After updating openssl on our dev server to version 1.0.1-4ubuntu5.31, a script that contains a curl command to a specific server no longer connects. We were running openssl 1.0.1-4ubuntu5.25. Curl performs the initial connection successfully. The problem comes into play when we ar trying the GET and receive the error:

GET /some/directory/on_the_remote_server HTTP/1.1
User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/ libidn/1.23 librtmp/2.3
Host: host.connection.com
Accept: */*

* SSLv3, TLS handshake, Hello request (0):
* SSLv3, TLS handshake, Client hello (1):
* SSL read: error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure, errno 0
* Closing connection #0
curl: (56) SSL read: error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure, errno 0

(This has been sanitized to protect private information)

I've verified there are no changes on the connecting server. Any help would be greatly appreciated as I have not been able to find anything on fixing this error.

  • If you roll back to the previous version, does curl work fine? – muru Jul 28 '15 at 17:18
  • Muru, it doesn't appear to be an option. When looking at the versions on the system there is the most recent version that is currently running and an archaic version. So, unfortunately this was not an option. Thanks. – Lee Higginbotham Jul 28 '15 at 19:55

Without having more detail about the server my guess is that the server uses weak Diffie-Hellmann keys and that the SSL handshake will fail because OpenSSL was fixed to enforce stronger DH keys. The reason for this fix are the recent publication of the Logjam attack.

From the Changelog

  • SECURITY IMPROVEMENT: reject dh keys smaller than 768 bits ...

Affected are only DH ciphers. To disable use of DH ciphers you might use the ciphers option, i.e.

  curl --ciphers 'DEFAULT:!DH' url

But you should also fix your server. For more information on how to do this see here.

  • Steffen, thank you very much for your quick reply and the solution! Now, I just have to get it fixed! You are awesome, Sir! Sincerely, Lee – Lee Higginbotham Jul 28 '15 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.