Fresh install of Ubuntu here and trying to use the SSLScan tool, only to find out that I get these error:

OpenSSL version does not support SSLv2
SSLv2 ciphers will not be detected

OpenSSL version does not support SSLv3
SSLv3 ciphers will not be detected
Testing SSL server xyzx on port 443

  TLS renegotiation:
Session renegotiation not supported

  TLS Compression:
OpenSSL version does not support compression
Rebuild with zlib1g-dev package for zlib support

I found some article online on trying to re-compile OpenSSL without those flags being explicitly disabled, but I can't even get past the first few steps in some of these guides. For example, one guide recommends running sudo apt-get build-dep openssl. I can't run that because then I get the following error:

[03.14.2017/23:47:31] user@box $ sudo apt-get build-dep openssl
Reading package lists... Done
E: You must put some 'source' URIs in your sources.list

Although I have many uncommented sources in my /etc/apt/sources.list file.

Any suggestions? I just want to enable SSLv2 and SSLv3, and at least enable compression too. Can I just simply re-enable all of the disabled features?

  • Did you get it work? I have similar problem i need opessl s_client to support -ssl2 and -ssl3 flags. I found some work around. If you interest lets discuss it online. You can contact using gtalk khamidulla@inoyatov.com
    – Khamidulla
    Mar 17 '17 at 12:44
  • Nope I haven't found a solution yet. I'm not all that familiar with compiling and stuff too so I just left it alone :( Mar 17 '17 at 14:38

My solution was to build just the openssl binary to avoid overwriting the system OpenSSL installation:

wget https://openssl.org/source/openssl-1.0.2k.tar.gz
tar -xvf openssl-1.0.2k.tar.gz
cd openssl-1.0.2k/
# --prefix will make sure that make install copies the files locally instead of system-wide
# --openssldir will make sure that the binary will look in the regular system location for openssl.cnf
# no-shared builds a mostly static binary
./config --prefix=`pwd`/local --openssldir=/usr/lib/ssl enable-ssl2 enable-ssl3 no-shared
make depend
make -i install
sudo cp local/bin/openssl /usr/local/bin/

To test:

$ openssl s_client -connect google.com:443 -ssl2
139675635414688:error:1407F0E5:SSL routines:ssl2_write:ssl handshake failure:s2_pkt.c:412:

$ openssl s_client -connect google.com:443 -ssl3
140647504119456:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:365:

I've got a more complete script here if you're interested: https://gist.github.com/bmaupin/8caca3a1e8c3c5686141

  • should also add enable-ssl3-method to ./config , at least if you want to link it to curl and use ssl3 in curl
    – hanshenrik
    May 31 '19 at 12:36

I also had this exact problem! (And this post is now the first hit on Google.)

I solved it by building sslscan myself, with static linking; this puts the SSLv2 and SSLv3 support into the executable itself. It might be dangerous to have the global openssl library support old vulnerable protocol versions.

The source code repo for sslscan is here: https://github.com/rbsec/sslscan

I could not get the instructions there to work without problems, because I did not have any deb-src lines in /etc/apt/sources.list, giving the error:

E: You must put some 'source' URIs in your sources.list

However, I ignored the error and it worked for me anyway. Building took about 10 minutes on my laptop (-j flag did not work). The build failed once for some reason (test not passing) but compiling again made it work.

TL;DR: Run:

sudo apt-get install build-essential git zlib1g-dev

git clone https://github.com/rbsec/sslscan.git
cd sslscan
make static

Verify the output

./sslscan --version
                OpenSSL 1.0.2-chacha (1.0.2g-dev)

I ran into the same error. Uncommenting all the lines beginning with deb-src in /etc/apt/sources.list that had matching uncommented lines followed by a sudo apt-get upgrade cleared up the error for me on Ubuntu 16.04.

I was mostly following https://www.hackwhackandsmack.com/?p=46 and now I have ssl3 working (I think I missed an extra flag for ssl2, so just a heads up to double check you get all the patches/series and rules options set).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.