<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On May 1, 2014, at 1:08 PM, Hynek Schlawack <<a href="mailto:hs@ox.cx">hs@ox.cx</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">On 1 May 2014, at 21:28, Glyph Lefkowitz wrote:</span><br style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><blockquote type="cite" style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><blockquote type="cite">When I connect to the hosts you mention using openssl (don’t forget to set -servername if you play along) I only get TLSv1. Is it possible that there’s some custom TLS code laying around?<br></blockquote><br>As far as I can see, only <<a href="https://github.com/glyph/txsni">https://github.com/glyph/txsni</a>>. It constructs the CertificateOptions in <<a href="https://github.com/glyph/txsni/blob/master/txsni/only_noticed_pypi_pem_after_i_wrote_this.py">https://github.com/glyph/txsni/blob/master/txsni/only_noticed_pypi_pem_after_i_wrote_this.py</a>> (whose name suggests a change I need to make to this library). Am I forgetting some cool new options to CertificateOptions?<br></blockquote><br style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">If you want DHE, you need to load DH parameters:</span><a href="http://twisted.readthedocs.org/en/latest/core/howto/ssl.html#tls-protocol-options" style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">http://twisted.readthedocs.org/en/latest/core/howto/ssl.html#tls-protocol-options</a><span style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;"><span class="Apple-converted-space"> </span>too.</span><br style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"></blockquote><div><br></div><div>I'm going to make txsni use pem, and then get the automagical DH params version with 0.4 ;-).</div><br><blockquote type="cite"><span style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">Why your server only accepts TLSv1 is beyond me off the cuff.</span><br style="font-family: Menlo-Regular; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"></blockquote><div><br></div><div>Oh hah, I think I got it: in order to do SNI with OpenSSL, you need an _initial_ context. For me, in txSNI, that's an incredibly poorly-set-up one just specifying TLSv1_METHOD, here: <<a href="https://github.com/glyph/txsni/blob/master/txsni/snimap.py#L11">https://github.com/glyph/txsni/blob/master/txsni/snimap.py#L11</a>></div><div><br></div><div>I should probably have a default DEFAULT.pem symlink in there or something.</div><div><br></div><div>Another name hosted on that domain is <<a href="https://www.ssllabs.com/ssltest/analyze.html?d=glyph.twistedmatrix.com">https://www.ssllabs.com/ssltest/analyze.html?d=glyph.twistedmatrix.com</a>> which doesn't have any of the spurious chain errors.</div><div><br></div><div>-glyph</div><div><br></div></div></body></html>