The explicit "no encrypted dialing" problem when trying to securely connect to the server

Question

I have a problem when a client (not mine) connects to my server reliably.

It seems like the connection is down based on cipher mismatch, but I confirmed that the server does share some ciphers with the client.

Maybe a problem with an unknown cipher (Unknown 0x0: 0x60)? If so, what should I do to fix this?

Java SSL logs are shown below:

Listener-https, setSoTimeout(30000) called Worker-30, READ: SSLv3 Handshake, length = 63 *** ClientHello, SSLv3 RandomCookie: GMT: 1267050437 bytes = { 23, 244, 228, 68, 161, 225, 218, 222, 207, 128, 228, 138, 127, 141, 159, 63, 232, 48, 242, 240, 26, 76, 58, 158, 179, 0, 192, 140 } Session ID: {} Cipher Suites: [TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_IDEA_CBC_SHA, SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_EXPORT1024_WITH_RC4_56_SHA, Unknown 0x0:0x60, SSL_RSA_EXPORT_WITH_RC4_40_MD5] Compression Methods: { 0 } *** Worker-30, SEND SSLv3 ALERT: fatal, description = handshake_failure Worker-30, WRITE: SSLv3 Alert, length = 2 Worker-30, called closeSocket() Worker-30, handling exception: javax.net.ssl.SSLHandshakeException: no cipher suites in common Worker-30, called close() Worker-30, called closeInternal(true) Worker-30, called close() Worker-30, called closeInternal(true) 

Thanks, Ben

Answer 1

Adding erickson to the answer, if your certificate does not use an RSA key pair, and instead it turns out that a DSA key pair is used, then no information about the RSA "encryption" set will help in solving this problem. You will need to enable the encryption kits associated with the DSA (they usually indicate the DSS keyword), and the client will use the same cipher suites.

The reason this edge case may turn out to be your problem is explained by the default behavior of the keytool utility when creating secret keys - DSA, not RSA, is the default algorithm.

Answer 2

You say that some of the ciphers requested by the client are enabled on your server. Have you successfully contacted one of them? For example, try the OpenSSL s_client utility with the -cipher , specifying only this cipher suite.

Perhaps the provider does not support all the ciphers that you think you included, or perhaps files with unlimited jurisdiction are incorrectly installed on your server.