Post #2788447

uugh, clients… at $work, one of the things we do involves sending HTTP requests to client-controlled servers (the details are really irrelevant) some clients are… special this one is getting on my nerves some time ago, they renewed their TLS certificates, and for reasons nobody can understand, changed their DH key echange parameters; OpenSSL complained SSL connect attempt failed error:0A00018A:SSL routines::dh key too small we exchanged some email, had a video conference, and they didn't understand the problem, and insisted we fix it on our side; did you know that OpenSSL from 2017 doesn't have a problem with too-small DH keys? and did you know that companies are still running that ancient version in production, and don't see a problem with it? luckily, telling our code to not accept TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, makes the protocol negotiation pick a ECDHE suite, which works and then we got a different error: a HTTP 403, with a plain text error code in the body turns out, if our request doesn't have a user-agent header, their server refuses to talk to us; we fixed that without even telling them a few days later, requests to one of their test servers started failing again this time, the TLS layer is fine, but whatever I send to the server, it always replies with P just one byte, P no newline, not even proper TLS shutdown. P and then closes the socket. I'm getting Ped off!