| Summary: | kde-base/konqueror-3.5.10 can not connect to a SSL website | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Anton Bolshakov <anton.bugs> |
| Component: | Current packages | Assignee: | Gentoo KDE team <kde> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | normal | ||
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: |
konqueror messages in a console
.xsession-error file |
||
|
Description
Anton Bolshakov
2008-06-06 05:22:24 UTC
Created attachment 155673 [details]
konqueror messages in a console
Created attachment 155675 [details]
.xsession-error file
So, the actual error is:
kssl: Setting real hostname: internet-banking.dbs.com.sg
kssl: KSSL connect failed - rc = 0
kssl: ERROR = 5
ok, the problem is that I don't have DES-CBC3-SHA(168) under sslv3 (KDE control center -> crypto) tab. I have DES-CBC-SHA (56bit) only. It works fine if I enable sslv2 tab with this cipher. Looks like this is a problem of KDE and they have to review some ciphers in there. Please correct me if I'm wrong. > It works fine if I enable sslv2 tab with this cipher.
SSLv2 means using md5 not sha1. Am I right to assume that this is the cipher you have enabled? SSLv2 is considered unsafe nowadays and all browser providers are on the verge disabling it or already have done so.
I can confirm, that Konqueror doesn't list the triple DES 168 bit SHA1 cipher, even though `openssl ciphers -v SSLv3` does.
uh, assign... >Am I right to assume that this is the cipher
you have enabled?
Yes, sorry for the confusion.
Just for the record, I can't connect using openssl sslv2:
openssl s_client -ssl2 -no_ssl3 -no_tls1 -showcerts -connect internet-banking.dbs.com.sg:443
I also can't connect using weak ciphers:
openssl s_client -showcerts -cipher NULL,EXPORT,LOW -connect internet-banking.dbs.com.sg:443
output: SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
I'm wondering how sslv2 in konqueror's crypt tab helps in that case?..
(In reply to comment #4) > SSLv2 means using md5 not sha1. Am I right to assume that this is the cipher > you have enabled? SSLv2 is considered unsafe nowadays and all browser providers > are on the verge disabling it or already have done so. > > > I can confirm, that Konqueror doesn't list the triple DES 168 bit SHA1 cipher, > even though `openssl ciphers -v SSLv3` does. > I've had a similar problem (konqueror 3.5.5 on debian) trying to access a https site (on our LAN) which really wants to use DES-CBC3-SHA cipher. DES-CBC3-SHA doesn't show up on konq's crypto tab. Only by disabling both sslv2 and sslv3 in konquerer's crypto tab does it start working (for some reason this lets konquerer use DES-CBC3-SHA). Can you try rebuilding kde-base/kdelibs with the 'legacyssl' USE flag enabled. You will probably also need to rebuild KDE against the newly rebuilt kdelibs. The 'legacyssl' USE flag re-instates the missing DES-CBC3-SHA cipher which was removed by upstream around 3.5.4 (?). (In reply to comment #8) Thanks for the tip Rick. I rebuilt it as suggested but still can't find DES-CBC3-SHA under SSLv3 list although тhe patch looks all right: - if (j->name.contains("ADH-") || j->name.contains("NULL-") || j->name. contains("DES-CBC3-SHA") || j->name.contains("FZA")) { + if (j->name.contains("ADH-")) { Anyway, the problem is clear now. Looks like this is a dup of bug #128922 ... *** This bug has been marked as a duplicate of bug 128922 *** |
