headers
Michael Meyer | 15 Feb 2010 11:35
Picon
Picon

Oracle Weblogic 10.3 + gnutls-cli = A TLS fatal...

Hello,

Default installation of a Oracle Weblogic 10.3. NodeManager is listen
at port 5556.

mime <at> openvas-qa:~> gnutls-cli --port 5556 GFDGFDGSFD
Resolving 'GFDGFDGSFD'...
Connecting to '192.168.2.6:5556'...
*** Fatal error: A TLS fatal alert has been received.
*** Received alert [70]: Error in protocol version
*** Handshake has failed
GNUTLS ERROR: A TLS fatal alert has been received.

gnutls-cli-debug -p 5556 GFDGFDGSFD -V  
http://pastebin.com/m2de5dfaa  

gnutls-cli --port 5556 GFDGFDGSFD -d 4711 -V
http://pastebin.com/f27633473

openssl s_client -host 192.168.2.6 -port 5556
http://pastebin.com/m61a8b468

Why i can't connect to the Weblogic Server with gnutls-cli? Is there
anything i can do to make it work?

I did not really know a lot about ssl and certs and so on... ;)

Thanks

Micha
(Continue reading)

Permalink | Reply | 15 comments |
headers
Simon Josefsson | 15 Feb 2010 11:54
Favicon
Gravatar

Re: Oracle Weblogic 10.3 + gnutls-cli = A TLS fatal...

Michael Meyer <mime <at> gmx.de> writes:

> Hello,
>
> Default installation of a Oracle Weblogic 10.3. NodeManager is listen
> at port 5556.
>
> mime <at> openvas-qa:~> gnutls-cli --port 5556 GFDGFDGSFD
> Resolving 'GFDGFDGSFD'...
> Connecting to '192.168.2.6:5556'...
> *** Fatal error: A TLS fatal alert has been received.
> *** Received alert [70]: Error in protocol version
> *** Handshake has failed
> GNUTLS ERROR: A TLS fatal alert has been received.
>
> gnutls-cli-debug -p 5556 GFDGFDGSFD -V  
> http://pastebin.com/m2de5dfaa  
>
> gnutls-cli --port 5556 GFDGFDGSFD -d 4711 -V
> http://pastebin.com/f27633473
>
> openssl s_client -host 192.168.2.6 -port 5556
> http://pastebin.com/m61a8b468
>
> Why i can't connect to the Weblogic Server with gnutls-cli? Is there
> anything i can do to make it work?

Try disabling TLS versions > 1.0 or TLS extensions.

/Simon
(Continue reading)

Permalink | Reply | 14 comments |
headers
Michael Meyer | 15 Feb 2010 12:21
Picon
Picon

Re: Oracle Weblogic 10.3 + gnutls-cli = A TLS fatal...

Hello,

*** Simon Josefsson <simon <at> josefsson.org> wrote:
> Michael Meyer <mime <at> gmx.de> writes:
> >
> > Why i can't connect to the Weblogic Server with gnutls-cli? Is there
> > anything i can do to make it work?
> 
> Try disabling TLS versions > 1.0 or TLS extensions.

Don't work. I hope I make it right. ;)

http://pastebin.com/f56a825f6

Thanks

Micha
Permalink | Reply | 13 comments |
headers
Nikos Mavrogiannopoulos | 15 Feb 2010 15:58

Re: Oracle Weblogic 10.3 + gnutls-cli = A TLS fatal...

As far as I understand from the logs this server only supports RC4-40.
(ARCFOUR-40 in gnutls)
and does not want to see anything over TLS 1.0.

On Mon, Feb 15, 2010 at 12:21 PM, Michael Meyer <mime <at> gmx.de> wrote:
> Hello,
>
> *** Simon Josefsson <simon <at> josefsson.org> wrote:
>> Michael Meyer <mime <at> gmx.de> writes:
>> >
>> > Why i can't connect to the Weblogic Server with gnutls-cli? Is there
>> > anything i can do to make it work?
>>
>> Try disabling TLS versions > 1.0 or TLS extensions.
>
> Don't work. I hope I make it right. ;)
>
> http://pastebin.com/f56a825f6
>
> Thanks
>
> Micha
>
>
> _______________________________________________
> Help-gnutls mailing list
> Help-gnutls <at> gnu.org
> http://lists.gnu.org/mailman/listinfo/help-gnutls
>
(Continue reading)

Permalink | Reply | 0 comments |
headers
Simon Josefsson | 15 Feb 2010 20:34
Favicon
Gravatar

Re: Oracle Weblogic 10.3 + gnutls-cli = A TLS fatal...

Michael Meyer <mime <at> gmx.de> writes:

> Hello,
>
> *** Simon Josefsson <simon <at> josefsson.org> wrote:
>> Michael Meyer <mime <at> gmx.de> writes:
>> >
>> > Why i can't connect to the Weblogic Server with gnutls-cli? Is there
>> > anything i can do to make it work?
>> 
>> Try disabling TLS versions > 1.0 or TLS extensions.
>
> Don't work. I hope I make it right. ;)
>
> http://pastebin.com/f56a825f6

Try

gnutls-cli --disable-extensions -p 5556 GFDGFDGSFD -d 4711 -V --priority "NORMAL:%COMPAT:-VERS-TLS1.1:-CTYPE-OPENPGP"

/Simon
Permalink | Reply | 11 comments |
headers
Michael Meyer | 15 Feb 2010 21:17
Picon
Picon

Re: Oracle Weblogic 10.3 + gnutls-cli = A TLS fatal...

