When running C-ICAP in TLS Mode, one of our TLS Client is not able to communicate using Ciphers ECDHE-RSA-AES128-GCM-SHA256 and ECDHE-RSA-AES256-GCM-SHA384 resulting in ICAP Communication Failure.
Inorder to workaround, I tried below things which failed:
a) Enabled Tls in c-icap.conf file with these two Ciphers as follows in c-icap package version 0.5.6:
TlsPort 11344 tls-method=TLSv1_2 cert=/etc/ssl/certs/server_cert.pem key=/etc/ssl/private/server_key.pem ciphers=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384
b) As C-ICAP internally uses openssl, Assumed its a issue in openssl ran openssl s_server listening to same port, same certificate and same cipher which worked fine on my TLS Client connection
c) Enabled same thing in c-icap package version 0.5.10, still the results are same.
All resulted with error:
139980890897424:error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher:s3_srvr.c:1417:
Inorder to understand what Ciphers C-ICAP Support I tried trying to connect to C-ICAP Server from custom Client which communicated with Cipher AES256-GCM-SHA384. Seems like other than Cipher AES256-GCM-SHA384 no other c-icap supports inspite of using openssl underneath is that correct?
Is there any workaround for the C-ICAP Server to choose Custom Cipher(as mentioned above) what I wanted?
Anonymous
Any Update Please? I am stuck with C-ICAP with TLS, Any Workaround?
Attached is the Client Output Screenshot that I am seeing with both working and non working Ciphers
Any Update or Any Suggestion or Any Workaround?