Cipherlist problems

[wolfgangbures]

I set the cipherlist in code like this:

    SSLStack.SSLOptions.CipherList := 'TLSv1.2:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:' +
      'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:' + 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:' +
      'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:' + 'ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:' +
      'ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:' + 'DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:' +
      'DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256';
    SSLStack.SSLOptions.SSLVersions := [sslvTLSv1_2];

the idea is to match a phyton module with the following information

$ openssl ciphers '@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!eNULL:!aDSS:!SHA1:!AESCCM' 
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-CHACHA20-POLY1305
ECDHE-RSA-CHACHA20-POLY1305
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA256
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES256-SHA256
DHE-RSA-AES128-SHA256

On connection from this module I get
"SSL. error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher" (EIdOSSLUnderlyingCryptoError)

[rlebeau]

You are setting your SSLStack to use only TLS 1.2, but your cipher list contains several TLS 1.3 ciphers.

Remember that TIdSSLIOHandlerSockeetOpenSSL still targets only up to OpenSSL 1.0.2, so don't use unsupported ciphers:

https://docs.openssl.org/1.0.2/man1/ciphers/

If you need TLS 1.3, there are alternatives available until Indy is updated.

Did you look at the TLS handshake with a packet sniffer to see what ciphers the peer is offering? Also, do you have any certificates assigned to your SSLStack?

[wolfgangbures]

I have cleared the ciphers (and added the code for the cert)

    OpenSSLStack.SSLOptions.RootCertFile := '.\root.crt';
    OpenSSLStack.SSLOptions.KeyFile := '.\cert.key';
    OpenSSLStack.SSLOptions.CertFile := '.\cert.crt';
    OpenSSLStack.SSLOptions.CipherList :=
  'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:' +
  'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:' +
  'ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:' +
  'ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:' +
  'DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:' +
  'DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256';

    OpenSSLStack.SSLOptions.SSLVersions := [sslvTLSv1_2];

Trying to debug that handshake still...