 b4 23 40 bb 80 d0   tnM..,2.*..#@...
0100 - c0 56 a2 85 14 31 31 86-51 08 97                  .V...11.Q..
SSL_connect:unknown state
>>> ??? [length 0005]
    14 03 01 00 01
>>> TLS 1.0 ChangeCipherSpec [length 0001]
    01
write to 0x55c36bb16ba0 [0x55c36bbf89a0] (6 bytes => 6 (0x6))
0000 - 14 03 01 00 01 01                                 ......
SSL_connect:unknown state
>>> ??? [length 0005]
    16 03 01 00 30
>>> TLS 1.0 Handshake [length 0010], Finished
    14 00 00 0c 69 e2 31 60 ad 31 d3 45 06 33 af 72
write to 0x55c36bb16ba0 [0x55c36bbf89a0] (53 bytes => 53 (0x35))
0000 - 16 03 01 00 30 7b d8 14-1b c5 b1 9f ce 03 1a 89   ....0{..........
0010 - ad fc 5e 36 61 95 63 31-25 c1 ef 86 6c 40 34 79   ..^6a.c1%...l@4y
0020 - da be ab f4 a8 b8 45 0c-49 d8 32 5a 00 ba ed 60   ......E.I.2Z...`
0030 - 51 00 54 d0 a2                                    Q.T..
SSL_connect:unknown state
SSL_connect:unknown state
read from 0x55c36bb16ba0 [0x55c36bbeef83] (5 bytes => 5 (0x5))
0000 - 16 03 01 00 aa                                    .....
<<< ??? [length 0005]
    16 03 01 00 aa
read from 0x55c36bb16ba0 [0x55c36bbeef88] (170 bytes => 170 (0xAA))
0000 - 04 00 00 a6 00 00 01 2c-00 a0 16 ca 6e 15 3d 99   .......,....n.=.
0010 - 08 cf 52 c4 50 33 70 66-8b 37 7a b0 81 91 3e d8   ..R.P3pf.7z...>.
0020 - c4 fc e1 5f fc 04 64 8f-f7 3c 10 d5 90 31 69 9b   ..._..d..<...1i.
0030 - 8f 01 97 7b b6 04 ec f8-ed c3 30 2d b8 cd 15 7b   ...{......0-...{
0040 - 04 8c 2b 11 ee 99 36 eb-29 14 08 0e 84 a0 4b 77   ..+...6.).....Kw
0050 - 71 ac 18 38 2d 21 62 49-09 cc 94 9a 43 cf 58 a3   q..8-!bI....C.X.
0060 - d4 79 7d 12 31 76 5e 10-f3 a3 78 91 72 48 75 af   .y}.1v^...x.rHu.
0070 - e5 64 64 7c a8 53 6e b2-ff c9 21 70 df 1a 3c 74   .dd|.Sn...!p..<t
0080 - 6b 72 73 e5 65 4e a2 95-c2 fa 1f 79 22 14 cd 8e   krs.eN.....y"...
0090 - 3b 75 01 88 d7 ce 75 22-51 c0 8e a3 25 27 d8 2a   ;u....u"Q...%'.*
00a0 - d1 90 1b e4 c4 2b ff 29-04 6f                     .....+.).o
<<< TLS 1.0 Handshake [length 00aa]???
    04 00 00 a6 00 00 01 2c 00 a0 16 ca 6e 15 3d 99
    08 cf 52 c4 50 33 70 66 8b 37 7a b0 81 91 3e d8
    c4 fc e1 5f fc 04 64 8f f7 3c 10 d5 90 31 69 9b
    8f 01 97 7b b6 04 ec f8 ed c3 30 2d b8 cd 15 7b
    04 8c 2b 11 ee 99 36 eb 29 14 08 0e 84 a0 4b 77
    71 ac 18 38 2d 21 62 49 09 cc 94 9a 43 cf 58 a3
    d4 79 7d 12 31 76 5e 10 f3 a3 78 91 72 48 75 af
    e5 64 64 7c a8 53 6e b2 ff c9 21 70 df 1a 3c 74
