Horton

Thread

  1. BUG #1321: SSL error: sslv3 alert handshake failure

    PostgreSQL Bugs List <pgsql-bugs@postgresql.org> — 2004-11-16T03:40:39Z

    The following bug has been logged online:

Bug reference:      1321
Logged by:          T.J. Ferraro

Email address:      tjtoocool@phreaker.net

PostgreSQL version: 8.0 Beta

Operating system:   Mandrake Linux 10

Description:        SSL error: sslv3 alert handshake failure

Details: 

After installing 8.0.0beta4 (previously tried with beta3,2,etc) on a linux 
system with a working 7.4.x installation I was unable to connect with ssl. 
Tried compiling with OpenSSL 0.9.7d/e. I used certificates created with 
OpenSSL 0.9.7d/e that both worked fine with 7.4.x but apparently not so with 
8.0.0. Server starts fine, but when I attempt to connect to the server with 
latest pgadmin or psql (8.0.0beta4 both on the pgfoundry binary for windows 
and a compiled version on Mandrake Linux) the error is always the same. The 
error message returned to the client is "SSL error: sslv3 alert handshake 
failure". The log reports: "could not accept SSL connection: 1".

  2. Re: BUG #1321: SSL error: sslv3 alert handshake failure

    Tom Lane <tgl@sss.pgh.pa.us> — 2004-11-16T20:01:23Z

    "PostgreSQL Bugs List" <pgsql-bugs@postgresql.org> writes:
> After installing 8.0.0beta4 (previously tried with beta3,2,etc) on a linux 
> system with a working 7.4.x installation I was unable to connect with ssl. 
> Tried compiling with OpenSSL 0.9.7d/e. I used certificates created with 
> OpenSSL 0.9.7d/e that both worked fine with 7.4.x but apparently not so with 
> 8.0.0. Server starts fine, but when I attempt to connect to the server with 
> latest pgadmin or psql (8.0.0beta4 both on the pgfoundry binary for windows 
> and a compiled version on Mandrake Linux) the error is always the same. The 
> error message returned to the client is "SSL error: sslv3 alert handshake 
> failure". The log reports: "could not accept SSL connection: 1". 

The only SSL changes between beta3 and beta4 were Magnus' changes to
make ssl work on Windows, so I'm assuming this is his fault ...

			regards, tom lane

  3. Re: BUG #1321: SSL error: sslv3 alert handshake failure

    Michael Fuhr <mike@fuhr.org> — 2004-11-16T20:30:33Z

    On Tue, Nov 16, 2004 at 03:01:23PM -0500, Tom Lane wrote:
> "PostgreSQL Bugs List" <pgsql-bugs@postgresql.org> writes:
> > After installing 8.0.0beta4 (previously tried with beta3,2,etc) on a linux 
> > system with a working 7.4.x installation I was unable to connect with ssl. 
> > Tried compiling with OpenSSL 0.9.7d/e. I used certificates created with 
> > OpenSSL 0.9.7d/e that both worked fine with 7.4.x but apparently not so with 
> > 8.0.0. Server starts fine, but when I attempt to connect to the server with 
> > latest pgadmin or psql (8.0.0beta4 both on the pgfoundry binary for windows 
> > and a compiled version on Mandrake Linux) the error is always the same. The 
> > error message returned to the client is "SSL error: sslv3 alert handshake 
> > failure". The log reports: "could not accept SSL connection: 1". 
> 
> The only SSL changes between beta3 and beta4 were Magnus' changes to
> make ssl work on Windows, so I'm assuming this is his fault ...

Sounds like a problem due to the backend in recent betas demanding
a client certificate if $PGDATA/root.crt exists, but the client
certificate doesn't exist in ~/.postgresql/postgresql.{crt,key}.

What happens if you remove or rename $PGDATA/root.crt and restart
the backend?  The server should print warnings like the following
but client connections should then succeed:

could not load root certificate file "/usr/local/pgsql/data/root.crt": No such file or directory
Will not verify client certificates.

Or you could install a client certificate and key in the locations
mentioned (~/.postgresql/postgresql.{crt,key}).

-- 
Michael Fuhr
http://www.fuhr.org/~mfuhr/

  4. Re: BUG #1321: SSL error: sslv3 alert handshake failure

    Tom Lane <tgl@sss.pgh.pa.us> — 2004-11-16T20:33:49Z

    Michael Fuhr <mike@fuhr.org> writes:
> Sounds like a problem due to the backend in recent betas demanding
> a client certificate if $PGDATA/root.crt exists, but the client
> certificate doesn't exist in ~/.postgresql/postgresql.{crt,key}.

