Return to SSL-PROBLEMS.md CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / curl / docs

Annotation of embedaddon/curl/docs/SSL-PROBLEMS.md, revision 1.1.1.1

1.1       misho       1:                                   _   _ ____  _
                      2:                               ___| | | |  _ \| |
                      3:                              / __| | | | |_) | |
                      4:                             | (__| |_| |  _ <| |___
                      5:                              \___|\___/|_| \_\_____|
                      6: 
                      7: # SSL problems
                      8: 
                      9:   First, let's establish that we often refer to TLS and SSL interchangeably as
                     10:   SSL here. The current protocol is called TLS, it was called SSL a long time
                     11:   ago.
                     12: 
                     13:   There are several known reasons why a connection that involves SSL might
                     14:   fail. This is a document that attempts to details the most common ones and
                     15:   how to mitigate them.
                     16: 
                     17: ## CA certs
                     18: 
                     19:   CA certs are used to digitally verify the server's certificate. You need a
                     20:   "ca bundle" for this. See lots of more details on this in the SSLCERTS
                     21:   document.
                     22: 
                     23: ## CA bundle missing intermediate certificates
                     24: 
                     25:   When using said CA bundle to verify a server cert, you will experience
                     26:   problems if your CA cert does not have the certificates for the
                     27:   intermediates in the whole trust chain.
                     28: 
                     29: ## Protocol version
                     30: 
                     31:   Some broken servers fail to support the protocol negotiation properly that
                     32:   SSL servers are supposed to handle. This may cause the connection to fail
                     33:   completely. Sometimes you may need to explicitly select a SSL version to use
                     34:   when connecting to make the connection succeed.
                     35: 
                     36:   An additional complication can be that modern SSL libraries sometimes are
                     37:   built with support for older SSL and TLS versions disabled!
                     38: 
                     39:   All versions of SSL are considered insecure and should be avoided. Use TLS.
                     40: 
                     41: ## Ciphers
                     42: 
                     43:   Clients give servers a list of ciphers to select from. If the list doesn't
                     44:   include any ciphers the server wants/can use, the connection handshake
                     45:   fails.
                     46: 
                     47:   curl has recently disabled the user of a whole bunch of seriously insecure
                     48:   ciphers from its default set (slightly depending on SSL backend in use).
                     49: 
                     50:   You may have to explicitly provide an alternative list of ciphers for curl
                     51:   to use to allow the server to use a WEAK cipher for you.
                     52: 
                     53:   Note that these weak ciphers are identified as flawed. For example, this
                     54:   includes symmetric ciphers with less than 128 bit keys and RC4.
                     55: 
                     56:   Schannel in Windows XP is not able to connect to servers that no longer
                     57:   support the legacy handshakes and algorithms used by those versions, so we
                     58:   advice against building curl to use Schannel on really old Windows versions.
                     59: 
                     60:   References:
                     61: 
                     62:   https://tools.ietf.org/html/draft-popov-tls-prohibiting-rc4-01
                     63: 
                     64: ## Allow BEAST
                     65: 
                     66:   BEAST is the name of a TLS 1.0 attack that surfaced 2011. When adding means
                     67:   to mitigate this attack, it turned out that some broken servers out there in
                     68:   the wild didn't work properly with the BEAST mitigation in place.
                     69: 
                     70:   To make such broken servers work, the --ssl-allow-beast option was
                     71:   introduced. Exactly as it sounds, it re-introduces the BEAST vulnerability
                     72:   but on the other hand it allows curl to connect to that kind of strange
                     73:   servers.
                     74: 
                     75: ## Disabling certificate revocation checks
                     76: 
                     77:   Some SSL backends may do certificate revocation checks (CRL, OCSP, etc)
                     78:   depending on the OS or build configuration. The --ssl-no-revoke option was
                     79:   introduced in 7.44.0 to disable revocation checking but currently is only
                     80:   supported for Schannel (the native Windows SSL library), with an exception
                     81:   in the case of Windows' Untrusted Publishers blacklist which it seems can't
                     82:   be bypassed. This option may have broader support to accommodate other SSL
                     83:   backends in the future.
                     84: 
                     85:   References:
                     86: 
                     87:   https://curl.haxx.se/docs/ssl-compared.html