Re: BUG #1321: SSL error: sslv3 alert handshake failure - Mailing list pgsql-bugs

From Magnus Hagander
Subject Re: BUG #1321: SSL error: sslv3 alert handshake failure
Date
Msg-id 6BCB9D8A16AC4241919521715F4D8BCE456A58@algol.sollentuna.se
Whole thread Raw
In response to BUG #1321: SSL error: sslv3 alert handshake failure  ("PostgreSQL Bugs List" <pgsql-bugs@postgresql.org>)
Responses Re: BUG #1321: SSL error: sslv3 alert handshake failure
List pgsql-bugs
>> After installing 8.0.0beta4 (previously tried with=20
>beta3,2,etc) on a linux=20
>> system with a working 7.4.x installation I was unable to=20
>connect with ssl.=20
>> Tried compiling with OpenSSL 0.9.7d/e. I used certificates=20
>created with=20
>> OpenSSL 0.9.7d/e that both worked fine with 7.4.x but=20
>apparently not so with=20
>> 8.0.0. Server starts fine, but when I attempt to connect to=20
>the server with=20
>> latest pgadmin or psql (8.0.0beta4 both on the pgfoundry=20
>binary for windows=20
>> and a compiled version on Mandrake Linux) the error is=20
>always the same. The=20
>> error message returned to the client is "SSL error: sslv3=20
>alert handshake=20
>> failure". The log reports: "could not accept SSL connection: 1".=20
>
>The only SSL changes between beta3 and beta4 were Magnus' changes to
>make ssl work on Windows, so I'm assuming this is his fault ...

It would have to come from
http://developer.postgresql.org/cvsweb.cgi/pgsql-server/src/backend/libp
q/be-secure.c.diff?r1=3D1.51&r2=3D1.52, the part where it fixes error
handling.
(Previusly it did three API calls and didn't actually check their
results individually)
In open_server_ssl(), right at the bottom.

I can't see where the problem is though. And it did work in all my
testing - both Windows and Linux. But that part can certainly be
reversed - I only added it because I needed the better error reporting
during debugging, and figured it would be useful for others as well.

I'm not 100% sure from the post wether this problem was actually not
present in beta3, or if it possibly was. But that could be me reading
the report trying to make it fit my needs.


Upon reviewing this patch, I notice this horrible line slipped into the
patch earlier up (in the #ifdef WIN32 section):
+        printf("uhh\n");fflush(stdout);

Oopsie. Could you remove that, or do you want a patch to do it? :-)
Can't beleive I missed that...

//Magnus

pgsql-bugs by date:

Previous
From: Tom Lane
Date:
Subject: Re: BUG #1321: SSL error: sslv3 alert handshake failure
Next
From: Michael Fuhr
Date:
Subject: Re: BUG #1321: SSL error: sslv3 alert handshake failure