    6b 72 73 e5 65 4e a2 95 c2 fa 1f 79 22 14 cd 8e
    3b 75 01 88 d7 ce 75 22 51 c0 8e a3 25 27 d8 2a
    d1 90 1b e4 c4 2b ff 29 04 6f
SSL_connect:unknown state
read from 0x55c36bb16ba0 [0x55c36bbeef83] (5 bytes => 5 (0x5))
0000 - 14 03 01 00 01                                    .....
<<< ??? [length 0005]
    14 03 01 00 01
read from 0x55c36bb16ba0 [0x55c36bbeef88] (1 bytes => 1 (0x1))
0000 - 01                                                .
<<< TLS 1.0 ChangeCipherSpec [length 0001]
    01
read from 0x55c36bb16ba0 [0x55c36bbeef83] (5 bytes => 5 (0x5))
0000 - 16 03 01 00 30                                    ....0
<<< ??? [length 0005]
    16 03 01 00 30
read from 0x55c36bb16ba0 [0x55c36bbeef88] (48 bytes => 48 (0x30))
0000 - 52 7a 9b ef 58 e3 be ea-5f 46 1d 89 b8 af c9 79   Rz..X..._F.....y
0010 - 97 7f 68 86 92 d8 37 ff-57 78 4f d9 48 f8 92 5a   ..h...7.WxO.H..Z
0020 - 77 0b ac 4c 07 55 14 a7-d2 b9 f2 1a 6e bc a9 bc   w..L.U......n...
<<< TLS 1.0 Handshake [length 0010], Finished
    14 00 00 0c 13 f5 f9 2b 0c 87 22 9c c4 57 b5 08
SSL_connect:unknown state
---
no peer certificate available
---
No client certificate CA names sent
Server Temp Key: DH, 2048 bits
---
SSL handshake has read 834 bytes and written 557 bytes
---
New, TLSv1/SSLv3, Cipher is ADH-AES256-SHA
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : ADH-AES256-SHA
    Session-ID: D9291D9606A1E04C07A69874B1975ABF892E9868B91801365C6C22DD14EDA6D1
    Session-ID-ctx: 
    Master-Key: F042194C91B62195B2E02FD5AAD88F065CD4A276DD3D6703B52084ED2099CD30580B218277B7EBDC736CCC360B3763B9
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 16 ca 6e 15 3d 99 08 cf-52 c4 50 33 70 66 8b 37   ..n.=...R.P3pf.7
    0010 - 7a b0 81 91 3e d8 c4 fc-e1 5f fc 04 64 8f f7 3c   z...>...._..d..<
    0020 - 10 d5 90 31 69 9b 8f 01-97 7b b6 04 ec f8 ed c3   ...1i....{......
    0030 - 30 2d b8 cd 15 7b 04 8c-2b 11 ee 99 36 eb 29 14   0-...{..+...6.).
    0040 - 08 0e 84 a0 4b 77 71 ac-18 38 2d 21 62 49 09 cc   ....Kwq..8-!bI..
    0050 - 94 9a 43 cf 58 a3 d4 79-7d 12 31 76 5e 10 f3 a3   ..C.X..y}.1v^...
    0060 - 78 91 72 48 75 af e5 64-64 7c a8 53 6e b2 ff c9   x.rHu..dd|.Sn...
    0070 - 21 70 df 1a 3c 74 6b 72-73 e5 65 4e a2 95 c2 fa   !p..<tkrs.eN....
    0080 - 1f 79 22 14 cd 8e 3b 75-01 88 d7 ce 75 22 51 c0   .y"...;u....u"Q.
    0090 - 8e a3 25 27 d8 2a d1 90-1b e4 c4 2b ff 29 04 6f   ..%'.*.....+.).o