If that is the problem, it's still broken because the error message
is so unhelpful.  (I'm quite certain I tested that case last time
I touched the SSL code, and it said something reasonable then.)

			regards, tom lane

  5. Re: BUG #1321: SSL error: sslv3 alert handshake failure

    Michael Fuhr <mike@fuhr.org> — 2004-11-16T20:41:56Z

    On Tue, Nov 16, 2004 at 03:33:49PM -0500, Tom Lane wrote:
> Michael Fuhr <mike@fuhr.org> writes:
> > Sounds like a problem due to the backend in recent betas demanding
> > a client certificate if $PGDATA/root.crt exists, but the client
> > certificate doesn't exist in ~/.postgresql/postgresql.{crt,key}.
> 
> If that is the problem, it's still broken because the error message
> is so unhelpful.  (I'm quite certain I tested that case last time
> I touched the SSL code, and it said something reasonable then.)

I get the following error if I use an 8.0.0beta4 client to connect
to an 8.0.0beta4 server that has a root.crt, but the client certificate
doesn't exist in ~/.postgresql:

psql: SSL error: sslv3 alert handshake failure

The server logs the following:

LOG:  could not accept SSL connection: 1

If the certificate exists but I use a 7.4.6 client, then the client
fails with the following:

psql: unrecognized SSL error code

The server logs this:

LOG:  could not accept SSL connection: 5

-- 
Michael Fuhr
http://www.fuhr.org/~mfuhr/

  6. Re: BUG #1321: SSL error: sslv3 alert handshake failure

    T.J. Ferraro <tjtoocool@phreaker.net> — 2004-11-16T22:48:52Z

    To clarify, what I have experienced was in all versions of 8.0.0.beta, 
it did not just happen between 3 to 4. It was the change from 7.4 to 
8.0. The error was not just windows based as I built psql on a seperate 
linux machine communicating with a linux server and got the same 
results. I created a client.crt client.key and placed them into the data 
directory, no change. I read the below post again and renamed the files 
to postgresql.crt and postgresql.key. No change. Read the below post 
very carefully AGAIN and then copied those files up one directory into 
the main pgsql dir. No change. Did I miss something?

Michael Fuhr wrote:

>On Tue, Nov 16, 2004 at 03:33:49PM -0500, Tom Lane wrote:
>  
>
>>Michael Fuhr <mike@fuhr.org> writes:
>>    
>>
>>>Sounds like a problem due to the backend in recent betas demanding
>>>a client certificate if $PGDATA/root.crt exists, but the client
>>>certificate doesn't exist in ~/.postgresql/postgresql.{crt,key}.
>>>      
>>>
>>If that is the problem, it's still broken because the error message
>>is so unhelpful.  (I'm quite certain I tested that case last time
>>I touched the SSL code, and it said something reasonable then.)
>>    
>>
>
>I get the following error if I use an 8.0.0beta4 client to connect
>to an 8.0.0beta4 server that has a root.crt, but the client certificate
>doesn't exist in ~/.postgresql:
>
>psql: SSL error: sslv3 alert handshake failure
>
>The server logs the following:
>
>LOG:  could not accept SSL connection: 1
>
>If the certificate exists but I use a 7.4.6 client, then the client
>fails with the following:
>
>psql: unrecognized SSL error code
>
>The server logs this:
>
>LOG:  could not accept SSL connection: 5
>
>  
>

  7. Re: BUG #1321: SSL error: sslv3 alert handshake failure

    Tom Lane <tgl@sss.pgh.pa.us> — 2004-11-16T22:56:22Z

    "T.J." <tjtoocool@phreaker.net> writes:
> To clarify, what I have experienced was in all versions of 8.0.0.beta, 
> it did not just happen between 3 to 4. It was the change from 7.4 to 
> 8.0. The error was not just windows based as I built psql on a seperate 
> linux machine communicating with a linux server and got the same 
> results. I created a client.crt client.key and placed them into the data 
> directory, no change. I read the below post again and renamed the files 
> to postgresql.crt and postgresql.key. No change. Read the below post 
> very carefully AGAIN and then copied those files up one directory into 
> the main pgsql dir. No change. Did I miss something?

The client key files go into something under the client user's HOME
directory (I think ~/.pgsql/client.key, but check the manual).  This
is entirely unrelated to either PGDATA or the postgres user's home
(neither of which a client program would be able to read, typically).

This stuff is documented in the 8.0 libpq docs.

			regards, tom lane