Btw, I think there is a problem in freeswitch - if for example I configure stunnel, there is no problem with specifying accepting also older TLS standards without the need of changing the MinProtocol setting within the openssl.cnf file. As a user or admin, I would normally expect the tls-version parameter to do the same job for me... Cheers, Walter On Tue, Nov 12, 2019 at 09:27:16PM +0100, Sebastian Kemper wrote:
On Mon, Nov 11, 2019 at 11:21:05PM +0100, Walter Behrend wrote:
It seems it does not matter which value I set for "tls_version" - in every case, my TLS enabled port only accepts TLS 1.3 connections. I have the problem that we're also using older phones which only support TLS 1.0.
Error message is:
tport_tls.c:157 tls_log_errors() TLS setup failed: 14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol
Works fine here:
4 0.004770 192.168.0.120 → 192.168.0.1 TLSv1 464 Client Hello 6 0.193706 192.168.0.1 → 192.168.0.120 TLSv1.2 1514 Server Hello 7 0.193809 192.168.0.1 → 192.168.0.120 TLSv1.2 871 Certificate, Server Key Exchange, Server Hello Done 10 0.256056 192.168.0.120 → 192.168.0.1 TLSv1.2 141 Client Key Exchange 12 0.269076 192.168.0.120 → 192.168.0.1 TLSv1.2 72 Change Cipher Spec 14 0.269344 192.168.0.120 → 192.168.0.1 TLSv1.2 103 Encrypted Handshake Message
With openssl s_client I can also connect with TLS1.0, 1.1, 1.2 and 1.3 (which suggests that FS isn't using system openssl config).
Actually it doesn't work fine here after all. I had updated /etc/ssl/openssl.cnf with the Debian changes, but actually openssl_conf = default_conf was overwritten by some OpenWrt config snippet later. I amended that and now when I set tls_version to something specific I get 4 0.010062 192.168.0.120 → 192.168.0.1 TLSv1 464 Client Hello 6 0.010927 192.168.0.1 → 192.168.0.120 TLSv1.2 73 Alert (Level: Fatal, Description: Protocol Version) and when I leave it unset I get 4 0.009440 192.168.0.120 → 192.168.0.1 TLSv1 464 Client Hello 6 0.010884 192.168.0.1 → 192.168.0.120 TLSv1.2 73 Alert (Level: Fatal, Description: Handshake Failure) Regards, Seb