[go: up one dir, main page]

Menu

#17 C-ICAP Fails to communicate using TLS Ciphers ECDHE-RSA-AES128-GCM-SHA256 and ECDHE-RSA-AES256-GCM-SHA384

v1.0_(example)
open
chtsanti
1
2021-10-26
2021-10-24
Anonymous
No

When running C-ICAP in TLS Mode, one of our TLS Client is not able to communicate using Ciphers ECDHE-RSA-AES128-GCM-SHA256 and ECDHE-RSA-AES256-GCM-SHA384 resulting in ICAP Communication Failure.
Inorder to workaround, I tried below things which failed:
a) Enabled Tls in c-icap.conf file with these two Ciphers as follows in c-icap package version 0.5.6:
TlsPort 11344 tls-method=TLSv1_2 cert=/etc/ssl/certs/server_cert.pem key=/etc/ssl/private/server_key.pem ciphers=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384
b) As C-ICAP internally uses openssl, Assumed its a issue in openssl ran openssl s_server listening to same port, same certificate and same cipher which worked fine on my TLS Client connection
c) Enabled same thing in c-icap package version 0.5.10, still the results are same.

All resulted with error:
139980890897424:error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher:s3_srvr.c:1417:

Inorder to understand what Ciphers C-ICAP Support I tried trying to connect to C-ICAP Server from custom Client which communicated with Cipher AES256-GCM-SHA384. Seems like other than Cipher AES256-GCM-SHA384 no other c-icap supports inspite of using openssl underneath is that correct?

Is there any workaround for the C-ICAP Server to choose Custom Cipher(as mentioned above) what I wanted?

Discussion

  • Anonymous

    Anonymous - 2021-10-25
    Post awaiting moderation.
  • Anonymous

    Anonymous - 2021-10-25
    Post awaiting moderation.
  • Srikanth R

    Srikanth R - 2021-10-25

    Any Update Please? I am stuck with C-ICAP with TLS, Any Workaround?

     
  • Srikanth R

    Srikanth R - 2021-10-25

    Attached is the Client Output Screenshot that I am seeing with both working and non working Ciphers

     
  • Srikanth R

    Srikanth R - 2021-10-26

    Any Update or Any Suggestion or Any Workaround?

     

Anonymous
Anonymous

Add attachments
Cancel