Uploaded image for project: 'Thrift'
  1. Thrift
  2. THRIFT-4986

cipher "TLSv1.2" returns SSL_CTX_set_ciper_list: bad value

    XMLWordPrintableJSON

Details

    • Question
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 0.10.0
    • None
    • C++ - Library
    • None

    Description

      Error occured after Debian upgrade.

      There is a class: 

      .hpp

class SSLSocketTransportFactory
        : public apache::thrift::transport::TSSLSocketFactory
{
public:
    SSLSocketTransportFactory(
        bool is_server,
        const std::string& crt_path,
        const std::string& key_path,
        const std::string& server_ca_path,
        boost::shared_ptr<apache::thrift::transport::AccessManager>);

    ~SSLSocketTransportFactory() = default;
};

       

      .cpp

SSLSocketTransportFactory::SSLSocketTransportFactory(
    bool is_server,
    const std::string& crt_path,
    const std::string& key_path,
    const std::string& server_ca_path,
    boost::shared_ptr<apache::thrift::transport::AccessManager> acc_mgr)
        : TSSLSocketFactory(apache::thrift::transport::TLSv1_2)
{
    this->ciphers("TLSv1.2"); <<----- Error occured
    this->authenticate(true);
    this->server(is_server);
    this->loadCertificate(crt_path.c_str());
    this->loadPrivateKey(key_path.c_str());
    this->loadTrustedCertificates(server_ca_path.c_str());
    this->access(acc_mgr);
}

       

      On Debian 9.6 worked fine!

      Now I have Debian 10. It compiled fine. But in run-time setting ciphers: 

      this->ciphers("TLSv1.2");

      returns:

      SSL_CTX_set_ciper_list: bad value

       

      Additional info.

      I have another server - POCO server. There I'm using ciphers from an example:

      ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH

      It worked on both Debian.

      I don't know much what ciphers are, but I decided to use these ciphers in Apache Thrift. I expected that it gonna work at Apache Thrift too as it worked in POCO.

      I got the same error!

      Attachments

        Activity

          People

            Unassigned Unassigned
            avovana Vladimir Nevzorov
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: