TLS handshake error

[Дмитрий Михирев]

Hi!

I used psi+ on Debian 9 and that worked fine, but I've recently updated to Debian 10 and now I'm unable to connect to one server (with both psi and psi+). The popup message "TLS handshake error" is shown, and in consile output I see multiple messages "Unknown signature value:  795 (unknown:0, unknown)". I suspect that the reason can be somewhere in new openssl or, maybe, qt, but I have no idea how to debug this issue. Can you suggest something?

BTW gajim and swift are also unable to connect to this server from my system, but pidgin and dino connects successfully.

[Boris Pek]

Hi,

> I used psi+ on Debian 9 and that worked fine, but I've recently updated to Debian 10 and now I'm unable to connect to one server (with both psi and psi+). The popup message "TLS handshake error" is shown, and in consile output I see multiple messages "Unknown signature value:  795 (unknown:0, unknown)". I suspect that the reason can be somewhere in new openssl or, maybe, qt, but I have no idea how to debug this issue. Can you suggest something?
>
> BTW gajim and swift are also unable to connect to this server from my system, but pidgin and dino connects successfully.

Is this server "gmail.com"?

--
Boris

[Dmitry Mikhirev]

В Wed, 08 May 2019 19:33:10 +0300
Boris Pek <tehn...@yandex.ru> пишет:

>
> Is this server "gmail.com"?
>

No. There is another problem with gmail.com caused by missing SNI, but
in that case psi complains self-signed certificate. (Yes, I'm also
waiting for this issue to be fixed.)

This is a private server, that was not updated for a long time, so I
guess, it can lack support of some modern protocols/cyphers, but how
can I know for sure?

--
Regards,
Dmitry Mikhirev

[Boris Pek]

>>  Is this server "gmail.com"?
>
> No. There is another problem with gmail.com caused by missing SNI, but
> in that case psi complains self-signed certificate. (Yes, I'm also
> waiting for this issue to be fixed.)

I see.

> This is a private server, that was not updated for a long time, so I
> guess, it can lack support of some modern protocols/cyphers, but how
> can I know for sure?

In this case check which TLS version is used in your private server.

TLS 1.0 and 1.1 were disabled in OpenSSL from Debian Buster:
https://lists.debian.org/debian-devel-announce/2017/08/msg00004.html

--
Boris

[Dmitry Mikhirev]

В Wed, 08 May 2019 20:11:27 +0300
Boris Pek <tehn...@yandex.ru> пишет:

> > This is a private server, that was not updated for a long time, so I
> > guess, it can lack support of some modern protocols/cyphers, but how
> > can I know for sure?
>
> In this case check which TLS version is used in your private server.
>

How can I do this if I'm not an admin of this server?

--
Regards,
Dmitry Mikhirev

[Boris Pek]

>>  TLS 1.0 and 1.1 were disabled in OpenSSL from Debian Buster:
>>  https://lists.debian.org/debian-devel-announce/2017/08/msg00004.html
>

> Well, after setting MinProtocol = TLSv1.0 in /etc/ssl/openssl.cnf I'm
> able to connect. Is there any way to change this setting for Psi only,
> without affecting the entire system?

No, this is OpenSSL internal issue.

More other, Psi don't use it directly: OpenSSL is used via OSSL plugin from QCA library.

--
Boris

[tony peter]

Hello,
I Appreciate your swift response and apologies for replying late. Please see below-attached listing interested for your reference. Please advise when we can meet for better discussion. Thank you.

Regards,

Download Image

Download Image

Download Image

Download Image

Download Image

--
You received this message because you are subscribed to the Google Groups "Psi-Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to psi-users+...@googlegroups.com.
To post to this group, send email to psi-...@googlegroups.com.
Visit this group at https://groups.google.com/group/psi-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/psi-users/26484441557757367%40iva8-3b901672a9c5.qloud-c.yandex.net.
For more options, visit https://groups.google.com/d/optout.

--

Hello,

         How are you doing? I have come across your profile and I am interested in your services as a Real Estate Agent kindly let me know when you will be available.

Thanks,

Controller

Tony Peter