    Start Time: 1532677446
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
rpv-tomsk commented 6 years ago

Ok, I will try to compile 1.1.x and play/reproduce the case.

rpv-tomsk commented 6 years ago 
root@hs01:/opt/openssl# ./openssl version
OpenSSL 1.1.1-pre8 (beta) 20 Jun 2018

root@hs01:/opt/openssl# ./openssl s_client  -connect router:8729 -tls1_2
CONNECTED(00000003)
depth=0 C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
verify error:num=18:self signed certificate
verify return:1
depth=0 C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
verify return:1
---
Certificate chain
 0 s:C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
   i:C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
---
Server certificate
-----BEGIN CERTIFICATE-----
[..cut..]
-----END CERTIFICATE-----
subject=C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router
issuer=C = RU, ST = Tomsk, L = Tomsk, O = Router, OU = Router

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: DH, 2048 bits
---
SSL handshake has read 2095 bytes and written 531 bytes
Verification error: self signed certificate
---
New, TLSv1.2, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : DHE-RSA-AES256-GCM-SHA384
    Session-ID: FECCE451696DC7912712EFF74C6435E2BD56DC2D13116C9FA125C9869DF1830A
    Session-ID-ctx:
    Master-Key: 51CBB1CEE540EA667812B0FE356B25C510E90B9F9882CF9C12CA0128C1B074F360EA4017BE9324BD81517069C68D9125
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - f9 5c aa 0d 84 a3 9e 8f-52 43 46 37 ca 66 31 ea   .\......RCF7.f1.
    0010 - d6 d0 cc 49 29 ec 05 2e-18 7a d0 3a ff 46 d1 4d   ...I)....z.:.F.M
    0020 - ce 0d 77 43 cd 18 17 61-50 b8 36 21 ec 95 ae f3   ..wC...aP.6!....
    0030 - a6 8e 39 9c f0 94 2c d5-6e 88 1c 76 c5 ff 64 c9   ..9...,.n..v..d.
    0040 - a7 35 af a3 05 41 49 a8-3a c4 2c 86 2d 5c df 36   .5...AI.:.,.-\.6
    0050 - b5 f5 a5 86 ff 24 6a 4d-3a 1b 5e d5 95 05 8b 84   .....$jM:.^.....
    0060 - 2a 2c a7 ac 39 6b 5e f7-02 68 e5 ac 54 09 5a 36   *,..9k^..h..T.Z6
    0070 - 20 09 8b f7 5c a4 c1 2d-e5 cd b3 ca a1 ac 87 71    ...\..-.......q
    0080 - db 86 b5 53 31 d7 df bb-9f a0 31 b1 fe 42 2b 2a   ...S1.....1..B+*
    0090 - d8 b4 93 8c 26 cf 78 8e-a3 31 5a 07 b7 da 64 05   ....&.x..1Z...d.
    00a0 - 46 c0 e2 68 cb cc d6 f2-f6 74 75 15 a9 cd 7c 2b   F..h.....tu...|+

    Start Time: 1532688555
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)
    Extended master secret: no
---
rpv-tomsk commented 6 years ago

Also no problems to use -tls1 and -tls1_1.

Should I check 1.1.0 ?

miegl commented 6 years ago

@rpv-tomsk that's because you use a certificate. Do /ip service set api-ssl certificate=none and try again. On openssl 1.1.* it won't work.

rpv-tomsk commented 6 years ago

I think certificate requirement should be mandatory, otherwise "SSL" will be insecure because of possible MITM. ) Ok, will try to check this case too.

rpv-tomsk commented 6 years ago

yes, w/o certificate it complains with SSL alert number 40

3072784704:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1557:SSL alert number 40
rpv-tomsk commented 6 years ago

Also, when no cert is configured then same complain SSL alert number 40 on version 1.0.1t (Debian).

miegl commented 6 years ago

@rpv-tomsk you must specify cipher and tls1 openssl s_client -tls1 -cipher "ADH AES256 SHA " -debug -msg -state -connect mikrotik:8729

rpv-tomsk commented 6 years ago

@rpv-tomsk you must specify cipher and tls1

Yes, then it works.