Fixing SSL Handshake Error: Not Connecting to Server Providing Certificates Signed Using SHA1RSA (Linux, OpenSSL 3)

Fixing SSL Handshake Error: Not Connecting Server Providing Certificates Signed Using SHA1 RSA (Linux, OpenSSL 3)

In this article, we will discuss the issue of SSL handshake errors when connecting to a legacy SQL server using Linux and OpenSSL 3. Specifically, we will focus on the scenario where the server provides certificates signed using SHA1 RSA, causing the connection to fail.

Understanding SSL Handshake Errors

An SSL handshake error occurs when the client and server fail to establish a secure connection due to issues with the SSL/TLS certificate. This can happen for several reasons, including the use of outdated or unsupported encryption algorithms, invalid certificates, or mismatched certificate details.

Analyzing the Traffic with Wireshark

To diagnose the issue in this scenario, we can use a network protocol analyzer like Wireshark to capture and analyze the traffic between the client and server. In this case, we found that the server was providing certificates signed using SHA1 RSA, which is no longer considered secure and is not supported by OpenSSL 3 by default.

Configuring OpenSSL to Support SHA1 RSA Certificates

To fix the SSL handshake error, we need to configure OpenSSL to support SHA1 RSA certificates. This can be done by modifying the OpenSSL configuration file, which is typically located at /etc/ssl/openssl.cnf.

]]>

In the [ system_default_sect ] section of the configuration file, we need to set the MinProtocol to SSLv3 and the CipherString to exclude SHA1. This will allow OpenSSL to negotiate a secure connection with the server while still validating the certificate.

Testing the Connection

After modifying the OpenSSL configuration file, we can test the connection to the SQL server using the following command:


: -CAfile  -cipher SHA1:!MD5

]]>

In this command, we specify the server's address and port, the path to the certificate file, and the cipher to use (SHA1, excluding MD5). This should establish a secure connection with the server and allow us to perform SQL queries.

Summary and References

In this article, we discussed the issue of SSL handshake errors when connecting to a legacy SQL server using Linux and OpenSSL 3. Specifically, we focused on the scenario where the server provides certificates signed using SHA1 RSA, causing the connection to fail. By configuring OpenSSL to support SHA1 RSA certificates and testing the connection using the openssl s_client command, we can establish a secure connection and perform SQL queries.


Wireshark SSL Documentation
OpenSSL Configuration File Format
Configuring OpenSSL to Support SHA-1 Ciphers