*** Simon Josefsson <simon <at> josefsson.org> wrote:
> Michael Meyer <mime <at> gmx.de> writes:

> > http://pastebin.com/f56a825f6
> 
> gnutls-cli --disable-extensions -p 5556 GFDGFDGSFD -d 4711 -V --priority "NORMAL:%COMPAT:-VERS-TLS1.1:-CTYPE-OPENPGP"

No, doesn't work either.

http://pastebin.com/m60914e97

It *seems* that this behavior can be reproduced by doing:

,---|
| mime <at> kira:~ % openssl s_server -accept 5556 \ 
|               -key /home/mime/ca/serverkey.pem \
|               -cert /home/mime/ca/servercert.pem \
|               -cipher EXP-RC4-MD5
`---|

http://pastebin.com/m5471d160

Thanks again for your help.

Micha
Permalink | Reply | 10 comments |
headers
Nikos Mavrogiannopoulos | 15 Feb 2010 21:40

Re: Oracle Weblogic 10.3 + gnutls-cli = A TLS fatal...

Michael Meyer wrote:
> *** Simon Josefsson <simon <at> josefsson.org> wrote:
>> Michael Meyer <mime <at> gmx.de> writes:
> 
>>> http://pastebin.com/f56a825f6
>> gnutls-cli --disable-extensions -p 5556 GFDGFDGSFD -d 4711 -V --priority "NORMAL:%COMPAT:-VERS-TLS1.1:-CTYPE-OPENPGP"

He needs to add +ARCFOUR-40 and +RSA-EXPORT as well. They are not
enabled by default.

regards,
Nikos
Permalink | Reply | 9 comments |
headers
Simon Josefsson | 15 Feb 2010 21:49
Favicon
Gravatar

Re: Oracle Weblogic 10.3 + gnutls-cli = A TLS fatal...

Nikos Mavrogiannopoulos <nmav <at> gnutls.org> writes:

> Michael Meyer wrote:
>> *** Simon Josefsson <simon <at> josefsson.org> wrote:
>>> Michael Meyer <mime <at> gmx.de> writes:
>> 
>>>> http://pastebin.com/f56a825f6
>>> gnutls-cli --disable-extensions -p 5556 GFDGFDGSFD -d 4711 -V --priority "NORMAL:%COMPAT:-VERS-TLS1.1:-CTYPE-OPENPGP"
>
> He needs to add +ARCFOUR-40 and +RSA-EXPORT as well. They are not
> enabled by default.

Michael can you try that?  Also try %SSL3_RECORD_VERSION.

/Simon
Permalink | Reply | 8 comments |
headers
Michael Meyer | 16 Feb 2010 10:29
Picon
Picon

Re: Oracle Weblogic 10.3 + gnutls-cli = A TLS fatal...

*** Simon Josefsson <simon <at> josefsson.org> wrote:
> Nikos Mavrogiannopoulos <nmav <at> gnutls.org> writes:
> > Michael Meyer wrote:

> >>>> http://pastebin.com/f56a825f6
> >>> gnutls-cli --disable-extensions -p 5556 GFDGFDGSFD -d 4711 -V --priority "NORMAL:%COMPAT:-VERS-TLS1.1:-CTYPE-OPENPGP"
> >
> > He needs to add +ARCFOUR-40 and +RSA-EXPORT as well. They are not
> > enabled by default.

I've tried with +ARCFOUR-40 but never with +RSA-EXPORT.

> Michael can you try that?  Also try %SSL3_RECORD_VERSION.

gnutls-cli -p 5556 GFDGFDGSFD --priority "NORMAL:%COMPAT:-VERS-TLS1.1:+ARCFOUR-40:+RSA-EXPORT"

That's it. It works. http://pastebin.com/m357f13b2

Any hints how to make this work also with C-code? :) One of our
C-Developers ask me that. We are looking for the best way to
*always* get a connection in C? Even if there is something
"strange" on the remote side.

Many thanks to you both.

Micha
Permalink | Reply | 7 comments |
headers
Simon Josefsson | 16 Feb 2010 14:22
Favicon
Gravatar

Re: Oracle Weblogic 10.3 + gnutls-cli = A TLS fatal...

Michael Meyer <mime <at> gmx.de> writes:

> *** Simon Josefsson <simon <at> josefsson.org> wrote:
>> Nikos Mavrogiannopoulos <nmav <at> gnutls.org> writes:
>> > Michael Meyer wrote:
>
>> >>>> http://pastebin.com/f56a825f6
>> >>> gnutls-cli --disable-extensions -p 5556 GFDGFDGSFD -d 4711 -V --priority "NORMAL:%COMPAT:-VERS-TLS1.1:-CTYPE-OPENPGP"
>> >
>> > He needs to add +ARCFOUR-40 and +RSA-EXPORT as well. They are not
>> > enabled by default.
>
> I've tried with +ARCFOUR-40 but never with +RSA-EXPORT.
>
>> Michael can you try that?  Also try %SSL3_RECORD_VERSION.
>
> gnutls-cli -p 5556 GFDGFDGSFD --priority "NORMAL:%COMPAT:-VERS-TLS1.1:+ARCFOUR-40:+RSA-EXPORT"
>
> That's it. It works. http://pastebin.com/m357f13b2

Do you need all of them?  Try removing each of them until it breaks, and
until you have tried removing all items.

> Any hints how to make this work also with C-code? :) One of our
> C-Developers ask me that. We are looking for the best way to
> *always* get a connection in C? Even if there is something
> "strange" on the remote side.

Call something like this:
(Continue reading)

Permalink | Reply | 6 comments |

Gmane