crypto/tls: remote error: handshake failure

[webluoye]

go version:1.4
connect to server with ssl get error msg "remote error: handshake failure"

code:
ipConn, err := net.DialTCP("tcp", ladd, radd)
conn := tls.Client(ipConn, tlsconfig)
hsErr := conn.Handshake()

use openssl is ok
openssl s_client -connect ote1.dotasia.net:700 -cert certs/crt -key certs/key -showcerts -state

Key-Arg   : None
Krb5 Principal: None
Start Time: 1419581515
Timeout   : 300 (sec)
Verify return code: 0 (ok)

[minux]

If the server requires client certificate, have you set your tlsconfig
correctly?
Please show more of your code.

[webluoye]

cert, err := tls.LoadX509KeyPair(eppConfig.crtPath, eppConfig.keyPath)
printLog("loadcert errors", err)
tlsConfig = tls.Config{Certificates: []tls.Certificate{cert}, ClientAuth: tls.VerifyClientCertIfGiven, InsecureSkipVerify: true}
ladd, lerr := net.ResolveTCPAddr("tcp", eppConfig.LocalIp+":0")
printLog("bind local ip error", lerr)
radd, rerr := net.ResolveTCPAddr("tcp", eppConfig.server+":"+eppConfig.port)
printLog("connect to server error", rerr)
return ladd, radd, tlsConfig

[quipo]

Reproducing script:

package main

import (
    "crypto/tls"
    "fmt"
    "net"
)

func resolve(u string) {
    dialer := new(net.Dialer)
    rawConn, err := dialer.Dial("tcp", u)
    if err != nil {
        fmt.Println("failed to dial: ", err.Error())
        return
    }
    config := &tls.Config{InsecureSkipVerify: true}
    conn := tls.Client(rawConn, config)
    fmt.Println(u, conn.Handshake())
    conn.Close()
}

func main() {
    failingUrls := []string{
        "www.vineclient.com:443",
        "www.freespeech.org:443",
        "www.visa.go.kr:443",
        "pressroom.turner.com:443",
        "robertsspaceindustries.com:443",
    }
    for _, u := range failingUrls {
        resolve(u)
    }
}

[quipo]

Reproducing script using an http client directly:

package main

import (
    "crypto/tls"
    "fmt"
    "net/http"
    "time"
)

func resolve(u string) {
    transport := &http.Transport{
        MaxIdleConnsPerHost: 250,
        TLSClientConfig: &tls.Config{
            InsecureSkipVerify: true,
        },
    }
    client := http.Client{
        Transport: transport,
        Timeout:   15 * time.Second,
    }

    fmt.Println(client.Get(u))
}

func main() {
    failingUrls := []string{
        "https://www.vineclient.com",
        "https://www.freespeech.org",
        "https://www.visa.go.kr",
        "https://pressroom.turner.com",
        "https://robertsspaceindustries.com",
    }
    for _, u := range failingUrls {
        resolve(u)
    }
}

[ebfe]

www.vineclient.com:443 seems to only accept TLS_DHE_* ciphersuites
pressroom.turner.com:443 seems to only accept TLS_RSA_WITH_RC4_128_MD5

These ciphersuites are not available in crypto/tls.

[bradfitz]

@agl, should crypto/tls return more details than just "remote error: handshake failure" ?

[agl]

"remote error: handshake failure" means that the peer sent us a numeric error code that means "handshake error". In this case we don't have any additional information to return even if we wanted to.

[rsc]

It doesn't sound like there's much we can do about this.
These servers don't like our client and they don't tell us why.
It's unfortunate.

[quipo]

well, the problem seems to be a difference in supported ciphersuites between the client and the server (see @ebfe's comment above).

It might get solved once the missing ciphersuites are available in crypto/tls.

[webluoye]

go 1.5 test ok