From owner-freebsd-ports@FreeBSD.ORG Tue Jun 2 00:03:17 2015 Return-Path: Delivered-To: freebsd-ports@FreeBSD.ORG Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 0071490 for ; Tue, 2 Jun 2015 00:03:16 +0000 (UTC) (envelope-from tundra@tundraware.com) Received: from ozzie.tundraware.com (ozzie.tundraware.com [75.145.138.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "ozzie.tundraware.com", Issuer "ozzie.tundraware.com" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id A668E159F for ; Tue, 2 Jun 2015 00:03:16 +0000 (UTC) (envelope-from tundra@tundraware.com) Received: from [192.168.0.2] (viper.tundraware.com [192.168.0.2]) (authenticated bits=0) by ozzie.tundraware.com (8.14.9/8.14.9) with ESMTP id t5202v8D015107 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Mon, 1 Jun 2015 19:02:57 -0500 (CDT) (envelope-from tundra@tundraware.com) Message-ID: <556CF2B1.30100@tundraware.com> Date: Mon, 01 Jun 2015 19:02:57 -0500 From: Tim Daneliuk User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: d@delphij.net, FreeBSD Ports Mailing List Subject: Re: Port Fetch Failing References: <556CEBE2.7030005@tundraware.com> <556CEEB8.2090406@delphij.net> In-Reply-To: <556CEEB8.2090406@delphij.net> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.4.3 (ozzie.tundraware.com [75.145.138.73]); Mon, 01 Jun 2015 19:02:57 -0500 (CDT) X-TundraWare-MailScanner-Information: Please contact the ISP for more information X-TundraWare-MailScanner-ID: t5202v8D015107 X-TundraWare-MailScanner: Found to be clean X-TundraWare-MailScanner-From: tundra@tundraware.com X-Spam-Status: No X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jun 2015 00:03:17 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/01/2015 06:46 PM, Xin Li wrote: > You seem to be using FreeBSD 9.x which does not support TLSv1.1 and > TLSv1.2. No, it is 10.1-Stable > Disabling SSLv3 ciphers means there would be no cipher available for > TLSv1 negotiation: > > % openssl ciphers 'TLSv1:-SSLv3' > Error in cipher list > 34379234072:error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no > cipher > match:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/ssl_lib.c:1 > 294: > > So, no negotiation would succeed in this case. > > I find your CipherSuite quite problematic, by the way. Why do you > enable eNULL there for instance? This is what happens when you are: A) In a hurry and B) Paranoid and C) Willing to copypasta a config without thought :( Thanks to you and Chuck, I have a more reasonable (I think): SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP:-eNULL:-SSLv3:-SSLv2:TLS_RSA_WITH_AES_256_CBC_SHA:TLS_RSA_WITH_AES_256_CBC_SHA256 Thanks for your prompt response, - -- - ---------------------------------------------------------------------------- Tim Daneliuk tundra@tundraware.com PGP Key: http://www.tundraware.com/PGP/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQIcBAEBAgAGBQJVbPKxAAoJEMLZ2alfelsnB1YP/AhzECzSgJPW6SbcjR4mJiGF dg2ywz36W/BDcxj1jPnLdf99b0NTlGe6FMVtGi9GpcVVO1EpKbZS9jtHx4okPlYH oOAIZnedF0+g/M2HOLLsij4EexQo2vcxyZ+S+DaKJkx4j9J2MQCMfzmDMDV3vr1m 7ErxipWuUq9+uoSJXE+JsvP3U2spmG+LGs/l2gIHwv7E2fvf63Ozb1Eo9e8NgLpf 9VO7jrghJDIGy4MUqWxMV6gqBl04rite0A46OUrJCvz78fB50YIW2tZXGafGpZ+H jd0uAqpTukvvxiVXYHpO+EWhIJpgbI96FgizZ7Zp6jPrAALC+hAfE7JA5OkLAMno CPvTj8jIn7SfF4e27OvhstDrUlJ3xuldKY3zbSebAK7Tee7i7oTU7h/6aKFv3fat o7qB89LUQZfFRMvrReiXVHlUawYUcE2YKSpuu0ZOOux12kb1wc7Yes08xDOj6lkH OTOUw7RWnvgm2exbzfzNBCZI/qa7VFixfB89eavP7Cfc2sYWTdrHky45yroLXABK Ek8w49iQnio3wf/sWuzymCJQ+aMMaA/vGzr/cDampYSBwXkEX6Rql8oh83hQST50 2ZNHGVjwzOgxs+4xUYpQTEzvtzX8DmbMNNUkBk9Bfiv67mTMHn3xV3cayFgA+Aq2 CihAOZ94Oi+UhAT34PKP =vMg0 -----END PGP SIGNATURE-----